HSBC fined over Australian scam failures

Financial Times - Please use the sharing tools found via the share button at the top or side of articles. Copying articles to share with others is a breach of FT.com T&Cs and Copyright Policy. Email [email protected] to buy additional rights. Subscribers may share up to 10 or 20 articles per month using the gift article service. 

HSBC has agreed to pay a A$35mn (US$24.6mn) penalty over its failure to protect Australians from scammers.

The UK-based bank had been expected to contest legal action launched by the Australian Securities and Investments Commission in 2024 after the regulator alleged “widespread and systemic failures” to protect customers targeted by scammers.

HSBC instead admitted to the “serious failures” that Asic had identified, which included allegations that its internal systems had inadequate controls and that it had breached its legal obligations in failing to respond to customer complaints in a timely manner.

“This is one of the first cases of its kind globally and sends a clear message that protecting customers from scams is a core responsibility of banks,” said Sarah Court, chair of Asic.

“HSBC’s alleged failures left customers more vulnerable to scams, tens of millions of dollars out of pocket and waiting months to find out what had happened to their money.”

The bank apologised to customers and said it had paid A$28mn in refunds and compensation.

“We are pleased to have reached an agreement to resolve the proceedings with Asic, which recognises our customer redress programme and the significant enhancements made to our fraud and scam prevention, detection and response,” said a company spokesperson.

HSBC has been hit with a series of penalties from regulators in recent years. In January 2024, the Bank of England fined it £57.4mn for failing to protect customers’ deposits, and in 2021 it was handed a £64mn fine in the UK for weaknesses in its anti-money laundering controls.

The spate of “spoofing” scams — in which customers were fooled into handing over banking details after receiving text messages purporting to be from HSBC — soared in 2023 and 2024 and cost some customers thousands of dollars.

Reports of unauthorised HSBC transactions surged 380 per cent from the start of 2023 to the end of 2024, largely driven by impersonation scams, according to Asic.

The regulator cited examples including a 51-year-old dental technician who lost A$47,000 — almost her entire savings — and a couple in their fifties who lost A$48,000 when the money was transferred out of their home loan.

Court said affected customers had reported distress, guilt and panic after being scammed and some had to borrow money or take on extra work to keep up with loan payments. Some were also locked out of their accounts after reporting scams.