Australia’s Federal Court on June 18, 2026, ordered HSBC Australia to pay a A$35 million penalty and publish adverse publicity notices over failures protecting customers from scams [1, 2, 3].
HSBC admitted to inadequate controls over internal transfer systems and delays investigating fraud reports. The bank took an average of 144 days to investigate scam cases, leaving customers exposed to losses [4, 1, 2, 5, 3].
Between January 2020 and August 2024, over 1,000 unauthorised transactions were reported to HSBC, totaling around A$35 million in losses [4]. Criminals impersonated HSBC staff in scams, a risk known to the bank as early as May 2021 [1, 2, 5, 3].
HSBC also acknowledged insufficient systems to help customers regain access to accounts locked after scams [4, 1, 2, 5, 3]. From May 2023 to May 2024, the bank failed to maintain adequate controls over internal transfer processes, increasing scam vulnerability [1, 2, 5, 3].
HSBC has launched a large remediation program and paid about A$21.5 million in compensation so far, with further payments expected. The bank has recovered and returned approximately A$6.5 million to customers [4].
An HSBC spokesperson said, "We apologise to our customers who were impacted by these events. We are pleased to have reached an agreement to resolve the proceedings with ASIC, which recognises our customer redress programme and the significant enhancements made to our fraud and scam prevention, detection and response." [4, 1]
ASIC Chair Sarah Court said, "Today’s outcome is one of the first of its kind globally and the A$35 million penalty ordered against HSBC is the strongest scam wake-up call yet to the banking industry." She added, "This is one of the first cases of its kind globally and sends a clear message that protecting customers from scams is a core responsibility of banks." [4, 1, 2, 5, 3]
ASIC and HSBC will seek Federal Court approval for the penalty and adverse publicity orders to be enforced [4, 5, 3].
