HSBC has agreed to pay a A$35 million (US$24.6 million) penalty following regulatory action by the Australian Securities and Investments Commission (ASIC) over the bank’s failures to protect customers from scams. The UK-based bank had initially been expected to contest the legal proceedings launched by ASIC in 2024, which alleged “widespread and systemic failures” in HSBC’s efforts to safeguard Australians targeted by scammers. However, HSBC ultimately admitted to the “serious failures” identified by the regulator.

ASIC's concerns centered on HSBC's internal controls, which the regulator found inadequate for preventing scam-related losses, and the bank’s failure to respond to customer complaints in a timely manner, breaches that constituted violations of its legal obligations. Sarah Court, chair of ASIC, described the case as one of the first of its kind globally and emphasized that protecting customers from scams is a fundamental responsibility for banks. She noted that the bank’s shortcomings left customers exposed to significant financial harm, with some losing tens of millions of dollars and enduring lengthy delays in understanding what had transpired with their funds.

In response, HSBC issued an apology to affected customers and stated it had already paid A$28 million in refunds and compensation as part of a customer redress program. The bank highlighted enhancements made to its fraud prevention, detection, and response systems and expressed satisfaction with reaching an agreement to resolve the proceedings with ASIC.

The surge in scam-related incidents involved a rise in “spoofing” scams, where fraudsters impersonated HSBC by sending deceptive text messages designed to trick customers into disclosing sensitive banking details. According to ASIC, reports of unauthorized HSBC transactions increased by 380 percent between early 2023 and the end of 2024, driven largely by these impersonation tactics, which cost some clients thousands of dollars.

This penalty adds to a series of regulatory fines faced by HSBC in recent years. In January 2024, the Bank of England fined the bank £57.4 million for failures in protecting customer deposits. Additionally, in 2021, HSBC was fined £64 million in the UK due to deficiencies in its anti-money laundering controls.

HSBC acknowledged the significance of the penalty but maintained that it has taken substantial steps to address the issues identified by regulators. The company’s statement underscored its commitment to further strengthening protections against scams and improving customer service in response to the evolving threat landscape.