ASIC has proposed a USD 24.6 million penalty against HSBC Australia over its failure to protect customers from scams.
According to the announcement, the settlement remains subject to court approval, and the proceedings have drawn additional scrutiny after a judge questioned in court whether the proposed amount was sufficient.
ASIC stated that HSBC Australia had been aware since May 2021 of the growing risk of impersonation scams, in which fraudsters posed as bank representatives to deceive customers. Despite this, the bank failed to maintain adequate controls over its internal transfer system between May 2023 and May 2024, leaving customers exposed to unauthorised payments.
Reports of unauthorised transactions rose by approximately 380% during 2023 and 2024, a trend ASIC linked largely to impersonation scams. Between January 2020 and August 2024, HSBC Australia received more than 1.000 such reports, totalling approximately USD 24.3 million.
ASIC also found that HSBC Australia breached its financial services licence obligations, citing an average resolution time of 144 days for complaints related to scams, and inadequate support for customers locked out of their accounts. The regulator's original lawsuit, filed in December 2024, alleged that one customer waited 542 days before regaining full access to their account.
ASIC's filing detailed financial and emotional hardship among affected customers, including cases where individuals lost up to USD 35.000, representing the majority or entirety of their savings. Several customers reported borrowing money or taking on additional work to manage the impact. HSBC Australia has since introduced a remediation programme, paying approximately USD 15.1 million in compensation to date, with further payments expected, and recovering and returning an additional USD 4.6 million to affected customers.
Wider regulatory enforcement
The case forms part of a wider enforcement effort by ASIC, which secured a record USD 245.9 million in civil penalties ordered by courts across the financial sector in the second half of 2025, including separate proceedings against other financial institutions. HSBC has also faced regulatory penalties in the UK during 2024, relating to deposit safeguarding and the handling of customers in financial difficulty.
ASIC Chair Sarah Court said the case was among the first of its kind globally, adding that protecting customers from scams represents a core responsibility for banks. Court noted that affected customers had been left tens of millions of dollars out of pocket while waiting months for outcomes.
The Federal Court has yet to approve the proposed penalty, and the presiding judge has indicated that the final amount could be increased.
