The Federal Court has ordered HSBC Bank Australia to pay a $35 million penalty after the bank admitted to serious and systemic failures in its scam protection obligations.
Justice Elizabeth Bennett handed down the penalty in Melbourne on 18 June, following civil proceedings brought by ASIC that commenced in December 2024. The court also ordered HSBC to publish adverse publicity notices on its website, app, and in direct correspondence to affected customers.
The ruling comes as national scam losses continue to climb. In 2025, Australians made a combined total of 481,523 scam reports, with 274,577 involving financial losses totalling $2.18 billion — an increase of 7.8% on 2024, according to the ACCC's Targeting Scams Report 2025.
ASIC Chair Sarah Court said the outcome was "one of the first of its kind globally" and described the $35 million penalty as "the strongest scam wake-up call yet to the banking industry."
At the heart of the case was a critical gap in HSBC's internal controls. The bank had implemented scam protections on some payment systems but left its internal payment rail — the channel where the majority of customer losses occurred — entirely exposed.
HSBC was aware of the growing risk of impersonation scams from as early as May 2021, yet reports of unauthorised transactions surged approximately 380% in 2023 and 2024 as the bank failed to act adequately. Between January 2020 and August 2024, HSBC received more than 1,000 reports of unauthorised transactions with a total transaction value of $34.6 million.
Combined with an average investigation time of 144 days per scam report and a failure to correctly apply the ePayments Code's liability rules, the court found HSBC's failures to be widespread and systemic.
"HSBC's alleged failures left customers more vulnerable to scams, tens of millions of dollars out of pocket and waiting months to find out what had happened to their money," Court said.
The human cost is significant — and for mortgage brokers, at least one detail will hit close to home. Among those affected was a Victorian couple in their 50s who lost $48,000 that was transferred directly out of their home loan. A 25-year-old part-time architectural assistant from NSW lost $50,000 — his entire life savings. A 51-year-old dental technician, also from NSW, lost $47,000, almost all she had saved. A 41-year-old Victorian father lost $50,000.
Some customers reported having to borrow money from elsewhere or take on extra shifts at work. Others described distress, guilt, and panic — and the additional stress of being locked out of their accounts after reporting the scam.
Court said the delays compounded the damage.
"Banks have been well on notice about the risks of scams for some time. They have now been given a clear message to have adequate controls and ensure their interactions with scam victims help — not hinder," she said.
HSBC has since established a large-scale remediation programme. To date, approximately $21.5 million in compensation has been paid to affected customers, with further payments expected before the end of July. An additional $6.5 million in recovered funds has also been returned.
See the ASIC announcements for more information: Federal Court orders $35 million penalty against HSBC for scam protection failures and $35 million penalty sought as HSBC admits to scam protection failures, and implements compensation plan.
Get the hottest and freshest property and mortgage news delivered right into your inbox. Subscribe now to our FREE daily newsletter.
