Profits Over Consumer Protection? HSBC’s Legal Challenge

•
June 12, 2025    

Some lessons come with a price. The recent lawsuit against HSBC by the Australian Securities and Investments Commission highlights how banks sometimes prioritize profits over customer safety. Despite repeated internal warnings from its own fraud experts, HSBC failed to act. In the end, the bank faces not just regulatory scrutiny but also reputational damage and financial losses.

See Also: OnDemand | Navigate the threat of AI-powered cyberattacks

Now, many are asking: Was it worth it to chase profits, rather than invest in consumer protection?

According to internal documents filed in the court by ASIC, HSBC Australia’s “failings were widespread and systemic,” and it failed to protect customers, which allowed criminals to “impersonate bank staff and drain their customers’ accounts.”

The ASIC said HSBC Bank Australia Limited was aware of the risks associated with unauthorized transactions as early as January 2023 but failed to address known gaps in its fraud control systems. This oversight left customers vulnerable to financial losses. Cases involving fraudsters impersonating HSBC staff escalated in mid-2023. Even worse, ASIC alleged HSBC failed to comply with its obligations under the ePayments Code through delays in investigating scam reports and restoring customer account access, further undermining consumer protection.

Australia’s ePayment Code governs unauthorized transactions, mistaken payments, disputed transactions and security obligations for both consumers and financial institutions.

What’s surprising is that the bank chose to ignore repeated warnings by its fraud team. According to court filings, in March 2021, HSBC fraud staff gave an internal presentation that the bank had “no real-time interception or payment-holding to clarify suspicious transaction content with customers.”

This capability would have allowed the bank to pause suspicious transactions before money left customer accounts. Despite warnings of a steady rise in incidents each month, the management took no visible action to upgrade controls.

Court documents show that in mid-2023, HSBC Australia’s head of fraud warned internally about a growing impersonation scam targeting its customers.

HSBC has not publicly explained why it ignored these alerts. In similar cases, organizations often cite cost-optimization strategies. But in this case, saving on fraud controls has led to costlier fallout. Whatever HSBC thought it was saving is likely to pay much more both in financial and reputational costs. It’s one thing to get blindsided by cybercriminals. It’s another to ignore warnings from your fraud team for more than two years while account takeovers are skyrocketing.

While profitability matters, bank executives must understand the real cost of ignoring fraud warnings. Failing to act, especially when internal teams have warned of the consequences, undermines long-term trust in the organization – and with customers. And that trust, once lost, is expensive to rebuild.

Australia’s new anti-scam framework takes a broader view. Rather than placing all liability on banks, it calls for shared responsibility across financial institutions, telecom carriers and internet platforms. But as that framework evolves, it must also include stronger deterrents for banks that knowingly skip basic fraud prevention steps to protect customers.

This case may be an example of regulators having to consider intent, inaction and the consequences for consumers. And for a bank that disregards red flags from its own fraud staff, it’s not a good look.