After admitting that it failed to do enough to protect its clients from scam artists, HSBC Bank Australia Ltd. has been ordered to pay a A$35-million penalty by a federal court in Australia.
In a case that the Australian Securities and Investments Commission (ASIC) said is one of the first in the world that seeks to hold a bank accountable for failing to protect customers from scams, HSBC admitted that it took too long — an average of 144 days — to investigate complaints about alleged scams, that it didn’t have adequate systems in place to help customers get back into their accounts after being scammed, and that it didn’t follow the requirements for determining when scam-related losses are to be borne by the bank or its customers.
The ASIC reported that, starting in 2021, the bank was aware of a growing risk of impersonation scams, that the volume of unauthorized transactions stemming from these kinds of scams jumped by approximately 380% in 2023 and 2024, and that the bank didn’t have adequate controls on its internal transfer system, which raised the risk of unauthorized payment transactions.
“HSBC’s alleged failures left customers more vulnerable to scams, tens of millions of dollars out of pocket and waiting months to find out what had happened to their money,” said ASIC chair, Sarah Court, in a release.
Now, following a hearing in Melbourne, a federal court judge, Justice Bennett, ordered the bank to pay a A$35-million penalty in a settlement with regulators.
Court said the ruling is a “wake-up call” to the banking industry.
“Banks have been well on notice about the risks of scams for some time. They have now been given a clear message to have adequate controls and ensure their interactions with scam victims help — not hinder,” she said.
The ASIC noted that the bank has already paid about A$21.5 million in compensation to harmed customers, and that further payouts are expected by the end of July. The bank has also recovered A$6.5 million, which has been returned to customers.