HSBC Australia Faces A$35M Penalty Over Scam Protection Failures

HSBC Bank Australia is facing a proposed A$35 million (US$24.6 million) penalty after admitting to significant shortcomings in its scam prevention and customer protection measures, according to the Australian Securities and Investments Commission (ASIC).

ASIC announced that it and HSBC will jointly seek Federal Court approval for the penalty, marking one of the first major cases worldwide centered on a bank’s alleged failure to adequately prevent scams and unauthorized transactions.

The regulator stated that HSBC acknowledged failing to maintain effective controls within its internal transfer system between May 2023 and May 2024. These deficiencies reportedly increased customers’ exposure to unauthorized transactions and financial fraud.

HSBC also admitted it had been aware since 2021 of the rising threat posed by impersonation scams, where fraudsters falsely present themselves as bank representatives to deceive customers. Despite recognizing the growing risk, ASIC found that the bank’s safeguards were insufficient to effectively protect account holders.

According to ASIC, HSBC received more than 1,000 reports of unauthorized transactions totaling approximately A$34.6 million between January 2020 and August 2024. Reports surged by roughly 380% during 2023 and 2024, with impersonation scams identified as a key driver behind the increase.

The regulator further alleged that HSBC breached its licensing obligations by taking excessive time to investigate scam-related complaints. On average, the bank reportedly required 144 days to resolve customer cases. ASIC also criticized HSBC for failing to provide adequate support systems for customers who were locked out of their accounts while investigations were underway.

In response, HSBC has implemented a remediation program aimed at strengthening its fraud prevention framework and improving customer protections. The bank has already paid approximately A$21.5 million in compensation to affected customers and successfully recovered and returned an additional A$6.5 million.

The proposed A$35 million penalty remains subject to approval by Australia’s Federal Court. The case highlights increasing regulatory scrutiny of scam prevention measures and reinforces the growing expectations placed on financial institutions to safeguard customers from fraud and cyber-enabled financial crimes.