HSBC Australia's $35 Million Scam Protection Penalty

Scammers posed as HSBC representatives, customers reported unauthorized transactions, and the bank took an average of 144 days to investigate reports. A court has now set a penalty.

By Siddharth ShankarUpdated October 11, 2026

When people think of bank scams, they often think of a customer's own mistake. This case, brought by the regulator ASIC, looks at the other side: what a bank was expected to do, and what a court found it did not.

What happened

ASIC says the Federal Court ordered a $35 million penalty plus adverse publicity against HSBC Bank Australia Ltd, decided by Justice Bennett on June 18, 2026. Proceedings were filed on December 13, 2024.

There were more than 1,000 reports of unauthorized transactions between January 2020 and August 2024, totaling $34.6 million. Scammers masqueraded as HSBC representatives, and reports rose about 380% in 2023 and 2024.

How it worked

According to ASIC, HSBC took an average of 144 days to investigate scam reports. Key scam controls were missing on the internal payment rail "where the majority of customer losses occurred," from May 2023 to May 2024. ASIC says HSBC knew of the impersonation risk from May 2021.

The scam itself is the familiar one: someone calls or messages, claims to be the bank and persuades a customer to act. The regulator's case was about what controls the bank had in place to detect and stop such payments.

What was exposed

The ASIC pages do not say how account access was obtained. What they show is that scammers masqueraded as HSBC representatives and customers reported more than 1,000 unauthorized transactions. The scammers' ability to sound like the real bank is the central fact.

How it ended

The result is mixed. The court ordered a $35 million penalty. HSBC has paid about $21.5 million in compensation, with more due before the end of July 2026, and recovered and returned $6.5 million.

A timeline of the case

HSBC knew of the impersonation risk from May 2021. Reports of unauthorized transactions ran from January 2020 to August 2024, and the control gap on the internal payment rail lasted from May 2023 to May 2024. ASIC filed proceedings on December 13, 2024, and the court ordered the penalty on June 18, 2026.

The sequence shows how long it can take between a known risk and a court outcome: about five years from the time of HSBC's awareness to the penalty.

Key facts at a glance

• Penalty: $35 million, ordered June 18, 2026
• Reports: more than 1,000, January 2020 to August 2024
• Losses reported: $34.6 million
• Average investigation time: 144 days
• Compensation paid: about $21.5 million, with more due
• Recovered and returned: $6.5 million

Why this case matters

The case shows that responsibility for scam losses is shifting toward institutions. Regulators expect banks to detect unusual payments, act on reports quickly and close gaps in controls.

For customers, the lesson is practical. If you lose money to a scam, report it to your bank immediately and ask about compensation. If you receive a call from your bank, hang up and call back on the number printed on your card.

What you can do

What a customer can learn from the numbers

Two figures stand out. The 144-day average investigation time means a victim could wait several months for an answer. The 380% rise in reports in 2023 and 2024 shows how quickly the scam grew once it worked. If you are caught up in one, push for a written reference number and follow up regularly, because the process may be slow.

How to read the compensation figures

The compensation figures describe what had been paid by the time of the release, with more due. The $6.5 million recovered and returned is a separate figure. We have not added the amounts together, because the releases do not say how they overlap, and we cannot tell how much of the $34.6 million in reports is covered by each.

What the releases do not say

The releases do not give a count of individual victims. For a UK review of what happens after scam losses, see the PSR reimbursement figures.

Your own exposure is the part you can still change. These guides cover how scammers find your phone number and email, what an exposed phone number means and how to prevent identity theft. You can also try our free phone number exposure check.