Australia's securities regulator ASIC and HSBC Bank Australia have asked the Federal Court to approve a proposed resolution under which the bank would pay a $35 million penalty after admitting serious failures in scam prevention and customer protection. The case covers the period from January 2020 to August 2024, during which HSBC received more than 1,000 reports of unauthorized transactions totaling $34.6 million. ASIC alleged the bank failed to maintain adequate controls within its internal transfer systems between May 2023 and May 2024, and failed to investigate customer complaints in a timely manner—taking an average of 144 days to resolve cases. ASIC Chair Sarah Court stated the enforcement action sends a clear message that protecting customers from scams is a core responsibility of banks, marking one of the first cases of its kind globally. The proceedings reflect a global regulatory shift toward holding financial institutions accountable for scam losses through effective monitoring and intervention before customers lose money.
HSBC Admitted Control Failures Across 1,000+ Scam Reports Totaling $34.6 Million
HSBC admitted that between May 2023 and May 2024 it failed to maintain adequate controls within its internal transfer systems, exposing customers to greater risk of unauthorized payments. The bank also admitted awareness since May 2021 of increasing risks from impersonation scams, where fraudsters posed as HSBC representatives to convince customers to transfer funds. ASIC said reports of unauthorized transactions surged approximately 380% during 2023 and 2024, driven largely by impersonation scams. The regulator alleged HSBC lacked adequate systems to help customers regain access to accounts locked following scam reports. ASIC Chair Sarah Court said: "HSBC's alleged failures left customers more vulnerable to scams, tens of millions of dollars out of pocket and waiting months to find out what had happened to their money."
Customers Lost Life Savings In Impersonation Scams
The enforcement action includes several examples illustrating the personal impact of the bank's failures. Among the affected customers was a 51-year-old dental technician from New South Wales who lost $47,000, representing almost all of her savings. A 25-year-old part-time architectural assistant lost $50,000, described as his life savings. ASIC also cited a Victorian couple in their 50s who lost $48,000 transferred from their home loan account, as well as a 41-year-old Victorian father who lost $50,000. Many affected customers reported significant financial and emotional consequences. Some said they were forced to borrow money elsewhere, work additional shifts, or worry about meeting mortgage repayments. Others reported distress, panic, guilt, and anxiety while waiting for outcomes from HSBC's investigations. Court said: "Individual customers lost tens of thousands of dollars which, for some, were their life savings, causing them real stress and uncertainty. Customers were left waiting months for answers, and delays in investigating and resolving their reports made the harm worse."
HSBC Paid $21.5 Million In Compensation And Recovered $6.5 Million
Alongside the proposed penalty, HSBC has undertaken a large-scale remediation program. The bank has already paid approximately $21.5 million in compensation to affected customers and recovered a further $6.5 million that has been returned to victims. Additional compensation payments are expected. ASIC said HSBC admitted it failed to do all things necessary to ensure its financial services and credit activities were provided efficiently, honestly, and fairly. The bank has also agreed to strengthen its internal controls and governance processes as part of the resolution. Those measures include improvements to policies, systems, and customer protection processes designed to reduce the likelihood of similar failures occurring in the future.
ASIC Case Establishes Scam Prevention As Core Banking Responsibility
The HSBC case reflects a growing expectation that banks should actively prevent scams through effective monitoring, customer protection systems, transaction controls, and rapid incident response. That approach places greater responsibility on financial institutions to identify vulnerabilities before customers suffer losses. Regulators globally have become increasingly concerned about the growing financial impact of scams, particularly impersonation fraud, investment scams, and social engineering attacks that exploit weaknesses in banking systems and customer processes. Historically, scam losses were often viewed primarily as customer problems. Regulators increasingly take a different view. The precedent ASIC is attempting to establish is that protecting customers from scams is no longer simply a fraud-management function, but a core banking responsibility carrying significant regulatory consequences when institutions fail to meet that obligation.
FAQ
What penalty is ASIC seeking against HSBC Australia?
ASIC and HSBC Bank Australia have asked the Federal Court to approve a proposed $35 million penalty after the bank admitted serious failures in scam prevention and customer protection covering the period from January 2020 to August 2024.
How much money did HSBC customers lose to scams?
HSBC received more than 1,000 reports of unauthorized transactions totaling $34.6 million between January 2020 and August 2024. ASIC said reports of unauthorized transactions surged approximately 380% during 2023 and 2024, driven largely by impersonation scams.
What compensation has HSBC paid to scam victims?
HSBC has already paid approximately $21.5 million in compensation to affected customers and recovered a further $6.5 million that has been returned to victims. Additional compensation payments are expected as part of the bank's large-scale remediation program.
