HSBC sued by Australian regulator for allegedly failing to protect customers from scams

The regulator claimed HSBC's local operator received 950 unauthorised transaction reports.

HSBC Australia was sued by the Australian Securities and Investments Commission (ASIC), alleging that it had failed to adequately protect customers from being scammed out of millions of dollars.

ASIC alleges HSBC Australia failed to have adequate controls in place to prevent and detect unauthorised payments and failed to comply with its obligations to investigate customer reports of unauthorised transactions within the specified timeframes required and to promptly reinstate their banking services in a timely manner.

ASIC also said that there was a significant escalation in reports of unauthorised transactions by HSBC Australia customers from mid-2023 which often occurred after scammers had obtained access to their accounts by impersonating HSBC Australia staff.

Between January 2020 and August 2024, HSBC received approximately 950 reports of unauthorised transactions, resulting in customer losses of about $14.64m (AU$23m). Almost $10.19m (AU$16m) of this occurred in the six months from October 2023 to March 2024.

ASIC Deputy Chair Sarah Court said that HSBC Australia’s failings were widespread and systemic, and the bank failed to protect its customers. She also said that from at least January 2023, HSBC Australia was aware of the risks of unauthorised transactions occurring and that there were gaps in their fraud controls. This resulted in some customers getting scammed out of $57.31k (AU$90k) or more.

ASIC also alleged that HSBC Australia compounded the problem by failing to comply with its obligations under the ePayments Code and let its customers down when they needed their help the most, on average taking 145 days to investigate customers’ reports that they had been scammed.

ASIC said they are also concerned that HSBC Australia failed to promptly restore customers’ full access to their bank accounts, on average taking 95 days to do so. One customer did not have full access restored for 542 days.