Australia's corporate watchdog is taking HSBC to the Federal Court over a prolonged failure to protect customers from scammers, in what could become a defining case for how banks globally are held accountable for scam-related losses.
ASIC and HSBC will jointly ask the Federal Court to find HSBC contravened the law and impose a proposed penalty of AU$35 million (approximately US$24.6 million). The settlement remains subject to court approval, though the proceedings have already drawn attention after a judge questioned in court whether the proposed penalty was high enough.
Years of Warnings, Years of Inaction
The facts admitted by HSBC paint a picture of a bank that knew it had a problem and moved too slowly to fix it. HSBC acknowledged it was aware from May 2021 of the growing threat posed by impersonation scams, where fraudsters posed as HSBC representatives, yet between May 2023 and May 2024 it failed to maintain adequate controls over its internal transfer system, exposing customers to a greater risk of unauthorised payments.
Reports of unauthorised transactions surged approximately 380% in 2023 and 2024, largely driven by those impersonation scams. Between January 2020 and August 2024, HSBC received more than 1,000 reports of unauthorised transactions totalling AU$34.6 million.
The failures were not limited to fraud detection. ASIC found HSBC breached its financial services licence obligations through major delays in investigating scam reports, taking an average of 144 days to resolve cases, and failed to provide adequate systems for customers locked out of their accounts following a scam incident. Finance Magnates had previously reported on the original ASIC lawsuit filed in December 2024, in which the regulator claimed one customer waited 542 days for full account access to be reinstated.
- ASIC to Publish Licensee Website Addresses in New Front Against Imposter Scams
- A 'Record Penalty': USGFX, EuropeFX and TradeFred to Pay AU$300M for ‘Egregious’ CFD Offerings
- ASIC Hands Euroclear a May 2027 Deadline to Get Australian
Life Savings Gone, Answers Months Away
The human toll outlined in ASIC's filing is considerable. Among those affected were a 51-year-old dental technician from NSW who lost AU$47,000, almost all her savings; a 25-year-old architectural assistant who lost AU$50,000, his entire life savings; a Victorian couple in their 50s who lost AU$48,000 transferred from their home loan; and a 41-year-old Victorian father who lost AU$50,000.
Some customers reported having to borrow money from elsewhere, take on extra work shifts, or fear they would struggle to meet home loan repayments. Others described distress, guilt, and panic from being unable to access their accounts.
ASIC Chair Sarah Court was direct: customers were left "tens of millions of dollars out of pocket and waiting months to find out what had happened to their money."
HSBC has since established a remediation programme, paying approximately AU$21.5 million in compensation with further payments to come, and recovering and returning an additional AU$6.5 million to affected customers.
Part of a Much Bigger ASIC Crackdown
The HSBC case is not an isolated enforcement action. In the second half of 2025 alone, ASIC secured a record AU$349.8 million in court-ordered civil penalties, with major cases including ANZ being ordered to pay AU$250 million in combined penalties for widespread misconduct and systemic risk failures, Cbus ordered to pay AU$23.5 million for serious failures processing members' death benefits, RAMS Financial Group ordered to pay AU$20 million for home loan compliance failures, and NAB ordered to pay AU$15.5 million for hardship failures impacting customers.
ASIC also took down 6,900 investment scam and phishing websites in the year to June 2025 and filed its first-ever court case alleging that a bank failed to protect customers from scams, namely the original HSBC proceeding, which has now reached a proposed resolution.
HSBC itself has faced regulatory heat beyond Australia. In 2024, the UK's Prudential Regulation Authority fined HSBC £57.4 million for serious failings in safeguarding certain customer deposits, while the Financial Conduct Authority imposed a separate £6.28 million fine on HSBC entities for mishandling customers experiencing financial difficulties.
For ASIC Chair Court, the message to the sector is unambiguous: "This is one of the first cases of its kind globally and sends a clear message that protecting customers from scams is a core responsibility of banks." With the Federal Court still to sign off on the penalty and a judge already signalling it may want to push higher, the final figure could yet shift.
