By Sam McKeith in Sydney

A landmark lawsuit against a major bank for allegedly failing to stop customers from being scammed out of their life savings is a warning to the sector to get serious about preventing fraud.

The Australian Securities and Investments Commission on Monday launched a civil suit against HSBC Australia for failing to protect customers from scams, which it says resulted in losses of about $23 million over four years.

The Federal Court case, the commission’s first lawsuit involving scam prevention, centres on about 950 reports of unauthorised transactions allegedly received between January 2020 and August 2024.

HSBC is accused of failing to have adequate controls to prevent and detect the unauthorised payments, and not acting quickly enough on scam reports.

Commission deputy chair Sarah Court said the lawsuit puts the nation’s banking sector on notice about adhering to anti-scam rules.

“We’ll be seeking very significant penalties firstly to send a message to HSBC to hold it to account, but also as importantly to send a broader message to the banking sector, more generally, that they have to take these obligations very seriously,” she said.

“We consider the failure by HSBC Australia to comply with these obligations was significant, widespread and systemic.

“The bank failed to adequately protect its customers.”

Some customers reportedly lost their life savings due to the scams, while the sums taken included amounts of more than $90,000, Ms Court said.

The corporate regulator also alleges major delays in HSBC’s fraud investigation process and that it took an average of 145 days to respond to scam reports, rather than the required maximum of 45 days.

During this time, affected customers were allegedly locked out of accounts for an average of 95 days, while one customer was unable to access their funds for 542 days.

“We are absolutely concerned that HSBC was on notice from as early as 2020 that there were scam-related losses or unauthorised transaction losses that were happening to its customers,” Ms Court said.

HSBC Australia has previously faced criticism over its handling of fraud claims, with customers and advocacy groups recently raising concerns over slow responses and poor communication.

The bank, a subsidiary of one of the world’s largest banking groups, said it was considering the issues raised in the case and would continue to work constructively with ASIC.

“Protecting our customers from scammers remains a top priority,” a spokesperson said.

“We continue to make significant investments in our fraud and scam prevention, detection and response.”

The lawsuit was likely the start of broader action by the corporate regulator as some financial institutions are lagging on curbing scams, Griffith University cybersecurity expert David Tuffley said.

The senior lecturer in information and communication technology said banking players “who do need to level up a bit will come in for some scrutiny”.

“This is a pretty salutary case that will not be lost on the banking sector,” Dr Tuffley added.

Australians lost $2.74 billion to scams in 2023, according to the Australian Competition and Consumer Commission.

The vast majority of the losses are borne by customers.

Laws to establish a scam prevention framework were introduced to parliament in November, including fines of up to $50 million if a business did not take reasonable steps to prevent, respond to or report scams.

Federal Financial Services Minister Stephen Jones would not comment on the court action against HSBC but his spokeswoman said the framework would make “Australia the toughest target in the world for scammers”.

The proposed laws would “put obligations on banks, social media companies and telcos to prevent scams or face hefty fines and compensation for victims”, she said.