HSBC has admitted to serious failures in protecting customers from scams that cost some tens of thousands of dollars, including their life savings

This is a statement from ASIC. The original is here.

HSBC Bank Australia Limited (HSBC) has admitted to serious failures in protecting customers from scams that cost some tens of thousands of dollars, including their life savings.

In one of the first cases of its kind globally, ASIC and HSBC will today ask the Federal Court to find HSBC contravened the law and impose a penalty of $35 million.

The proposed resolution is subject to the approval of the Court, and it is a matter for the Court to determine whether the proposed orders are appropriate and whether any other orders should be made.

Following ASIC’s investigation, HSBC has also established a large-scale remediation program.

To date, HSBC has paid around $21.5 million in compensation, with further payments to come. HSBC has also recovered $6.5 million and returned those funds to customers.

Between January 2020 and August 2024, HSBC received more than 1,000 reports of unauthorised transactions with a total transaction value of $34.6 million.

HSBC has admitted that:

• between May 2023 and May 2024, it failed to have adequate controls on its internal transfer system, exposing customers to a greater risk of unauthorised payments
• it was aware from May 2021 of the growing risk of impersonation scams, where scammers masqueraded as representatives of HSBC
• reports of unauthorised transactions to HSBC surged approximately 380% in 2023 and 2024, largely driven by impersonation scams
• because of its failure to adequately protect its customers from scams, customers were put at greater risk of financial and non-financial harm, and some suffered that harm
• it breached its financial services licence obligations due to major delays in investigating cases, which took an average of 144 days to finalise, and
• it had inadequate systems to inform customers how to regain access to their accounts that were locked after they had reported a scam.

ASIC Chair Sarah Court said, ‘this is one of the first cases of its kind globally and sends a clear message that protecting customers from scams is a core responsibility of banks.

‘HSBC’s alleged failures left customers more vulnerable to scams, tens of millions of dollars out of pocket and waiting months to find out what had happened to their money,’ the Chair said.

Some of the customers who reported being scammed included:

• a 51-year-old dental technician from NSW who lost $47,000 – almost all her savings
• a 25-year-old part time architectural assistant from NSW who lost $50,000 – his life savings
• a Victorian couple in their 50s who lost $48,000 that was transferred out of their home loan, and
• a 41-year-old Victorian father who lost $50,000.

‘Individual customers lost tens of thousands of dollars which, for some, were their life savings, causing them real stress and uncertainty,’ the Chair said.

Some customers reported having to borrow money from elsewhere, taking on extra shifts at work, or fearing they would struggle to meet their home loan repayments.

Others reported distress, guilt, panic, and the stress of being unable to access their money or accounts.

‘Customers were left waiting months for answers, and delays in investigating and resolving their reports made the harm worse.

‘ASIC has taken this action to hold HSBC to account, and we’re pleased affected customers are now being compensated,’ the Chair said.

ASIC has an enduring enforcement priority targeted at systemic compliance failures by large financial institutions which result in widespread consumer harm.

Downloads

• Statement of Agreed Facts and Admissions
• Supplementary Statement of Agreed Facts and Admissions

Background

ASIC commenced civil penalty proceedings against HSBC Bank Australia Limited on 13 December 2024.

HSBC has admitted that it failed to do all things necessary to ensure that its financial services and credit activities were provided efficiently, honestly and fairly.

The matter is being heard in the Federal Court on 18 June 2026.

ASIC’s proceedings concern payments which are ‘unauthorised transactions’ as defined in the ePayments Code, which is administered by ASIC.

Read more about ASIC's role in administrating the ePayments Code.

HSBC has established a remediation program to assess affected customers and compensate those who were not liable for losses under the ePayments Code, including for lost earnings as a result of delays in accessing funds. Further information for affected customers is available from HSBC: https://www.hsbc.com.au/help/important-notices/.