HSBC Bank Australia has agreed to pay a $35 million penalty after admitting it did not protect customers from scams that cost some victims their life savings.

HSBC failed to maintain control of its internal transfer system where significant client losses occurred, Federal Court Justice Elizabeth Bennett found, while the bank conceded it had breached the ePayments code by taking too long to investigate scam reports — about 144 days on average

It also did not correctly apply rules when determining if customers or banks should bear the losses of scams, and admitted it did not have proper avenues in place for customers to regain access to their accounts once locked out by an incident.

Know the news with the 7NEWS app: Download today

The matter was heard in the Federal Court on Thursday, where Justice Bennett said the breaches were serious and that the $35 million financial penalty was appropriate.

HSBC was aware as early as May 2021 that scammers were impersonating their staff, and admitted it failed to protect customers from financial and non-financial harm.

Australian Securities and Investments Commission (ASIC) chair Sarah Court said victims were collectively left tens of millions of dollars out of pocket and had to wait months to find out what happened to their money, causing stress, guilt and panic.

More than 1000 reports of unauthorised transactions worth $34.6 million were made between January 2020 and August 2024.

Among those scammed was a 51-year-old dental technician ($47,000), and Victorian couple in their 50s who had $48,000 transferred from their home loan.

HSBC customers previously told 7NEWS.com.au how they had been targeted in cruel scams and felt unheard.

A Sydney man’s surprise plan to take his parents overseas was dashed when $50,000 was stolen in a cruel scam, and a Melbourne woman’s dream of home ownership was reduced to rubble in just moments when the same amount vanished from her account.

HSBC responds to $35m penalty

HSBC said in a statement it was pleased to have reached an agreement to resolve proceedings.

“We apologise to our customers who were impacted by these events,” a HSBC spokesperson said on Thursday.

“We are pleased to have reached an agreement to resolve the proceedings with ASIC, which recognises our customer redress program and the significant enhancements made to our fraud and scam prevention, detection and response.”

The bank has also been ordered to publish their wrongdoings through its digital platforms and in letters to customers.

Court said the outcome is “one of the first of its kind globally”.

“The $35 million penalty ordered against HSBC is the strongest scam wake-up call yet to the banking industry,” Court said.

“Banks have been well on notice about the risks of scams for some time.

“They have now been given a clear message to have adequate controls and ensure their interactions with scam victims help – not hinder.”

The corporate watchdog, which commenced civil penalty proceedings against HSBC Bank Australia, said that to date the bank had paid about $21.5 million compensation through the remediation program, and more would come before the end of July.

The bank has also recovered and returned $6.5 million in customers.