HSBC Australia to pay $35 million penalty for scam failures

HSBC Bank Australia has agreed to pay a $35 million penalty after admitting to widespread failures that left customers vulnerable to scammers, in a landmark case brought by the Australian Securities and Investments Commission. The proposed settlement, which remains subject to final approval by the Federal Court, was presented on Thursday, June 18, 2026.

The bank admitted it failed to maintain adequate controls over its internal transfer systems between May 2023 and May 2024, exposing customers to a heightened risk of unauthorized transactions. Regulators found that HSBC was aware as early as May 2021 of the growing threat from impersonation scams, where fraudsters posed as bank representatives, yet its response was inadequate.

The breaches were systemic. ASIC stated HSBC took an average of 144 days to investigate scam reports, breaching its obligations under the ePayments Code. The bank also failed to provide proper avenues for customers to regain access to their accounts after they were locked due to a scam incident, leaving some without access for extended periods. Furthermore, HSBC did not correctly apply rules to determine liability for losses.