A Bank Averaged 144 Days on Scam Reports When the Code Allows 45

Scams Awareness Week began on Monday, and ASIC marked it by pointing back at June, when the Federal Court ordered HSBC Bank Australia to pay a $35 million penalty over failures to protect customers from scams. One number in that judgment matters more than the penalty. HSBC took 144 days on average to investigate a customer's report. The code it had signed up to allows 45.

That code is the ePayments Code, administered by ASIC. Banks opt into it and are bound once they do, and it sets out what your bank has to do, and by when, once you tell it money left your account without your say-so.

The clock the Code sets

Clause 18.1 gives your bank 21 days from receiving your report to either finish the investigation and tell you the outcome in writing, or tell you in writing that it needs more time. Clause 18.2 sets the outer limit: unless there are exceptional circumstances, the investigation must be complete within 45 days. Clause 18.4 requires the outcome and the reasons for it, with references to the clauses relied on. These are the obligations HSBC admitted breaching, and Justice Bennett held those failures were widespread and systemic.

Which kind of scam you had changes the rule

The clock only runs on what the Code calls an unauthorised transaction, and the definition is narrow. It means a transaction "not authorised by a user", and expressly excludes "any transaction that is performed by a user themselves or by anyone who performs a transaction with the knowledge and consent of a user".

That exclusion does a lot of work. If someone got into your account and moved your money, the 21 and 45 day deadlines are yours to point at. If a caller convinced you your account was compromised and you moved the money yourself, you authorised that payment, and the Code's timeframes are not what you are relying on. A third case sits apart: the right amount sent to the wrong account is a mistaken internet payment, and the sending bank is expected to start its own process within two business days.

Business accounts sit outside it

Clause 2.1 excludes transactions performed using "a facility that is designed primarily for use by a business, and established primarily for business purposes". A business transaction account is not covered, so neither deadline is one you can hold your bank to there. Clause 2.3 does let a bank apply the Code more widely, and some do.

A wider net is coming. Under the Scams Prevention Framework, the sector designation registered in May requires covered banking, telecommunications and digital platform services to be members of an authorised external dispute resolution scheme from 1 September 2026, with the remaining obligations applying from 31 March 2027. Treasury says the Minister intends to prescribe the Australian Financial Complaints Authority as that single scheme.

What to do

Start the clock on a date nobody can argue about. Ring the bank, then put the same report in writing that day and keep the timestamp. Every deadline runs from when the bank received your report, and a phone log is a weaker record than an email you still hold.

Then work out which of the three cases you are in, because it decides what you can hold the bank to. On day 21, if you have neither an outcome in writing nor a written notice that more time is needed, say so in writing. On day 45, unless the bank has explained why the circumstances are exceptional, the investigation should be finished. If it decides you are liable, ask for the reasons and clause references clause 18.4 requires: that is the document a complaint gets built on.

Business owners have a job that runs before the event. Ask your bank in writing whether it applies the Code to your business accounts, and file the answer. Then put the effort where the Code cannot reach: dual approval on any new payee, and a rule that a change to a supplier's bank details is verified on a phone number you already had.

This article is general information only and is not financial advice.