HSBC agreed to pay a A$35 million (US$24.6 million) penalty to resolve legal action by the Australian Securities and Investments Commission. The regulator alleged systemic failures in the bank's internal controls, leaving customers vulnerable to impersonation scams. The bank admitted these serious failures instead of contesting the 2024 lawsuit.

Fraudulent spoofing messages led to a 380 per cent surge in unauthorized transactions between early 2023 and late 2024. Victims lost tens of thousands of dollars, with some losing nearly their entire savings. To address these losses, the bank has already paid out A$28 million in compensation and refunds to affected customers.

This settlement follows a pattern of regulatory trouble for the UK-based lender. Recent penalties include a £57.4 million fine from the Bank of England and a £64 million fine for anti-money laundering weaknesses in 2021. The Federal Court of Australia must now approve the final settlement agreement.

Sarah Court of Asic stated the case sends a clear message that protecting customers from scams is a core responsibility of banks. The bank's failures left many customers facing financial distress and account lockouts. This case marks one of the first global examples of banks being held accountable for scam prevention.