ASIC: The Devastating Impact Behind Bank Impersonation Scams

‘I thought I was doing the right thing to protect my money.’

That is how one HSBC customer described responding to what appeared to be a genuine message from their bank before having their money stolen by a bank impersonation scam and spending months without clear answers about what had happened.

‘It was emotionally devastating. I could not sleep or eat properly… I felt bad that I had lost the money and I punished myself for it. I felt like the bank was blaming me, even though I thought I was speaking to the bank and trying to stop a scam,’ the victim said.

As Scams Awareness Week begins, ASIC is highlighting the harm caused by scams and urging Australians to be on alert for bank impersonation scams, which are designed to exploit people’s trust in their bank and pressure them to act quickly.

ASIC’s warning follows the Federal Court recently ordering HSBC Bank Australia Limited to pay a $35 million penalty after the bank admitted to significant failures in protecting customers from scams and responding to customer reports when scams occurred.

The case was one of the first of its kind globally and reinforced that banks have a responsibility to protect their customers from scams.

HSBC admitted that because of its failure to adequately protect its customers from scams, customers were put at greater risk of financial and non-financial harm, and some suffered that harm.

Consumer impact of bank impersonation scams

One of HSBC’s victims described the impact after receiving what they thought was a genuine text message from the bank:

‘I had been an HSBC customer for more than 20 years. I received a text message that looked like the real messages I had always received from the bank, and it came through in the same message thread that I had received messages from HSBC before... I believed the message was genuine, and I thought I was doing the right thing to protect my money.

‘I called the bank within half an hour and reported everything. I went to the police station and made a report. I thought that because I had acted so quickly, the bank would help me. Instead, what followed felt like torture.

‘Months and months went by and I still had no real answers about where my money had gone or whether I would get any of it back.’

What should you look out for?

Bank impersonation scams can start with a phone call, text message, email, social media message or other contact that appears to come from a trusted bank or financial institution, for example:

• Phishing emails attempting to impersonate your bank with subjects such as ‘Recurring bank instruction created – please review’ or ‘Reminder – Verification identity needed’

• Text messages reporting that your online access has been blocked due to unusual activity

• An unexpected call from someone claiming to be from your bank, asking for your personal details and bank codes.

Scammers often claim there is suspicious activity on an account and pressure people to move money, share passwords or codes, or click on links to “keep their money safe”.

ASIC Commissioner Alan Kirkland said bank impersonation scams can cause devastating financial and emotional harm.

‘These scams are designed to create fear and urgency. Scammers make people believe their money is at risk and convince them to act quickly without stopping to check.’

Banks have a critical role as part of a broader industry ecosystem in helping protect:

• their customers from scams, and
• against misuse of their bank’s brand and brand assets

Poor anti-scam practices from the banks can have a devastating impact on their customers.

Between 1 January and 30 June 2026, the National Anti-Scam Centre (NASC) received 5,262 Scamwatch reports of bank impersonation scams with losses of $3,249,618.

Protect Yourself