Fraud victims are anxiously waiting to see if global bank HSBC will admit to the Federal Court that it failed to protect its customers from a long-running spoofing scam, potentially paving the way for a massive financial penalty.
Hundreds of Australians were scammed out of huge sums of money over four years, where fraudsters used text messages to trick people into thinking their accounts had been compromised.
While the bank has fully reimbursed some, others settled for much less and victims want the bank to repay outstanding losses and compensation.
Defrauded customers have been waiting for HSBC’s day in court, after it was sued by the Australian Securities and Investments Commission (ASIC) in 2024.
The lawsuit is the first in Australia attempting to hold a bank to account for allegedly having inadequate processes to detect and prevent scam losses. (ABC News: Billy Cooper)
Sunni Wan lost nearly $50,000 after responding to a “spoofing” text message from someone impersonating the bank.
When the Sydney woman discovered there were many others facing massive losses, she created a support group to fight HSBC for reimbursement.
“They just kept putting the blame on the victims,” she said.
“It’s about time that they admit to their fault … and their system failure.“
HSBC is being sued by ASIC over allegations of “widespread and systemic” failures to protect customers.
Customers made 950 reports alleging scammers had netted $23 million, between January 2020 to August 2024, in the bank impersonation scam.
The lawsuit is the first of its kind in Australia, attempting to hold a bank to account for allegedly having inadequate processes to detect and prevent scam losses.
It’s also alleging the bank was too slow to investigate complaints, and customers were locked out of their accounts for too long — in one case, 542 days.
HSBC had planned to defend the case at trial, but it was abandoned when the bank said it would no longer contest it.
Today in Melbourne, HSBC will front a Federal Court hearing where it is expected the bank will admit it failed customers in a statement of agreed facts.
Stephanie Tonkin says HSBC needs to be shown its conduct is entirely unacceptable. (ABC News: Billy Draper)
Stephanie Tonkin, CEO of the Consumer Action Law Centre, said it was a stunning turn-around.
“HSBC has fought tooth and nail, fought against its customers, fought against the regulator,” she said.
“These scam victims were gaslit by their own bank.
“The same failures kept happening and the bank still kept failing to prevent it.”
The corporate watchdog is expected to request the court hit the bank with a substantial financial penalty.
Ms Tonkin said the penalty needed to send a message.
Court documents show customers lost more than $100 million in all fraud-related losses between 2021 and 2024. (ABC News: Billy Cooper)
“HSBC needs to be shown that its conduct is entirely unacceptable and can never happen again,” she said.
“So, a penalty in the hundreds of millions of dollars.”
HSBC declined an interview request and said it was unable to comment while the case was ongoing.
HSBC given ‘repeated red flags’
Advocates say internal documents provide a concerning insight into what was happening inside HSBC during that time, including warnings that appear to have gone unheeded.
Court documents show customers lost more than $100 million to all payment fraud-related losses between 2021 and 2024.
Those losses accelerated to almost $61 million between January and September 2024, with $24 million related to impersonation scams.
Not all of these losses are covered by the Federal Court case.
ASIC has alleged there were missed opportunities inside the bank, including that HSBC’s internal controls weren’t up to scratch to identify suspicious activity across mobile and online banking.
In 2021, the bank was told about “fraudsters” impersonating the bank.
A fraud steering committee heard in early 2022, that if it had in place specific fraud prevention products to monitor transactions, “losses resulting from these scam cases … would likely have been avoided”.
Midway through 2023, a special presentation was given about the “HSBC Impersonation Scam”.
It heard customers had made over 150 unusual activity reports and one group behind the scam was even using a HSBC Australia “mule account” to shift stolen funds to Pakistan.
A money mule account is when an account is used to transfer illegally acquired funds through the banking system and out of reach of law enforcement.
Stephanie Tonkin says documents suggest HSBC failed to act with urgency on “repeated red flags”. (ABC News: Billy Cooper)
Most money mule accounts are either created using stolen identities, or set up legitimately by people who are recruited to transfer money, move it offshore, withdraw it or convert it to cryptocurrency, usually for a commission.
