The corporate watchdog is suing multinational banking giant HSBC over a scam that netted $23 million, alleging it failed to protect 950 Australian customers from a long-running "spoofing" scam.