The Australian Securities and Investments Commission (ASIC) has launched a groundbreaking legal case against banking giant HSBC, accusing its Australian arm of failing to protect 950 customers from a sophisticated “spoofing” scam that siphoned $23 million over nearly five years.
ASIC filed the lawsuit in the Federal Court, claiming HSBC’s “widespread and systemic” failings enabled scammers to target customers between January 2020 and August 2024. The scam escalated sharply, netting almost $16 million between October 2023 and March 2024, with some victims losing more than $90,000 each.
The “spoofing” scam involved fraudsters using software to mimic HSBC phone numbers and embed fake texts into legitimate message chains. Customers, believing they were responding to the bank, were tricked into calling fake fraud teams. Scammers used this ruse to extract personal details and seize control of accounts.
ASIC Deputy Chair Sarah Court labelled the bank’s fraud prevention measures inadequate.
“We allege HSBC Australia was aware of significant risks from at least January 2023 but failed to close gaps in their fraud controls.”
Court also highlighted HSBC’s slow response times, alleging the bank took an average of 145 days to investigate unauthorised transaction reports — far exceeding the required 21-day timeframe. One customer waited 542 days to regain access to their account.
“This is the first case of its kind globally where a financial institution is being held accountable for widespread failures to protect customers from scams.”
ASIC’s case is set to test the banking sector’s responsibility in combating scams. While there are no specific laws dictating banks’ actions in scam-related incidents, they are legally required to safeguard customers’ personal information and adhere to industry codes.
HSBC responded, stating it has made “significant investments” in fraud prevention, including blocking payments to high-risk platforms like cryptocurrency exchanges, enhancing SMS warnings, and using telecom measures to curb phone number spoofing.
The corporate regulator has indicated it will seek significant penalties if the court finds HSBC liable. “This case isn’t just about penalties,” Court said.
“It’s about sending a clear message to the banking sector to take their obligations seriously.”
The case will be closely watched, marking a pivotal moment in how Australian financial institutions address the growing threat of scams.
Support Our Journalism
The global Indian Diaspora and Australia’s multicultural communities need fair, non-hyphenated, and questioning journalism, packed with on-ground reporting. The Australia Today—with exceptional reporters, columnists, and editors—is doing just that. Sustaining this requires support from wonderful readers like you.
Whether you live in Australia, the United Kingdom, Canada, the United States of America, or India you can take a paid subscription by clicking Patreon
