Australian Securities & Investments Commission secures Federal Court order for HSBC to pay AUD 35 million over scam protection failures

The Australian Securities & Investments Commission announced that the Federal Court has ordered HSBC Bank Australia Limited to pay an AUD 35 million penalty and publish adverse publicity notices on its website, app and in letters to affected customers after the bank admitted serious failures in protecting customers from scams. The case arose from HSBC’s handling of unauthorised transactions under the ePayments Code and focused on weak scam controls, delayed investigations and poor treatment of affected customers. Justice Bennett found the contraventions serious and held that HSBC’s failures under the ePayments Code were widespread and systemic. Key controls had been implemented on some payment systems but not on the internal IAT payment rail, where most customer losses occurred. HSBC also admitted it took too long to investigate scam reports, averaging 144 days, did not apply the Code’s rules for deciding whether the customer or the bank should bear losses, and lacked adequate systems to help customers regain access to banking after being scammed. The court also found that customers’ stress and frustration were worsened by HSBC’s failure to meet the Code’s timelines. Following ASIC’s investigation, HSBC set up a large-scale remediation program that has so far paid about AUD 21.5 million in compensation and recovered AUD 6.5 million for customers. Further compensation payments are due before the end of July 2026.