HSBC's $35 Million Penalty and What It Means for Every Australian Business Making Payments

One thousand customers. Thirty-four point six million dollars lost to scammers. One hundred and forty-four days - on average - before HSBC even finished investigating a complaint.

Those are the numbers behind ASIC’s landmark action against HSBC Australia, which last month became one of the first rulings of its kind anywhere in the world. On 20 July 2026, ASIC announced a record $830 million in civil penalties across its 2025-26 enforcement year - an eightfold increase on the prior year. The HSBC case sits at the centre of that enforcement surge, and it says something important about where payment fraud risk sits in Australia right now.

If you run finance for an Australian business, those numbers are worth sitting with for a moment.

What the HSBC Case Actually Involved

Between January 2020 and August 2024, more than 1,000 HSBC Australia customers reported unauthorised transactions worth a combined $34.6 million. These were not novel or sophisticated attacks. The majority were impersonation scams - criminals calling customers while pretending to be HSBC staff, persuading them to hand over account access, and then moving money before the customer realised what had happened.

From mid-2023, these reports surged roughly 380%. HSBC’s own data showed the spike. What the Federal Court found was that HSBC’s response to that spike was inadequate on multiple fronts: the bank had no effective mechanism to help locked-out scam victims regain account access, its internal investigation process took an average of 144 days per case to finalise, and its controls on internal transfers were not adequate for the scale of the problem.

Justice Bennett ordered HSBC to pay $35 million in penalties and to publish adverse publicity notices across its website, its app, and in direct letters to affected customers. The bank has since paid approximately $21.5 million in compensation and recovered a further $6.5 million from fraudulent accounts to return to victims - but the money that could not be recovered is gone.

ASIC chair Joe Longo described the outcome as reinforcing “the core responsibility of banks to protect their customers from scams.” For the first time in Australia, a court has put that responsibility in writing with a nine-figure consequence attached.

The $830 Million Enforcement Year

The HSBC ruling is the centrepiece of a broader shift in how Australian regulators approach fraud and scam failures. ASIC’s 2025-26 enforcement total of $830 million covered failures across banks, superannuation trustees, market participants, and financial services firms. The prior year produced $104.1 million in penalties. That is not a marginal increase - it reflects a fundamental change in how the regulator is approaching the question of who is responsible when Australians lose money to fraud.

Simultaneously, AUSTRAC expanded its anti-money laundering and counter-terrorism financing regime from 1 July 2026 to capture real estate agents, lawyers, conveyancers, and accountants - thousands of businesses that now carry formal obligations to monitor and report suspicious financial activity.

The Scams Prevention Framework, meanwhile, places statutory obligations on banks, telecommunications providers, and digital platforms to implement safeguards against scam activity. These are not aspirational guidelines. They carry enforcement teeth, as HSBC has now discovered.

The direction of travel from every major regulator is the same: having inadequate controls is itself a liability.

Why Business Payments Are the More Dangerous Problem

The HSBC case centred on retail customers losing money from personal accounts. Business payment fraud is a different, larger, and faster-growing problem - and it plays out in a way that is significantly harder for banks to catch.

Payment redirection scams - where a fraudster intercepts a supplier’s invoice and replaces the BSB and account number with their own - cost Australian businesses $152.6 million in 2024. Business email compromise, the broader category covering invoice fraud and impersonation of suppliers and executives, is the highest-reported cybercrime type causing financial loss in Australia, with self-reported losses exceeding $167 million a year according to figures from the Australian Signals Directorate.

These attacks do not require account takeover. They do not need access to your bank. They need one thing: to convince someone in your accounts payable team to send a legitimate, authorised payment to the wrong account. The money leaves your books as a normal outgoing transaction. Your bank sees a payment instruction your team generated and authorised. By the time the real supplier follows up on an unpaid invoice, the money is dispersed through mule accounts and almost certainly unrecoverable.

This is precisely where your bank cannot protect you. The fraud succeeds before the transaction even reaches the rail.

