Australia regulator seeks $24.6 million penalty over HSBC scam failures

HSBC Bank Australia’s scam defenses failed customers at the moment they needed them most, leaving some to wait months, even years, for help after impersonation fraud drained their accounts. On June 18, Australia’s Federal Court approved a A$35 million penalty after the bank admitted serious failures and regulators said the case exposed a wider problem in how lenders protect customers from scams.

The Australian Securities and Investments Commission said HSBC had not kept adequate controls over internal transfer systems from May 2023 to May 2024, allowing unauthorized transactions to slip through. The regulator also said HSBC knew as early as May 2021 that impersonation scams were rising, with fraudsters posing as bank staff to trick customers. In one case, a customer waited 542 days for full account access to be restored, underscoring how slow recovery can deepen the damage after fraud has already occurred.

ASIC first sued HSBC Bank Australia Limited on December 16, 2024, alleging about A$23 million in scam-related losses between January 2020 and August 2024 across roughly 950 reports of unauthorized transactions. Almost A$16 million of those losses came in just six months, from October 2023 to March 2024. The regulator said HSBC’s failures were widespread and systemic, and that some customers lost A$90,000 or more.

The court record shows the case drew unusual public-interest attention, with a public online file established for ASIC v HSBC Bank Australia Limited by May 18, 2026. ASIC Chair Sarah Court said the matter was one of the first of its kind globally, signaling that banks are expected to do more than reimburse victims after the fact. Regulators are now pressing lenders to prevent scams earlier, investigate reports faster and restore account access without long delays that can trap victims outside their own money.

HSBC’s own figures showed how sharply the problem escalated. Unauthorised-transaction reports surged about 380% in 2023 and 2024, driven largely by impersonation scams. The bank had already paid about A$21.5 million in compensation and recovered A$6.5 million for customers, with the redress process expected to finish in July 2026. ABC identified one affected customer, Sunni Wan, who lost almost A$50,000 after responding to a text-message scam in which fraudsters impersonated the bank.

The case points to a new standard of care for the banking sector: scam losses are increasingly being treated as a systems failure, not just an individual mistake. With stronger scrutiny of transfer controls, detection tools and response times, banks across Australia now face clear pressure to prove that their fraud defenses can stop losses before they begin.