The landmark case claims that HSBC failed to protect more than 950 customers.
The Australian Securities and Investments Commission (ASIC) has launched legal action against HSBC’s Australian arm, accusing the bank of failing to protect more than 950 customers from scams.
The claim, filed in the Federal Court today, alleges that customers lost $23 million over five years due to a “spoofing” scam.
Reports of unauthorised transactions to HSBC were recorded from January 2020 to August this year, with the scam peaking between October 2023 and March 2024, accounting for approximately $16 million in losses.
The corporate watchdog further alleges that HSBC failed to investigate reports of fraud in a timely manner, exacerbating customer losses. 
“This is the first case of its kind taken by ASIC. We allege HSBC’s failures were widespread and systemic, and the bank failed to protect its customers.”
ASIC Deputy Chair Sarah Court
The case is a landmark for ASIC, marking the first time the regulator has filed a lawsuit against a bank for failing to prevent scams. ASIC Deputy Chair, Sarah Court issuing a stern warning to other financial institutions.
“All banks need to pull their weight in the fight against scams. We will not hesitate to take court action where we consider banks fail to comply with their obligations to protect their customers.”
“All banks need to pull their weight in the fight against scams. We will not hesitate to take court action where we consider banks fail to comply with their obligations to protect their customers.”
Sarah Court
The spoofing scam involved fraudsters disguising phone numbers to appear in legitimate HSBC text threads.
Scammers would send messages warning of suspicious transactions and urge customers to call a fake fraud hotline. Believing they were contacting HSBC, customers unknowingly provided sensitive personal information, enabling the scammers to take over their accounts.
Despite suspicious activity, including large international money transfers and password changes, the bank reportedly failed to intervene.
ASIC claims it took HSBC an average of 145 days to investigate fraud complaints, with one customer waiting 542 days to regain access to their account.
HSBC had recently announced improvements to its fraud and scam prevention systems.
