ASIC’s move on HSBC shows the fight against scams just got serious

All banks are now on the hook as the corporate regulator asks ‘how much is enough’ when it comes to protecting customers.

HSBC has been accused of not doing enough to protect customers from scams. Picture: AFP

Australia’s major banks collectively spend hundreds of millions each year fighting scams, working closely with regulators and police to try and stay ahead of the game against scammers.

Not only do they all this because they have a responsibility to protect their customers under the banking code of conduct, losses linked to scams also represent big dollars. This could come back to hurt them financially if left unchecked.

With more banking going through digital channels, banks have found the best defence is prevention, to head off the scammers before they can strike. This involves using everything in their tech toolkit, from using artificial intelligence to monitor transaction behaviour to having “physical” barriers to payments such as biometric technology. The banks too have been working with telcos on scams.

Commonwealth Bank last year prevented more than $400m in scams on customers taking place. Westpac stopped nearly $240m. Other banks have reported similar figures, getting the total number across Australia’s banking system to around $1bn annually.

However, the fight has now been turned up several notches, with the corporate regulator launching legal action against global bank HSBC for allegedly not doing enough to prevent scammers. The legal action means all banks are now on the hook.

The Australian Securities and Investments Commission action now seeks to define the legal obligations all banks will have in protecting their customers.

In this case, ASIC has taken the first court action under the banking code of conduct, which was beefed up in 2019 up after the Hayne financial services royal commission.

While signing up to the code is voluntary (although a requirement for a bank to join the Australian Banking Association) it is enforceable by law.

ASIC on Monday alleged HSBC didn’t do enough to stamp out scams and fraud, including monitoring transactions to distinguish between normal, criminal or automated payment behaviour. The regulator claims HSBC’s digital identify safeguards fell short across its mobile and online platforms and its banking software lacked the sophistication to monitor frauds in real time.

ASIC Deputy Chair Sarah Court in Sydney, providing an update on the regulator suing HSBC Australia, alleging failures to adequately protect customers from scams. Picture: Gaye Gerard

And then for those customers hit with fraud, the bank was painfully slow to sort out the dispute, ASIC alleges. Indeed, on average it took 145 days to deal with a customer complaint, the code of conduct has a required time frame of no more than 45 days.

ASIC alleges, from about mid-2023, there was “a significantly increased” volume of fraud and unauthorised payments. As a result, customers lost significant sums of money, primarily after fraudsters had obtained access to their accounts after impersonating HSBC Australia staff, and through “Smishing”, which convinces a customer to reveal sensitive information.

The ASIC action relates to 950 cases where scammers stole as much as $23m over five years.

HSBC is yet to respond to the claims, however, the case will surely turn on how much activity is enough to prevent a scam.

While scams can’t be eliminated entirely, it will seek to establish the new minimum threshold for what banks should be doing in the fight.

The heart of ASIC’s claim — HSBC lacked the sophisticated technology to stamp out scams — will send shockwaves through the global bank. It has 41 million customers across more than 60 countries, and many rely on the bank for trade and business transactions.

The bank has a fraught history with regulators, including being fined more than $US2bn early last decade by the US, where in Mexico it had turned a blind eye to drug cartels laundering hundreds of millions of dollars.

Furthermore, it has also paid out millions in fines in its home market in the UK for failure of anti-money laundering controls.

HSBC’s new global chief executive, Georges Elhedery, is reviewing plans to pull back its retail banking operations from some markets across Asia and Latin America as part of cost-cutting measures.

[e-mail]

Originally published as ASIC’s move on HSBC shows the fight against scams just got serious