Bank's Global Scam Precedent
Federal Court Orders HSBC Australia to Pay $35M Penalty for Scam Protection Failures
Key Points
ASIC chair Sarah Court said the case is “one of the first cases of its kind globally” and that it “sends a clear message that protecting customers from scams is a core responsibility of banks.”
ASIC’s filing alleges HSBC Australia received about 950 reports of unauthorised transactions between January 2020 and August 2024, with customer losses of around $23 million, and describes the failures as “widespread and systemic.”
ASIC alleges HSBC lacked certain digital fraud-detection capabilities, including “biometric analysis and device identification capabilities,” and failed to meet required timeframes under the ePayments Code.
ASIC says average remediation timeframes were also excessive—about 145 days to investigate unauthorised-transaction reports and 95 days to reinstate banking access—with one customer allegedly waiting 542 days.
HSBC's Australian unit has agreed to a proposed A$35 million penalty after admitting it failed to protect customers from scams, with Australia's corporate regulator calling it "one of the first cases of its kind globally." ASIC says the bank left customers exposed to fraud for years — and in one case, a customer waited 542 days to get their money back.
Reuters reported that HSBC acknowledged serious failures and said it has since upgraded its fraud systems and launched a compensation program for affected customers. The proposed settlement still needs approval from the Federal Court of Australia.
ASIC Found Scam Warnings Ignored for Three Years
HSBC knew about rising impersonation scams targeting its Australian customers as early as 2021, according to ASIC. Yet the bank did not put adequate controls in place until years later. The critical gap — between May 2023 and May 2024 — was when ASIC says HSBC failed to maintain proper controls over its internal transfer systems, leaving customers at higher risk of losing money.
ABC News Australia reported that ASIC's filing describes the failures as "widespread and systemic." The regulator says HSBC received about 950 reports of unauthorised transactions between January 2020 and August 2024. Total customer losses came to roughly $23 million. ASIC also alleges HSBC lacked basic digital tools — including biometric analysis and device identification — that Australia's biggest banks already had in place by 2022.
Customers Waited Months — Sometimes Over a Year — for Help
When customers reported fraud, HSBC took an average of 144 days to investigate their complaints. It took another 95 days on average to restore access to their accounts. The Guardian reported that court documents allege at least one customer waited 542 days — nearly a year and a half — to regain access to their funds.
ASIC chair Sarah Court said the delays were "unacceptable" and caused customers "significant distress." She added that the case "sends a clear message that protecting customers from scams is a core responsibility of banks, not an optional extra." ASIC says these delays also breached the ePayments Code, a set of rules that governs how banks must handle unauthorised transactions, according to The Australian.
A$35 Million Fine Sets a Global Regulatory Benchmark
The proposed A$35 million penalty is pending approval from the Federal Court, which will decide if it meets the standard for deterrence, Sky News Australia reported. ASIC filed the lawsuit and announced the proposed settlement on the same day — a sign the two sides had already reached a deal. Legal experts told Bloomberg that ASIC is using HSBC as a test case to put mid-tier and international banks on notice.
Consumer group CHOICE welcomed the fine but noted it is a small fraction of HSBC's global profits, according to The Guardian. Analysts at Morningstar suggested other mid-tier banks — such as ING and Macquarie — may now fast-track spending on fraud detection to avoid a similar "systemic failure" label, the Australian Financial Review reported.
HSBC Points to Upgrades and a Compensation Program
HSBC said it is "sincerely" sorry to affected customers and has agreed to resolve the matter. The bank pointed to a customer compensation program it has already launched. It also said it has made major investments in AI-driven fraud detection and biometric tools — the same tools ASIC said it lacked during the period in question.
HSBC framed its past failures as a response to a "rapidly evolving scam landscape," according to Reuters. But ASIC's own timeline shows the bank had internal warnings about impersonation scams three years before it made significant changes. The Federal Court will have the final say on whether the $35 million penalty is the right number — and whether the related orders against the bank are appropriate.
Sentiment
Mostly NegativePublishers
31
Articles
97
Reach
128
