HSBC Australia's $35 million scam penalty covers five separate failures, not one

On 18 June 2026 Justice Elizabeth Bennett of the Federal Court, sitting in Melbourne, ordered HSBC Bank Australia Limited to pay $35 million to the Commonwealth. The bank admitted the case and the penalty was put to the court jointly by HSBC and the Australian Securities and Investments Commission. Almost all reporting has described the outcome as a fine for "scam failures", a single label for a single number.

The notice HSBC was ordered to publish on its own website on 7 July 2026 is more precise. It records five separate declarations, each with its own date range, and only one of them is about stopping a scam before the money moves.

The first covers 29 May 2023 to 29 May 2024, and concerns HSBC's failure to have adequate prevention and detection controls on an internal payment rail, the channel used for transfers between HSBC accounts. This is where, on ASIC's account, the majority of customer losses occurred. The second and third both run from January 2020 to August 2023: systemic non-compliance with the ePayments Code timeframes for investigating reports of unauthorised transactions and notifying customers of the outcome, and widespread non-compliance with the Code's rules for deciding whether the customer or the bank bears the loss. The fourth, from January 2020 to November 2024, is a failure to have adequate systems to identify and report on its own compliance with the Code. The fifth, from January 2020 to April 2024, is a failure to restore customers' access to their accounts within a reasonable time after access was restricted following a fraud report.

Four of those five, in other words, are about what happened to customers after the money had already gone.

The 144 day figure belongs to the second declaration. ASIC states that HSBC took an average of 144 days to investigate a report of an unauthorised transaction. The ePayments Code, which HSBC had subscribed to, sets much shorter periods. Fintech News Australia and Australian Broker both record that HSBC received more than 1,000 reports of unauthorised transactions totalling $34.6 million, and the ABC reported that unauthorised transaction reports rose by about 380 per cent across 2023 and 2024.

On remediation, ASIC states that HSBC has paid approximately $21.5 million in compensation, with further payments due before the end of July 2026, and that a further $6.5 million was recovered and returned to affected customers. The bank has also been ordered to run a compensation programme for eligible customers, and to publish the adverse publicity notice on its website, in its mobile app and in letters to affected customers.

ASIC deputy chair Sarah Court described the outcome as one of the first of its kind globally and said the penalty was the strongest scam wake up call yet to the banking industry. HSBC, in a statement about itself, apologised to customers and said it had made significant enhancements to its fraud prevention. ASIC commenced the proceeding on 13 December 2024.

What the record does not establish is scale. Neither ASIC's media release nor the court ordered notice states how many customers were affected in total. The declarations are framed by conduct and by date, not by headcount. The $34.6 million in reported unauthorised transactions is a figure for reports received, not a finding about how many people ultimately lost money or how many were wrongly held liable under the mis-applied ePayments Code rules. The ABC reported that more than 400 complaints against HSBC had been determined by the Australian Financial Complaints Authority with about $8.67 million awarded, and that some customers remain short of full reimbursement, but that is a count of people who complained rather than a count of people affected.

The second thing the record does not settle is whether the internal payment rail problem is peculiar to HSBC. The declaration is specific: a rail used for transfers between accounts at the same bank, carrying weaker controls than the rails used to send money elsewhere. Nothing in the judgment or the notice says anything about how other Australian banks treat the equivalent channel, and no regulator has published a comparison.

The compensation programme is still running. Until it closes, the number of customers behind the $35 million remains unpublished.