Ms Tonkin said the documents suggested HSBC had failed to act with urgency on “repeated red flags”.
In April, the bank changed its defence, admitting it was aware of the risk of unauthorised payments but argued it had adequate controls in place, including the use of a fraud detection system.
However, it said it did not have fraud prevention products called BioCatch and ThreatMetrix, to monitor suspect transactions for online banking until June 2024 — even though they were in place much earlier for customers using mobile banking.
HSBC admitted its internal documents showed that from 2021 both of these anti-fraud products would “enhance” its controls against scams.
Victims in ‘dire straits’ accepted low reimbursement offers
When Ms Wan was scammed, it was weeks before Christmas in 2023.
It began with an SMS warning that the bank had detected suspicious transactions on the customer’s account, asking the customer to call them.
Fraudsters used software to disguise their phone number so that text messages appeared in the same text chain as legitimate HSBC messages.
Loading…
When the customer called, they were connected to a fake fraud team, complete with a HSBC on-hold message.
Once the criminals gained their trust, the customer was locked out of their account and the money was stolen.
In a recording of a male scammer obtained by the ABC, he spoke in a formal, professional manner and pretended to book the customer for an in-branch appointment with a fraud specialist.
It took Ms Wan almost a year to get her money back from HSBC.
“Oh my gosh, it was literally like another full-time job,” she said.
Sunni Wan was scammed before she had her baby daughter and is still dealing with the fallout. (ABC News: Billy Cooper)
In her case she would later discover the bank had failed to act on suspicious logins to her account from Dubai and Scotland.
Ms Wan and other affected customers connected over Facebook messenger, sharing tips about the complaint process and giving each other “positive vibes” while they grappled with the emotional and financial fallout.
In response, the victims rallied, held strategy meetings, and lodged complaints with police, regulators, and politicians trying to spur action and ramp up pressure on the bank.
However, Ms Wan said some victims were in “dire straits” and accepted low reimbursement offers dubbed as “goodwill” payments, because they couldn’t afford to wait.
Ms Tonkin was highly critical of how the bank approached reimbursement requests, which she claimed included “low-ball offers and for the vast majority HSBC were particularly combative”.
A key turning point was a landmark determination by the Australian Financial Complaints Authority (AFCA) in August 2024, which found the bank should repay a scam victim in full and pay additional compensation for breaching the banking code.
Even though the victim had disclosed pass codes to the scammer that had been used to steal their money, AFCA found the person had not done so voluntarily because they had been manipulated into believing they were talking to the bank.
More than 400 victims of the HSBC bank impersonation scam lodged AFCA complaints and have been awarded $8.67m in reimbursement.
Not all victims have been repaid
However, not all the HSBC customers have been repaid in full, including 64-year-old Perth woman, Betty, who requested to only use her first name.
She was scammed out of $95,000 in early 2024.
Once she realised what happened, she called HSBC within 10 minutes, but claims more money was stolen after that warning.
She said negotiations with the bank were difficult and took months.
Loading…
Betty resorted to emailing then-CEO Antony Shaw, to say the bank’s offer to pay her $500 was “insulting”.
The bank later paid her $5,000, but after she pursued an AFCA complaint, she received $75,000.
She said the $20,000 shortfall continued to have a negative impact — with her husband unable to work due to illness, she will have to remain employed for much longer to repay an outstanding loan.
Betty, Ms Wan and others in their group want HSBC to publicly apologise and repay all affected customers in full — including compensation for pain and suffering.
“We should really be getting our money back,” she said.
HSBC declined an interview request and did not respond to the ABC’s written questions about the allegations in this story.
In a statement the bank said, “HSBC and ASIC are working to resolve the legal proceedings in relation to frauds and scams. Any resolution is subject to approval by the Federal Court of Australia and HSBC cannot comment further at this stage”.
The case returns for a one-day hearing today.
