Notice ordered by the Federal Court of Australia

In the proceedings the Court found that HSBC Australia:

1. in the period 29 May 2023 to 29 May 2024, failed to have adequate prevention and detection controls on an internal payment rail for transactions between HSBC Australia bank accounts to manage the risk that mobile and online banking customers were exposed to, of falling victim to, unauthorised payments, to a reasonable standard;
2. in the period January 2020 to August 2023, failed to have adequate systems and processes to ensure there was not widespread and/or systemic non-compliance with the timeframes in the ePayments Code for investigating customer reports of unauthorised transactions and advising customers of the outcome of those investigations;
3. in the period January 2020 to August 2023, failed to have adequate systems and processes to ensure there was not a widespread and/or systemic failure to apply the rules prescribed in the ePayments Code for attributing liability as between the customer and HSBC Australia for losses arising from unauthorised transactions;
4. in the period January 2020 to November 2024, failed to have adequate systems and processes to identify, track and report the extent to which HSBC Australia was complying with the requirements in the ePayments Code described in paragraph (b) above; and
5. in the period January 2020 to April 2024, failed to have adequate systems or processes to ensure customers were advised how to reinstate full access or use of their accounts within a reasonable time after blocks or restrictions being applied following a customer’s report of an unauthorised transaction.

HSBC Australia made admissions of contravention in the proceeding and agreed to the financial penalty. HSBC Australia also cooperated with ASIC in the investigation and during the proceeding.

In addition to paying a financial penalty, HSBC Australia is undertaking a comprehensive remediation program for affected customers in which eligible customers have been, or will be, compensated for their loss including for lost investment earnings.

HSBC Australia has taken steps to significantly enhance its capabilities for responding to fraud, including:

1. enhancements to its fraud detection and prevention capabilities, including through the integration of new technology;
2. improvements to processes for investigating and responding to reports of unauthorised transactions in accordance with the ePayments Code; and
3. improvements to the process by which customers are able to get back to banking following an account restriction or block.

For further information, see the following links:

• Federal Court of Australia judgment
• ASIC media release (which includes links to the judgment and the statements of facts and admissions agreed between the parties)

MEDIA ENQUIRIES

Jessica Effeney | jessica.effeney@hsbc.com.au
Lillian Birchall | lillian.birchall@hsbc.com.au