What HSBC admitted
The bank’s admissions are detailed and damaging. HSBC acknowledged that between May 2023 and May 2024 it failed to maintain adequate controls on its internal transfer system, leaving customers exposed to a materially elevated risk of unauthorised payments. More troublingly, it admitted it had been aware of scammers impersonating HSBC staff since May 2021 – meaning the bank sat on that knowledge for two years before controls were improved.
During that period, reports of unauthorised transactions surged 380% in 2023 and 2024, driven overwhelmingly by impersonation scams in which criminals contacted customers by text or phone, purporting to be from HSBC, and extracted account credentials. ASIC’s investigation found that between January 2020 and August 2024 the bank received more than 1,000 reports of unauthorised transactions with a total value of A$34.6 million – roughly £18.2 million. Nearly half of that, approximately A$16 million, was lost in just six months between October 2023 and March 2024.
When customers did report being scammed, the bank’s response was, by its own admission, inadequate. HSBC acknowledged that investigations took an average of 144 days to complete – against a 21-day target under the Australian ePayments Code – and that it had insufficient systems to help customers regain access to accounts that had been locked after they reported fraud. In 749 cases, the bank failed to meet even the extended 45-day deadline for completing investigations.
The human cost
ASIC’s chair Sarah Court set out the human consequences of those failures in terms that a mortgage intermediary audience will understand viscerally.
Among those affected was a couple in their fifties who had A$48,000 taken directly from their home loan account. A 51-year-old dental technician lost A$47,000 – almost her entire savings. A 25-year-old architectural assistant lost A$50,000. A 41-year-old lost the same amount. In each case, the ASIC said the harm was compounded not just by the initial loss but by the bank’s failure to respond adequately once customers reported what had happened.