HSBC Bank Australia allegedly failed to adequately protect customers “scammed out of millions of dollars”, according to documents filed by The Australian Securities and Investments Commission (ASIC) in the Federal Court on Monday.
ASIC alleged HSBC Australia failed to have adequate controls in place to prevent and detect unauthorised payments and failed to comply with its obligations to investigate customer reports of unauthorised transactions within the specified timeframes required, and to promptly reinstate their banking services in a timely manner.
The regulator further alleged that there was a “significant escalation” in reports of unauthorised transactions by HSBC Australia customers from mid-2023, which often occurred after scammers had obtained access to their accounts by impersonating HSBC Australia staff.
Namely, the bank received some 950 reports of unauthorised transactions between January 2020 and August 2024, resulting in customer losses of about $23 million.
According to ASIC, almost $16 million of this occurred in the six months from October 2023 to March 2024.
“We allege HSBC Australia’s failings were widespread and systemic, and the bank failed to protect its customers,” ASIC deputy chair Sarah Court said.
“We allege that from at least January 2023, HSBC Australia was aware of the risks of unauthorised transactions occurring and that there were gaps in their fraud controls. This resulted in some customers getting scammed out of $90,000 or more,” Court continued.
“We allege HSBC Australia compounded the problem by failing to comply with its obligations under the ePayments Code and let its customers down when they needed their help the most, on average taking 145 days to investigate customers’ reports that they had been scammed.”
The deputy chair further shared ASIC’s concern that HSBC Australia failed to promptly restore customers’ full access to their bank accounts, on average taking 95 days to do so.
“One customer did not have full access restored for 542 days.”
Moreover, ASIC alleges HSBC Australia failed to have:
- From January 2020, adequate systems and processes to ensure that significant, widespread or systemic non-compliance with its obligations to investigate reports of unauthorised transactions within specified timeframes and to promptly reinstate banking services to customers who reported unauthorised transactions; and
- From 1 January 2023 to 1 June 2024, adequate controls for the prevention and detection of unauthorised payments.
The regulator said that as a result, HSBC Australia failed to do all things necessary to ensure that:
- the financial services covered by its Australian financial services licence were provided efficiently, honestly and fairly in contravention of its obligations under s 912A(1)(a) of the Corporations Act 2001 (Cth); and
- the credit activities authorised by its credit licence were engaged in efficiently, honestly and fairly in contravention of its obligations under s 47(1)(a) of the National Consumer Credit Protection Act 2009 (Cth).
“We know scammers are constantly looking for new ways to exploit people. Customers can lose their life savings in an instant. Scammers do not discriminate,” Court said.
“All banks need to pull their weight in the fight against scams. We will not hesitate to take court action where we consider banks fail to comply with their obligations to protect their customers.”
ASIC is also seeking declarations of contraventions, pecuniary penalties, adverse publicity orders, and costs.
