HSBC Bank Australia has agreed to pay a $35 million penalty after admitting it failed to protect customers from scams that cost some victims their life savings. The Federal Court found that HSBC did not maintain control of its internal transfer system, where significant client losses occurred. The bank conceded it breached the ePayments code by taking too long to investigate scam reports—about 144 days on average. It also failed to correctly apply rules when determining who should bear scam losses and lacked proper avenues for customers to regain access to locked accounts.
The matter was heard in the Federal Court on Thursday, where Justice Elizabeth Bennett said the breaches were serious and the $35 million penalty appropriate. HSBC was aware as early as May 2021 that scammers were impersonating its staff, yet failed to protect customers from financial and non-financial harm.
ASIC's Response
Australian Securities and Investments Commission (ASIC) chair Sarah Court said victims were collectively left tens of millions of dollars out of pocket and faced months of uncertainty, causing stress, guilt, and panic. Between January 2020 and August 2024, there were more than 950 reports of unauthorised transactions worth $34.6 million. Among those scammed were a 51-year-old dental technician who lost $47,000 and a Victorian couple in their 50s who had $48,000 transferred from their home loan.
Customer Impact
HSBC customers previously told 7NEWS.com.au how they were targeted in cruel scams and felt unheard. A Sydney man's plan to take his parents overseas was dashed when $50,000 was stolen, and a Melbourne woman's dream of home ownership vanished when the same amount disappeared from her account.
HSBC's Response
HSBC said it was pleased to have reached an agreement to resolve the proceedings. "We apologise to our customers who were impacted by these events," a spokesperson said. "We are pleased to have reached an agreement to resolve the proceedings with ASIC, which recognises our customer redress program and the significant enhancements made to our fraud and scam prevention, detection and response." The bank has been ordered to publish its wrongdoings through digital platforms and in letters to customers.
ASIC Chair's Warning
Court said the outcome is "one of the first of its kind globally." "The $35 million penalty ordered against HSBC is the strongest scam wake-up call yet to the banking industry," she said. "Banks have been well on notice about the risks of scams for some time. They have now been given a clear message to have adequate controls and ensure their interactions with scam victims help – not hinder."
ASIC, which commenced civil penalty proceedings against HSBC Bank Australia, said the bank had paid about $21.5 million in compensation through its remediation program to date, with more payments due before the end of July. The bank has also recovered and returned $6.5 million to customers.
