HSBC sued over scam failures by Australian regulator

Unlock the Editor’s Digest for free

Roula Khalaf, Editor of the FT, selects her favourite stories in this weekly newsletter.

Australia’s markets regulator has sued HSBC for what it called “widespread and systemic failures” in protecting customers against scammers as governments around the world grapple with who should be held responsible for consumer fraud losses.

The Australian Securities and Investments Commission said on Monday that scammers had cost HSBC Australia customers A$23mn ($14.6mn) between 2020 and 2024, with some customers losing more than A$90,000.

Sarah Court, Asic’s deputy chair, said the regulator would seek “very significant penalties to send a message to HSBC . . . and to the broader banking sector” over their obligations to protect customers from scammers.

She added the regulator had engaged in a “deep dive” with banks over their response to scams but would only proceed with the case against HSBC.

Court said the lawsuit was the commission’s first against a financial services institution over scams. An HSBC spokesperson said the bank was “considering the matters raised” and would co-operate with the regulator.

The UK-based bank has been hit with a series of penalties from regulators in recent years. In January the Bank of England fined it £57.4mn for failing to protect customers’ deposits, and in 2021 it was handed a £64mn fine in the UK for weaknesses in its anti-money laundering controls.

Asic said HSBC Australia had registered 950 complaints of unauthorised transactions from 2020 to 2024, with the bulk occurring between October 2023 and March this year. Many of those scams were in the form of texts or phone calls from scammers purporting to be from the bank.

It alleges that HSBC Australia was aware of the issue from at least January 2023 but was “far too slow to act”.

The bank has been told it was in breach of obligations to investigate unauthorised transactions within 21 days, or within 45 days under complicating circumstances such as the involvement of foreign merchants.

Asic said the bank took an average of 145 days to investigate incidents of scamming and compounded the issue for some customers by suspending their accounts. HSBC took an average of 95 days to restore suspended accounts and in one case left a customer locked out for 542 days, the regulator said.

Court said Australians were scammed out of A$2.7bn last year and that all banks had to “pull their weight” to protect their customers, given the damage that online scammers can cause.