HSBC Bank Australia Limited (HSBC) has admitted to serious failures in protecting customers from scams that resulted in losses of tens of thousands of dollars for affected individuals, including their life savings. The Australian Securities and Investments Commission (ASIC) and HSBC are jointly asking the Federal Court to find that HSBC contravened the law and to impose a penalty of $35 million.
The proposed resolution is subject to the approval of the Federal Court, which will determine whether the proposed orders are appropriate and whether any other orders should be made. ASIC commenced civil penalty proceedings against HSBC on 13 December 2024, and the matter is being heard in the Federal Court on 18 June 2026.
Admitted failures and scam impact
Between January 2020 and August 2024, HSBC received more than 1,000 reports of unauthorised transactions, with a total transaction value of $34.6 million. HSBC has admitted that, between May 2023 and May 2024, it failed to have adequate controls on its internal transfer system, exposing customers to a greater risk of unauthorised payments.
HSBC was aware from May 2021 of the growing risk of impersonation scams, in which scammers posed as representatives of HSBC. Reports of unauthorised transactions surged by approximately 380% in 2023 and 2024, largely driven by these impersonation scams. HSBC has acknowledged that, because of its failure to adequately protect customers from scams, customers were placed at greater risk of financial and non-financial harm, and some suffered that harm.
Licence breaches and customer remediation
HSBC has admitted that it breached its financial services licence obligations due to major delays in investigating scam-related cases, which took an average of 144 days to finalise. The bank also had inadequate systems to inform customers how to regain access to accounts that were locked after a scam report.
Following ASIC's investigation, HSBC has established a large-scale remediation program. To date, HSBC has paid around $21.5 million in compensation to affected customers, with further payments expected. In addition, HSBC has recovered $6.5 million and returned those funds to customers.
Regulatory significance
ASIC Chair Sarah Court said this is one of the first cases of its kind globally and that it sends a clear message that protecting customers from scams is a core responsibility of banks. She noted that HSBC's failures left customers more vulnerable to scams, out of pocket by tens of millions of dollars, and waiting months to discover what had happened to their money.
The final outcome of the proceedings, including whether the proposed $35 million penalty and associated orders will be imposed, will be determined by the Federal Court.
