HSBC Agrees to Pay $35 Million for Failing to Stop Scams

Thursday, June 18, 2026, 4:47 am

Sunni Wan lost almost $50,000 to a text message scam where fraudsters pretended to be the bank.

In short:

HSBC admitted to not protecting customers from scams and agreed to pay a $35 million penalty.

The bank exposed customers to a greater risk of unauthorized payments due to inadequate controls.

What's next?

Customers hope for a full refund, including compensation. The penalty still needs court approval.

HSBC admitted to failing to protect customers from scams and agreed to a $35 million penalty.

The bank failed to have adequate controls on its internal transfer system, exposing customers to unauthorized payments.

HSBC knew about the growing risk of impersonation scams, which caused unauthorized transactions to increase by 380% in 2023 and 2024.

Delays in investigating scams, which took an average of 144 days, resulted in the bank breaching its financial services license obligations.

The lawsuit is the first in Australia to hold a bank accountable for allegedly having inadequate processes to detect and prevent scam losses.

The bank also admitted it did not have adequate systems to inform customers about regaining access to their accounts after scammers locked them out.

HSBC paid about $21.5 million in compensation and recovered $6.5 million, which was returned to customers.

The $35 million penalty was jointly submitted with the corporate watchdog ASIC but needs court approval.

An HSBC spokesperson apologized to customers.

HSBC is pleased to have reached an agreement with ASIC, recognizing its customer redress program and enhancements to fraud and scam prevention.

Hundreds of customers were scammed

Hundreds of Australians were scammed out of large sums of money over four years, with fraudsters using text messages to trick people into thinking their accounts were compromised.

While the bank reimbursed some customers, others settled for less, and victims want the bank to repay outstanding losses and compensation.

Australians are still losing their life savings to a long-running 'spoofing' scam targeting HSBC customers.

Defrauded customers have been waiting for HSBC's day in court after the bank was sued by ASIC in 2024.

Sunni Wan lost nearly $50,000 after responding to a 'spoofing' text message from someone impersonating the bank.

When she discovered others faced massive losses, she created a support group to fight HSBC for reimbursement.

The victims were blamed by the bank.

The lawsuit is the first of its kind in Australia, attempting to hold a bank accountable for allegedly having inadequate processes to detect and prevent scam losses.

The bank was too slow to investigate complaints, and customers were locked out of their accounts for too long, up to 542 days.

HSBC planned to defend the case but abandoned it when the bank said it would no longer contest it.

Stephanie Tonkin says HSBC needs to be shown its conduct is unacceptable.

Stephanie Tonkin, CEO of the Consumer Action Law Centre, said it was a stunning turn-around.

HSBC fought against its customers and the regulator.

Scam victims were manipulated by their own bank.

The same failures kept happening, and the bank failed to prevent them.

Court documents show customers lost over $100 million in all fraud-related losses between 2021 and 2024.

HSBC was given 'repeated red flags'

Advocates say internal documents provide a concerning insight into what happened inside HSBC, including unheeded warnings.

Customers lost over $100 million to payment fraud-related losses between 2021 and 2024.

Losses accelerated to almost $61 million between January and September 2024, with $24 million related to impersonation scams.

Not all losses are covered by the Federal Court case.

What is a 'spoofing' scam?

In 2021, the bank was told about 'fraudsters' impersonating the bank.

A fraud steering committee heard that specific fraud prevention products could have avoided losses from these scam cases.

A special presentation was given about the 'HSBC Impersonation Scam' in 2023.

Customers made over 150 unusual activity reports, and one group behind the scam used a HSBC Australia 'mule account' to shift stolen funds to Pakistan.

A money mule account is used to transfer illegally acquired funds through the banking system.

Stephanie Tonkin says documents suggest HSBC failed to act with urgency on 'repeated red flags'.

Most money mule accounts are created using stolen identities or set up by people recruited to transfer money.

Ms Tonkin said the documents suggested HSBC had failed to act with urgency on 'repeated red flags'.

Victims in 'dire straits' accepted low reimbursement offers

When Ms Wan was scammed, it was weeks before Christmas in 2023.

It began with an SMS warning that the bank had detected suspicious transactions on the customer's account.

Fraudsters used software to disguise their phone number, making text messages appear in the same text chain as legitimate HSBC messages.

When the customer called, they were connected to a fake fraud team with a HSBC on-hold message.

Once the criminals gained trust, the customer was locked out of their account, and the money was stolen.

In a recording of a male scammer, he spoke in a formal, professional manner and pretended to book the customer for an in-branch appointment.

It took Ms Wan almost a year to get her money back from HSBC.

She said it was like another full-time job.

Sunni Wan was scammed before she had her baby daughter and is still dealing with the fallout.

She later discovered the bank had failed to act on suspicious logins to her account from Dubai and Scotland.

Ms Wan and other affected customers connected over Facebook messenger, sharing tips and giving each other 'positive vibes'.

The victims rallied, held strategy meetings, and lodged complaints with police, regulators, and politicians.

Some victims were in 'dire straits' and accepted low reimbursement offers because they couldn't afford to wait.

Authorities say new scam figures show their action on scams is working, but consumer groups and victims say it's not enough.

Ms Tonkin was critical of how the bank approached reimbursement requests, which included 'low-ball offers'.

A landmark determination by the Australian Financial Complaints Authority (AFCA) in August 2024 found the bank should repay a scam victim in full and pay additional compensation.

Even though the victim had disclosed pass codes to the scammer, AFCA found the person had not done so voluntarily because they were manipulated.

More than 400 victims of the HSBC bank impersonation scam lodged AFCA complaints and were awarded $8.67m in reimbursement.

Do you have a story to share?

Not all victims have been repaid

A 64-year-old Perth woman, Betty, was scammed out of $95,000 in early 2024.

She called HSBC within 10 minutes, but more money was stolen after that warning.

Negotiations with the bank were difficult and took months.

Betty emailed the then-CEO, saying the bank's offer to pay her $500 was 'insulting'.

The bank later paid her $5,000, but after she pursued an AFCA complaint, she received $75,000.

The $20,000 shortfall continues to have a negative impact, and she will have to remain employed longer to repay an outstanding loan.

Betty, Ms Wan, and others want HSBC to publicly apologize and repay all affected customers in full, including compensation for pain and suffering.

They should get their money back.

Thursday, June 18, 2026, 4:47 am

Thursday, June 18, 2026, 11:23 am

Top Stories

LIVE

BREAKING

Topic: Universities

Topic: War

LIVE

Top Stories

LIVE

BREAKING

Topic: Universities

Topic: War

LIVE

Just In

Topic: FIFA World Cup

Thursday, June 18, 2026, 12:07 pm

Topic: Courts

Thursday, June 18, 2026, 12:06 pm

Topic: Courts

Thursday, June 18, 2026, 11:58 am

BREAKING

Thursday, June 18, 2026, 11:36 am