A Bank Averaged 144 Days on Scam Reports. The Code Allows 45.

Scams Awareness Week began on Monday, and ASIC marked it by pointing back at a case from June, when the Federal Court ordered HSBC Bank Australia to pay a $35 million penalty over failures to protect customers from scams. One number in that judgment matters more than the penalty to anyone who has reported a scam. HSBC took 144 days on average to investigate a customer's report. The code it had signed up to allows 45.

That code is the ePayments Code, administered by ASIC. Banks opt into it and are bound once they do, and it sets out what your bank has to do, and by when, once you tell it money left your account without your say-so.

The clock the Code sets

Clause 18.1 gives your bank 21 days from receiving your report to either finish the investigation and tell you the outcome in writing, or tell you in writing that it needs more time. Clause 18.2 sets the outer limit: unless there are exceptional circumstances, the investigation must be complete within 45 days. Clause 18.4 requires the outcome and the reasons for it, with references to the clauses relied on. These are the obligations HSBC admitted breaching, and Justice Bennett held those failures were widespread and systemic.

Which kind of scam you had changes the rule

The clock only runs on what the Code calls an unauthorised transaction, and the definition is narrow. It means a transaction "not authorised by a user", and expressly excludes "any transaction that is performed by a user themselves or by anyone who performs a transaction with the knowledge and consent of a user".

That exclusion does a lot of work. If someone got into your account and moved your money, the 21 and 45 day deadlines are yours to point at. If a caller convinced you your account was compromised and you moved the money yourself, you authorised that payment, and the Code's timeframes are not what you are relying on. Same crime, same loss, different route back to the money. A third case sits apart: the right amount sent to the wrong account is a mistaken internet payment, and the sending bank is expected to start its own process within two business days.

Business accounts sit outside it

Clause 2.1 excludes transactions performed using "a facility that is designed primarily for use by a business, and established primarily for business purposes". A business transaction account is not covered, so neither deadline is one you can hold your bank to there. Clause 2.3 does let a bank apply the Code more widely, and some do. The only way to know where you stand is to ask, and the time to ask is before anything goes wrong.

A wider net is coming. The ACCC says the Scams Prevention Framework arrives in stages: banks, telecommunications providers and digital platforms providing a regulated service must be members of the Australian Financial Complaints Authority from 1 September 2026, and from 31 March 2027 AFCA will handle eligible scam complaints a business has not resolved internally.

What to do

Start the clock on a date nobody can argue about later. Ring the bank, then put the same report in writing the same day and keep the timestamp. Every deadline that follows runs from when the bank received your report, and a phone log is a weaker record than an email you still hold.

Then work out which of the three cases you are in, because it decides what you can hold the bank to. On day 21, if you have neither an outcome in writing nor a written notice that more time is needed, say so in writing. On day 45, unless the bank has explained why the circumstances are exceptional, the investigation should be finished. If it decides you are liable, ask for the reasons and clause references that clause 18.4 requires, because that is the document a complaint gets built on.

Business owners have a job that runs before the event, not after it. Ask your bank in writing whether it applies the Code to your business accounts, and file the answer. Then put the effort where the Code cannot reach: dual approval on any new payee, and a rule that a change to a supplier's bank details gets verified on a phone number you already had, never one supplied in the message asking for the change.

This article is general information only and is not financial advice.