HSBC Australia fined $24.53m over scam protection failures

HSBC admitted to inadequate scam controls in its internal transfer system between May 2023-2024.

HSBC Bank Australia Limited is ordered to pay a $24.53m (A$35m) penalty after the bank admitted to “serious failures in protecting customers from scams,” according to the Australian Securities & Investments Commission (ASIC).

The scams reported cost customers tens of thousands of dollars, including life savings.

To date, HSBC has paid around $15.07m (A$21.5m) in compensation. The bank has recovered $4.55m (A$6.5m) and has returned those to customers, ASIC said.

Between May 2023 and May 2024, HSBC Australia admitted to having failed to have adequate controls in its internal transfer system.

The bank also noted the growing risk of impersonation scams as early as May 2021, and reports of unauthorised transactions to HSBC rising 380% in 2023 and 2024 largely driven by impersonation scams.

ASIC said that HSBC admitted to breaching its financial services licence obligations due to major delays in investigating cases, which took an average of 144 days to finalise.

HSBC also admitted that it had “inadequate systems to inform customers how to regain access to their accounts that were locked after they had reported a scam,” ASIC said.