HSBC fined $35m after customers lose $23m to scams

HSBC Australia has been fined $35 million after customers lost more than $23 million in scams linked to widespread failures in the bank's scam detection and response systems.

In a landmark Federal Court ruling, Justice Bennett found the bank's breaches of the ePayments Code were "widespread and systemic", with ASIC saying the judgement sends a clear warning to banks about their responsibility to protect customers from scams.

Of the $23 million lost, almost $16 million disappeared in just six months between October 2023 and March 2024.

Many victims were deceived by scammers impersonating HSBC staff and gaining access to their accounts.

The bank took 144 days on average to investigate the issues.

The regulator launched legal proceedings in late 2024, alleging the bank failed to have suitable controls in place to prevent and detect unauthorised payments and did not investigate suspicious transactions. These took place between January 2020 and August 2024.

Justice Bennett found HSBC's breaches to be serious, noting that while some scam controls were implemented, critical safeguards were not applied to the bank's internal payment system, where the majority of customer losses occurred.

ASIC chair Sarah Court says, "Banks have been well on notice about the risks of scams for some time. They have now been given a clear message to have adequate controls and ensure their interactions with scam victims help - not hinder."

HSBC admitted it failed its obligations under the ePayments Code and did not apply rules in the code for determining when customers or the bank should bear the losses from scams. It also admitted it did not have adequate systems in place to help customers get back into their banking after they had been scammed.

Upon ASIC's investigation, HSBC established a remediation program that has paid some $21.5 million in compensation to date.

More remediation is expected before the end of July. The bank has since recovered and returned $6.5 million to customers.

"We apologise to our customers who were impacted by these events. We are pleased to have reached an agreement to resolve the proceedings with ASIC, which recognises our customer redress program and the significant enhancements made to our fraud and scam prevention, detection and response," an HSBC spokesperson said.

This article first appeared on Financial Standard

Get stories like this in our newsletters.