Key facts
- HSBC Australia will pay a A$35 million penalty for failing to protect customers from scams.
- The bank admitted to widespread and systematic failures in its scam protection measures.
- Inadequate controls over internal transfer systems between May 2023 and May 2024 exposed customers to unauthorized transactions.
- HSBC was aware of impersonation scam threats since May 2021.
- The Federal Court ordered the penalty and adverse publicity orders.
HSBC Australia has been ordered by an Australian court to pay a A$35 million penalty after admitting to widespread and systematic failures in protecting customers from scams. The Australian Securities and Investments Commission (ASIC) found that the bank failed to maintain adequate controls over its internal transfer systems between May 2023 and May 2024, exposing customers to a heightened risk of unauthorized transactions.
ASIC also stated that HSBC was aware as early as May 2021 of a growing threat from impersonation scams, where fraudsters posed as bank representatives. The regulator noted that HSBC breached its financial services licence obligations by failing to adequately prevent scams and by taking an average of 144 days to investigate customer reports. The bank also had insufficient systems to help customers regain access to accounts locked after scam incidents.
ASIC Chair Sarah Court described the outcome as one of the first of its kind globally and a significant wake-up call to the banking industry. HSBC has reached an agreement with ASIC that recognizes its customer redress program and enhancements made to its fraud and scam prevention measures.