HSBC Bank Australia Limited, one of the country’s largest retail banking operations, is facing a $35m court-imposed penalty after admitting it left customers dangerously exposed to scams, with some losing their entire life savings as a result.
Australia’s corporate regulator, the Australian Securities and Investments Commission (ASIC), and HSBC have jointly asked the Federal Court to rule that the bank breached the law and to impose the proposed $35m penalty. The case is described as one of the first of its kind anywhere in the world, though the proposed outcome remains subject to court approval, with the judge retaining discretion over whether different orders should be made.
In the wake of ASIC’s investigation, HSBC has launched a wide-reaching remediation scheme. Around $21.5m in compensation has already been paid out to affected customers, with further disbursements still to follow. The bank has additionally clawed back $6.5m and returned those funds directly to those who lost them.
The scale of the problem is significant. Between January 2020 and August 2024, HSBC received in excess of 1,000 reports of unauthorised transactions, with a combined value of $34.6m. The bank has acknowledged it failed to maintain adequate controls on its internal transfer system between May 2023 and May 2024, a gap that left customers more susceptible to unauthorised payments. It also conceded that it had been aware since May 2021 of the mounting threat posed by impersonation scams, in which fraudsters posed as HSBC staff. Despite this early awareness, reports of unauthorised transactions surged by approximately 380% across 2023 and 2024, driven largely by these impersonation schemes.
HSBC has further admitted it fell short of its financial services licence obligations by taking an average of 144 days to conclude investigations into customer complaints, and by operating inadequate systems to help account holders regain access to accounts locked in the aftermath of a reported scam.
The human cost of those shortcomings has been considerable. Among those affected were a 51-year-old dental technician from New South Wales who lost $47,000, representing almost all her savings; a 25-year-old part-time architectural assistant, also from New South Wales, who lost $50,000, his entire life savings; a couple in their 50s from Victoria who had $48,000 transferred out of their home loan; and a 41-year-old father from Victoria who lost $50,000. Customers reported having to borrow money from family, taking on additional shifts at work, and fearing they would be unable to meet mortgage repayments. Others described feelings of guilt, panic, and distress, compounded by being unable to access their accounts for extended periods.
ASIC chair Sarah Court said, “this is one of the first cases of its kind globally and sends a clear message that protecting customers from scams is a core responsibility of banks.”
“HSBC’s alleged failures left customers more vulnerable to scams, tens of millions of dollars out of pocket and waiting months to find out what had happened to their money,” the chair said.
“Individual customers lost tens of thousands of dollars which, for some, were their life savings, causing them real stress and uncertainty,” the chair said.
“Customers were left waiting months for answers, and delays in investigating and resolving their reports made the harm worse.”
“ASIC has taken this action to hold HSBC to account, and we’re pleased affected customers are now being compensated,” the chair said.
ASIC maintains an ongoing enforcement priority focused on systemic compliance failures within large financial institutions that result in broad consumer harm.
Copyright © 2026 RegTech Analyst
Copyright © 2018 RegTech Analyst
