Multiple HSBC customers have been left “crushed” after losing their life savings in a sophisticated scam and an expert says there is little recourse available to them.
Sunni Wan and Gerald Chin were both fleeced out of nearly $50,000 by a scam impersonating their bank. They are now navigating the process of trying to get their money back.
Both HSBC customers fell for a spoofed text message that appeared to be sent by the bank and came in the same thread as previous legitimate messages. It claimed a new device had logged into their accounts and they were told to call a number provided if it wasn’t them.
Have you fallen victim to a scam? Contact firstname.lastname@example.org
The Sydney residents both called the number and, thinking they were speaking to someone from the bank, gave their names, addresses and dates of birth over the phone. They also handed over one-time passcodes thinking their accounts had been compromised.
“He sounded very professional. I didn't really think twice about it because he sounded like a HSBC representative,” Sunni told Yahoo Finance.
HSBC has since told Sunni it will not be able to recover her funds, while Gerald is still waiting for an outcome from the bank. Both customers have now made complaints to the Australian Financial Complaints Authority (AFCA), which has seen scam complaints nearly double, year on year.
“There’s a lot of stress because I’m trying to deal with all this and speak with the bank [and] AFCA,” Gerald told Yahoo Finance. “It’s taking a toll on me mentally. I personally feel let down by the system.”
Sunni and Gerald said they were both now worried about how they would deal with their rising mortgage repayments and other upcoming expenses.
“I was meant to use that money for my mum’s knee-replacement surgery and I have to delay the operation,” Sunni said.
Multiple HSBC customers scammed
Yahoo Finance has been contacted by multiple other HSBC customers who have fallen victim to the same scam and wished to remain anonymous.
One South Australian customer lost $50,000 meant for his first home deposit and said he was “slowly losing hope” he would recover the money.
Another customer from Western Australia lost $50,000 just last week and said it felt like she was living a “nightmare”.
“The stolen $50,000 has left a huge hole in our lives and I feel totally hopeless and crushed knowing that we may never recover the money back,” she told Yahoo Finance.
We also heard from an elderly man who lost his entire life savings to the scam and was now facing health repercussions, including being put on medication for high blood pressure.
Sunni and Gerald have started a Facebook group with around 10 customers who lost money to the scam and are hoping to find other victims.
Victims ‘very rarely’ compensated
Consumer Action Law Centre policy officer Rose Bruce-Smith said there were “very little legal obligations” on banks in these circumstances and victims often ended up bearing the losses.
“There is a really limited level of duty of care in these kinds of scams where someone has been called up and a lot of pressure put on them and they may have authorised a transaction, or they may have allowed a scammer to access their computer or their phone,” Bruce-Smith told Yahoo Finance.
“In those circumstances, the legal obligations on the banks are really low and it will only be in certain circumstances where there were major red flags raised and the banks were totally reckless to it. So, we see compensation for victims very rarely in these areas.”
Under the ePayments code, customers may be held liable for losses arising from an unauthorised transaction if their bank can prove they contributed to the loss. This could be the case if they voluntarily disclose their PIN or password to another person.
Customers told to not provide personal details
While HSBC has said it cannot comment on specific customer situations due to privacy reasons, a spokesperson said it took the matter “very seriously”.
“We continue to educate our customers, and again strongly remind the public that HSBC will never ask you to provide your PINs, passwords or verification codes on a phone call, in response to a text message or email,” the HSBC spokesperson told Yahoo Finance.
“Bank customers need to be vigilant about the ever-changing scam landscape. If HSBC customers are ever in doubt, or believe their details have been compromised, we ask that they go to the HSBC website and use the contact details listed.”
The bank said it was “investing heavily” to protect its customers and working with the Australian Banking Association and government bodies to address the issue.
The banking industry recently introduced a Scam Safe Accord, which outlines the actions banks will take to protect Australians against scams.
While this has been welcomed by the Consumer Action Law Centre, Bruce-Smith noted it does not outline a clear pathway for people who’ve lost money to scams to seek reimbursement. Last year, ASIC found the rate of reimbursement was between 2 and 5 per cent on average.
The group is calling on the government to go further and implement mandatory reimbursement of customers’ money lost to scams, as is now the case in the UK.
“Right now, consumers are wearing the loss and we are seeing this victim-blaming mentality,” Bruce-Smith said.
“It’s ignoring the reality of how clever and well-resourced these scammers are. Our view is that if reimbursement was mandatory, the banks and institutions would be really incentivised to put the resources into protecting consumers' money.”