HSBC has admitted to failing to protect customers from scams and agreed to a $35 million penalty in the Federal Court.