HSBC Australia fined A$35 million over scam protection failures

HSBC Bank Australia Limited has been ordered to pay A$35 million after a Federal Court penalty over failures that left customers exposed to scams, unauthorized transfers and long delays in getting their money and account access back. The court also required the bank to publish adverse publicity notices on its website, in its app and in letters to affected customers, an unusually public sanction designed to put the failures in plain view.

The Australian Securities and Investments Commission said HSBC received about 950 reports of unauthorized transactions between January 2020 and August 2024, producing about A$23 million in customer losses. Almost A$16 million of those losses landed in just six months, from October 2023 to March 2024, when impersonation scams surged and fraudsters posed as HSBC staff to trick account holders. ASIC said the bank took an average of 145 days to investigate scam reports and 95 days to restore full access to locked accounts, while one customer allegedly waited 542 days to regain access.

HSBC admitted in agreed facts that unauthorized transaction reports jumped 380% in 2023 and 2024. The bank also admitted customers were exposed to a greater risk of unauthorized payments because of inadequate controls, including failures around internal transfer systems between May 2023 and May 2024. ASIC said HSBC had known as early as May 2021 about the growing impersonation scam problem, yet its safeguards still did not stop the losses from compounding.

The financial damage was not limited to account balances. HSBC has already paid about A$21.5 million in compensation and recovered A$6.5 million that has been returned to customers, with its remediation program expected to continue until July. ABC News reported that some customers had to borrow money, take extra shifts or worry about missing home-loan payments while waiting for their funds to be sorted out.

Sarah Court, ASIC’s chair, called the outcome “one of the first of its kind globally” and said it was the “strongest scam wake-up call yet” to the banking industry. Justice Bennett approved the penalty and ordered HSBC to pay ASIC’s costs. The case, filed in December 2024 and tracked through a public Federal Court file, now stands as a warning that banks can face large financial and reputational penalties not just for reimbursing scam victims, but for failing to prevent the frauds from taking hold in the first place.