HSBC allowed fraudsters to transfer millions of dollars around the world even after it had learned of their scam, leaked secret files show.