HSBC Bank fined $35m in landmark scam-protection failures

HSBC Bank Australia has been hit with a $35 million penalty after admitting to widespread and systemic failures in protecting customers from scams.

Following a Federal Court hearing in Melbourne on June 18, Justice Bennett handed down the penalty and ordered HSBC to publish adverse publicity notices across its website, mobile app and in direct communications with affected customers.

ASIC said the judgement "is one of the first of its kind globally and reinforces the core responsibility of banks to protect their customers from scams."

The regulator launched legal proceedings in late 2024, alleging the bank failed to have suitable controls in place to prevent and detect unauthorised payments and did not investigate suspicious transactions. These took place between January 2020 and August 2024.

Of the $23 million lost ASIC was investigating, almost $16 million was lost in the six months from October 2023 to March 2024. Many of the scammers accessed victims' accounts by impersonating HSBC Australia staff. The bank took 144 days on average to investigate the issues.

ASIC held HSBC Australia against the ePayments Code, which regulates electronic payment facilities.

Justice Bennett found HSBC's failures in respect to the ePayments Code were widespread and systemic.

She also found HSBC's breaches to be serious, noting that while some scam controls were implemented, critical safeguards were not applied to the bank's internal payment system, where the majority of customer losses occurred.

ASIC chair Sarah Court commented: "Banks have been well on notice about the risks of scams for some time. They have now been given a clear message to have adequate controls and ensure their interactions with scam victims help - not hinder."

HSBC admitted it failed its obligations under the ePayments Code and did not apply rules in the code for determining when customers or the bank should bear the losses from scams. It also admitted it did not have adequate systems in place to help customers get back into their banking after they had been scammed.

Upon ASIC's investigation, HSBC established a remediation program that has paid some $21.5 million in compensation to date.

More remediation is expected before the end of July. The bank has since recovered and returned $6.5 million to customers.

"We apologise to our customers who were impacted by these events. We are pleased to have reached an agreement to resolve the proceedings with ASIC, which recognises our customer redress program and the significant enhancements made to our fraud and scam prevention, detection and response," a HSBC spokesperson said.