What Confirmation of Payee Proves

Australia’s Confirmation of Payee service - an industry-wide system that checks account names against BSB and account number combinations before a transfer completes - hit 150 million checks in its first year of operation. Launched in July 2025 and now live across more than 100 financial institutions covering 143 million accounts, CoP shows customers a green, amber, or red match result whenever they are about to send money.

One participating financial institution reported that more than 570,000 payments were abandoned after customers received a mismatch result. Of those, more than 10,000 were headed to accounts already listed on the Australian Financial Crimes Exchange as linked to fraud or scam activity.

That is the verification principle working in practice. Checking whether the name matches the account - before the money moves - stops fraud that would otherwise succeed.

But CoP operates at the consumer transfer layer. It fires when an individual logs into internet banking and enters account details. It does not reach into the accounts payable workflow of a business - the moment a new supplier record is created, the moment emailed bank detail changes are applied to an existing payee, or the moment a weekly payment run is approved for processing.

The Gap in Every Business Payment Workflow

Think about how payment fraud actually enters a business.

A supplier calls to say they have changed banks and will follow up with updated account details by email. An email arrives - correct sender name, familiar domain format, professional tone. Someone in accounts updates the payee record. Three payment runs later, your supplier calls to ask why they have not been paid. The email was from a spoofed domain. The account received six weeks of payments before anyone noticed.

Or an ABN gets submitted through your new-contractor onboarding form. The account name matches. The ABN looks valid. Nobody checks whether the ABN is actually registered to a trading business, whether it has been deregistered, or whether the account is associated with prior fraud reports. The contractor delivers the first month’s work, invoices, and gets paid. Then they invoice again, collect again, and stop answering calls.

These are not edge cases. These are the scenarios that produced $167 million in losses last financial year. The common factor in all of them is that nobody verified the payee - the person, the business, or the bank account - before the payment was set up or authorised.

Verification Before the Money Moves

What good controls look like in 2026 is not complicated, but it requires doing the check at the right point - in the payee management workflow, before a payment is ever queued.

That means:

• Verifying the ABN or ACN against ASIC and ATO records when a new supplier or contractor is added, not assuming the number supplied is active or legitimate.
• Confirming in real time that the BSB and account number match the account name provided - the same check CoP runs at the bank level, applied at the point the payee record is created.
• Running identity verification on individuals receiving payments where the risk warrants it - particularly for high-value contractors, new payees, or accounts that cannot be confirmed through business registry checks.
• Flagging mismatches and anomalies before payment approval, not routing them into a weeks-long dispute process after the money has left.

Person, business, bank account - verified in sequence, before the payment is authorised. That three-layer approach matches the actual attack vectors businesses face: fake individuals, fictitious or misrepresented businesses, and fraudulent account numbers.

What the HSBC Ruling Should Change in Your Finance Team

The Federal Court found that HSBC had inadequate controls for a known and growing risk. The 380% surge in impersonation scam reports starting in mid-2023 was not invisible - HSBC could see it. What the court penalised was the failure to respond to that signal with appropriate controls.

Australian businesses are not yet subject to the same statutory obligations as banks under the Scams Prevention Framework. But the logic of the HSBC judgment applies more broadly: when fraud signals are visible, when the risk is well-documented, and when controls were available - a failure to implement those controls is a choice, and choices have consequences.

More practically, payment fraud disputes between businesses and their banks, suppliers, and counterparties are landing in court more frequently. Finance teams are being asked to demonstrate that reasonable steps were taken to verify payment details. “We trusted the email” is no longer a sufficient answer.

The businesses that are best positioned in this environment are those that have built verification into the front end of their payment workflow - so the question is answered before any money moves, not excavated after it is gone.

The $35 million question ASIC put to HSBC is the same question any Australian finance team should be asking right now: if a similar scam hit us next month, could we show that we did the verification?

---

ezyshield is on a mission to eliminate payment fraud in Australia. We verify the person, the business, and the bank account before money moves - so payments only ever land with who they’re meant to. Learn more