The Australian Securities and Investments Commission (ASIC) is suing HSBC Bank Australia Limited for failures to adequately protect customers from scams.

According to documents filed by ASIC in the Federal Court today, HSBC Australia failed to protects customers from getting scammed out of millions of dollars.

ASIC alleges HSBC Australia failed to have adequate controls in place to prevent and detect unauthorised payments and failed to comply with its obligations to investigate customer reports of unauthorised transactions within the specified timeframes required, and to promptly reinstate their banking services in a timely manner.

The regulator alleges that there was a significant escalation in reports of unauthorised transactions by HSBC Australia customers from mid-2023 which often occurred after scammers had obtained access to their accounts by impersonating HSBC Australia staff.

Between January 2020 and August 2024, HSBC received approximately 950 reports of unauthorised transactions, resulting in customer losses of about $23 million. Almost $16 million of this occurred in the six months from October 2023 to March 2024.

ASIC alleges HSBC Australia failed to have:

• From January 2020, adequate systems and processes to ensure that significant, widespread or systemic non-compliance with its obligations to investigate reports of unauthorised transactions within specified timeframes and to promptly reinstate banking services to customers who reported unauthorised transactions; and
• From 1 January 2023 to 1 June 2024, adequate controls for the prevention and detection of unauthorised payments.

ASIC contends that as a result, HSBC Australia failed to do all things necessary to ensure that:

• the financial services covered by its Australian financial services licence were provided efficiently, honestly and fairly in contravention of its obligations under s 912A(1)(a) of the Corporations Act 2001 (Cth); and
• the credit activities authorised by its credit licence were engaged in efficiently, honestly and fairly in contravention of its obligations under s 47(1)(a) of the National Consumer Credit Protection Act 2009 (Cth).

ASIC is seeking declarations of contraventions, pecuniary penalties, adverse publicity orders, and costs.