The Australian Securities and Investments Commission (ASIC) is seeking a $35 million penalty from the Federal Court after HSBC Bank Australia admitted to systemic failures in protecting customers from scams over a four-year period.
ASIC, which describes the case as one of the first of its kind globally, says the failings involved customer transactions totalling $34.6 million.
HSBC, which has agreed to the penalty sought by ASIC, received more than 1,000 reports of unauthorised transactions between January 2020 and August 2024.
The bank has admitted to a string of failures including inadequate controls on its internal transfer system between May 2023 and May 2024, a 380 per cent surge in unauthorised transaction reports during FY24 driven by impersonation scams and average investigation times of 144 days.
"This is one of the first cases of its kind globally and sends a clear message that protecting customers from scams is a core responsibility of banks," says ASIC chair Sarah Court.
"HSBC’s alleged failures left customers more vulnerable to scams, tens of millions of dollars out of pocket and waiting months to find out what had happened to their money."
The regulator first filed proceedings against HSBC Australia in the Federal Court in December 2024, alleging the bank had failed to adequately protect customers from scams.
At the time, ASIC cited 950 reports of unauthorised transactions and customer losses of about $23 million - figures that have since grown as the investigation period was extended.
HSBC has established a remediation program and to date has paid around $21.5 million in compensation to affected customers. A further $6.5 million has been recovered and returned to customers.
The agreed $35 million penalty was approved by the Federal Court today.
ASIC says the jointly proposed figure reflects HSBC's admissions, its cooperation with the regulator and the remediation program already under way.
The case centres on HSBC's obligations under Australian financial services laws to maintain adequate systems and controls to detect, prevent and respond to unauthorised transactions.
ASIC alleged the bank's internal transfer system lacked sufficient safeguards, allowing scammers, particularly those using impersonation tactics, to exploit gaps in the bank's processes over an extended period.
"Individual customers lost tens of thousands of dollars which, for some, were their life savings, causing them real stress and uncertainty," says Court.
ASIC says some customers reported having to borrow money from elsewhere, taking on extra shifts at work, or fearing they would struggle to meet their home loan repayments.
Others reported distress, guilt, panic and the stress of being unable to access their money or accounts.
"Customers were left waiting months for answers, and delays in investigating and resolving their reports made the harm worse," says Court.
"ASIC has taken this action to hold HSBC to account, and we’re pleased affected customers are now being compensated."
Help us deliver quality journalism to you.
As a free and independent news site providing daily updates
during a period of unprecedented challenges for businesses everywhere
we call on your support