Systemic and widespread failures at a major bank led to some customers being scammed out of their life savings, the corporate regulator says as it launches a landmark court action.

The significant shortcomings at HSBC Australia resulted in losses of about $23 million over a four-year period, the Australian Securities and Investment Commission said on Monday.

The regulator has launched its first lawsuit against a bank for failing to protect customers from scams in a Federal Court case that centres on about 950 reports of unauthorised transactions allegedly received between January 2020 and August 2024.

ASIC said HSBC failed to have adequate controls in place to prevent and detect the unauthorised payments, and didn’t act quickly enough to respond to scam reports when they were received.

“We consider the failure by HSBC Australia to comply with these obligations was significant, widespread and systemic,” deputy chair Sarah Court said.

“The bank failed to adequately protect its customers.”

Court did not specify what penalties the regulator would seek against HSBC in court but indicated they would be very significant.

“The maximum penalties are so high they’re almost theoretical,” she said.

Some customers reportedly lost their life savings due to the scams, while the sums taken included amounts of more than $90,000, Court said.

The regulator also alleges there were major delays in HSBC’s fraud-investigation process and that it took an average of 145 days to respond to scam reports, rather than the required maximum of 45 days.

During this time, affected customers were allegedly locked out of accounts for an average of 95 days, while one customer was unable to access their funds for 542 days.

“We are absolutely concerned that HSBC was on notice from as early as 2020 that there were scam-related losses or unauthorised transaction losses that were happening to its customers,” Court said.

The lawsuit was a landmark move for the regulator in its action to curb banking failures on scams.

“This is the very first time that we have held a financial institution to account for what we consider to be widespread compliance failures,” Court said.

HSBC Australia has previously been criticised for its handling of fraud claims, with customers and advocacy groups recently raising concerns about slow responses and poor communication.

The bank, a subsidiary of one of the world’s largest banking groups, has been contacted for comment.

Australians lost $2.74 billion to scams in 2023, according to the Australian Competition & Consumer Commission.

The vast majority of the losses are borne by customers.

Laws to establish a scam prevention framework were introduced to parliament in November, including fines of up to $50 million if a business did not take reasonable steps to prevent, respond to or report scams.

-AAP