Unlock the Editor’s Digest for free
Australia’s market regulator has charged HSBC over what it called “widespread and systemic failures” in protecting customers from scammers, as governments around the world grapple with who should be held responsible for consumer fraud losses.
The Australian Securities and Investments Commission said on Monday that scammers cost HSBC Australia customers A$23 million ($14.6 million) between 2020 and 2024, with some customers losing more than A$90,000.
Sarah Court, the deputy chair of Asic, said the regulator would demand “very significant penalties for sending a notice to HSBC. . . and to the wider banking sector” on their obligations to protect customers from scammers.
She added that the regulator had conducted a “deep dive” with the banks over their response to scams, but would only pursue the case against HSBC.
The court said the case was the commission’s first against a financial services provider for fraud. A spokesperson for HSBC said the bank was “considering the matters raised” and would work with the regulator.
The British bank has been hit by a series of fines from regulators in recent years. In January, the Bank of England fined it £57.4 million for failing to protect its customers’ deposits, and in 2021 it was fined £64 million in Britain over weaknesses in its controls on money laundering.
Asic said HSBC Australia had recorded 950 complaints about unauthorized transactions between 2020 and 2024, with the majority occurring between October 2023 and March this year. Many of these scams took the form of text messages or phone calls from scammers pretending to be from the bank.
It claims HSBC Australia was aware of the issue from at least January 2023 but was “far too slow to act”.
The bank has been told it has breached obligations to investigate unauthorized transactions within 21 days, or within 45 days under complicating circumstances such as the involvement of foreign traders.
Asic said the bank took an average of 145 days to investigate fraud cases and made the problem worse for some customers by suspending their accounts. HSBC took an average of 95 days to reinstate suspended accounts and in one case a customer was locked out for 542 days, the regulator said.
The court ruled that Australians were defrauded of $2.7 billion last year and that all banks should “do their best” to protect their customers, given the damage online scammers can cause.