The HSBC scam text: $23 million lost, a $35 million fine - and a payout fight that isn't over

In June 2026, HSBC Australia admitted in the Federal Court that it had failed to protect its customers from a long-running text-message scam, and agreed to a $35 million penalty - the first case of its kind anywhere, brought by ASIC, whose chair called protecting customers from scams “a core responsibility of banks”. Between January 2020 and August 2024 the bank received around 950 reports of unauthorised transactions. Customers lost about $23 million. Individual losses ran from $47,000 - most of one woman's life savings - to more than $90,000.

Today the story is back in the news for what happened after the fine. HSBC has paid roughly $21.5 million in compensation and returned another $6.5 million it recovered, but victims say the process has been uneven and opaque: some were repaid in full, others accepted much smaller “goodwill” offers because they couldn't afford to keep waiting, and support groups accuse the bank of secrecy over how payouts are decided. The bank's own numbers during the scam tell you why prevention matters more than remediation: investigations took 145 days on average, and one customer waited 542 days to get full access to their accounts back.

What the text looked like

This is a reconstruction of the pattern, not any one victim's message - but if you banked with HSBC in those years, it will look familiar:

Nothing about it reads like a scam. No misspellings, no strange link, no lottery win - just a bank doing what you'd want a bank to do. The trap is the phone number: ring it and a calm, professional “fraud team” answers, confirms the fake payment, and begins helping you “secure” your money.

Why careful people fell for it

The messages were sender-spoofed - forged to display “HSBC” as the sender - which means many landed in the same message thread as the bank's genuine texts, stacked directly under real one-time codes and real alerts. Every instinct says a message in that thread is from the bank. That instinct is exactly what the scam rents. A text from your bank's real number can still be a scam - the thread proves nothing; only a call you place on a number you already had proves anything.

The call-first version: when the text is the “proof”

Today's coverage detailed the nastier sequence. For one customer, the call came first: a man claiming to be HSBC's fraud department, who already knew the last four digits of his account. He did the right thing - he refused to read out a code, because he couldn't verify who was calling. So the scammer sent a text, spoofed to land in his genuine HSBC thread, as proof the call was real. His own phone appeared to corroborate the lie. The defence everyone teaches - be suspicious, verify who's calling - was performed, and then defeated by forged corroboration.

Channels can't vouch for each other. A text can't prove a call is genuine, and a familiar-looking thread can't prove a text. As of today, our checker flags this exact shape - a message whose only job is to certify a live phone call - as a scam outright, because no bank sends one. Ever.

The “safe account” move

Once the fake fraud team had someone on the phone, the ask was almost always the same: your accounts are compromised, so move your money to a safe account while we investigate. The safe account belonged to the scammers. Transfers made this way are authorised by the customer, which is precisely why they are so hard to claw back afterwards - and why the safe-account request is the scam itself, every single time.

Doesn't the new Sender ID Register fix this?

Partly - and it arrived after this scam's entire run. From 1 July 2026, the ACMA's SMS Sender ID Register became mandatory: registered sender names display as normal, and texts sent with unregistered sender IDs are over-stamped “Unverified” and grouped separately. That kills the exact trick used here - a forged “HSBC” landing in the real HSBC thread - for registered brands.

What it can't do: read the words inside a message, verify a callback number or a link, or follow the scam to where it moves next - ordinary mobile numbers with the bank's name typed into the body, iMessage, WhatsApp, email. And it quietly trains a dangerous shortcut: no warning label means safe. A scam text from a plain mobile number carries no label at all. Treat every unexpected bank message the same way, label or not: don't use its numbers or links, and ring the bank on the number from your card.

The ten-second check

1. Don't call the number in the text, and don't tap anything. The contact channel is the trap.
2. Forward the message and have it checked before you act - you can check a message free, no sign-up. The spoofed-sender pattern and the callback-number trap are exactly what a checker is for.
3. If you want to hear it from the bank, ring 132 152 yourself. A real problem will still be a real problem on the official line. A fake one evaporates.

If money has already left

Move fast and don't be hard on yourself - this scam was professional enough that a court fined a global bank for failing to catch it. Ring your bank immediately on the number from your card and say the word “scam”: recalls are most likely to succeed in the first hours. Then call IDCARE on 1800 595 160 (free, confidential) and report it at Scamwatch. If the bank's reimbursement answer doesn't sit right, you can escalate to AFCA at no cost - that route is how one HSBC customer won full repayment plus compensation. We've written honestly about what getting money back after a scam really looks like - including why anyone who promises recovery is usually the next scam.

Not an HSBC customer? You'll get these anyway

These texts are sprayed, not aimed. Receiving an “HSBC” alert when you've never held an HSBC account is itself the tell - and the same script runs under every bank's name. The rule doesn't change with the logo: the thread proves nothing, the callback number is the trap, and no bank has a safe account.

Common questions