Global telco escapes penalty for bank scam texts despite customers losing millions

Telco given warning after consumers lose millions in HSBC text scam Fri 19 Jun 2026 at 4:37am A global telco that failed to stop more than 1,000 scam text messages from reaching Australians has faced no consequences, the ABC can reveal. HSBC bank customers were defrauded out of tens of millions of dollars in a long-running bank impersonation scam after they were duped by fake SMS messages. The lack of action by the regulator, the Australian Communications and Media Authority (ACMA), has been criticised by victims and advocates who say it raises questions about whether it has sufficient powers. Yesterday, HSBC admitted that it failed to protect customers from scams and agreed to a $35 million penalty in the Federal Court. HSBC customers made more than 1,000 reports alleging scammers had netted more than $34 million between January 2020 and August 2024. The scam text messages claimed to be from HSBC warned the customer about suspicious transactions and urged them to ring a fraud team. When the customer called the number listed, a scammer would gain access to their account and steal as much money as possible after gaining the person's trust. The fraudulent messages appeared in the same thread as legitimate texts from the bank. Last August, the ACMA found Telesign — a California-based company — had allowed 1,121 messages impersonating HSBC to pass through its network, but the company failed to tell the regulator — breaching the industry scams code. Telesign markets its ability to let SMS text messages reach customers around the world and uses the tagline, "The future is built on trust". In total, Telesign failed to share information about more than 11,000 SMS scam messages. However, Telesign did not receive a fine or other enforcement action and was only warned by the ACMA that it needed to comply with the scams code. The regulator said in a statement the direction to comply was, "the strongest enforcement option currently available for a first-time offence". Only a second breach can result in a maximum penalty of up to $250,000. When the ACMA announced the findings of its investigation, it did not mention the HSBC bank scam. Telesign's involvement only came to light after the ABC sent questions to the regulator asking whether it had taken any action against telcos for their involvement in allowing fraudulent messages to reach bank customers. 'A bit of a cop-out' Sydney woman Sunni Wan lost almost $50,000 in the scam. It took Ms Wan almost a year to get the money back from HSBC. She said the lack of consequences for Telesign was concerning. "It's totally upsetting," she said. "They should definitely get a financial penalty." Stephanie Tonkin, CEO of the Consumer Action Law Centre, said the fraudulent text messages had acted as the "gateway". She criticised the ACMA for not naming Telesign's involvement in the HSBC scam. "I find that disappointing and entirely unhelpful," Ms Tonkin said. In March 2024, Ms Tonkin publicly called on the ACMA to urgently investigate the HSBC scam due to the growing number of victims. She believes the regulator was too slow to act — although she concedes the limitations of the industry code. "They could've issued a direction under the scams code years earlier," she said. "To simply rest on the laurels and the weak two-step process in the current scams code, I think that's a bit of a cop-out." Carol Bennett, CEO of the Australian Communications Consumer Action Network (ACCAN) said there was a contrast between the lawsuit taken by the corporate watchdog ASIC against HSBC and the "passive response" from the ACMA. "One of the really concerning things about this example, and it's one of many, is the lack of powers that ACMA has had to date to actually take decisive action in a way that ASIC and ACCC and other regulators seem to do," she said. The ACMA was unavailable for interview. In a statement to the ABC, the telco regulator said it, "rejects any suggestion that it failed to act promptly". In March 2024, the ACMA said it examined how HSBC scam traffic was moving across Australian telco networks and "found that the scams were highly sophisticated and likely to have originated overseas". The next month it put HSBC bank on a pilot of the SMS Sender ID register to reduce the impact of impersonation scams. The ACMA also defended the time its Telesign investigation took which began in August 2024 and was finalised a year later. It did not say why it didn't mention Telesign's involvement in the HSBC scam. "These investigations are highly complex, involve interrogation of an extensive amount of data and can take a number of months to finalise," it said. In a statement, Telesign said it regretted allowing the fraudulent HSBC messages to go through its platform. The company said it had reviewed and strengthened its processes and was committed to "protecting end users from the harm that scam messages cause". Tougher penalties to come Under proposed changes by the Albanese government ACMA would no longer be required to warn telcos before imposing a fine, which could be up to $10 million. Next month another change will help people decipher legitimate text messages from dodgy ones. The SMS Sender ID Register will brand the legitimate text messages of businesses and other organisations so customers know its trustworthy — for example a message from the tax office might say "ATO" at the top. Luke Coleman, CEO of industry peak body the Australian Telecommunications Alliance (ATA) said the abuse of SMS sender IDs "has been a real problem," but believes the new register will make a difference. "If the SMS sender ID has not been registered, you will see the word 'unverified' (on screen) and that should be a warning to most people that they should think twice about what's in that message." Another significant change will be the Albanese government's scam prevention framework which will begin at the end of March 2027 and sets tougher obligations on telcos to detect and prevent scams — with higher penalties. In a statement a spokesperson for the Albanese government said: "The Australian Communications and Media Authority play an important role in preventing scams and we expect them to do everything in their power to hold industry to account." [Image text:] 110 HSBC You HSBC Plea YO didn' 1O AE 613