"HA! she was with nationwide last year but they ate the card (because she got the pin wrong 3 yes 3 times) so she swapped"
Industry standard is 3 strikes. Though not every bank would eat the card, lots would just cancel the pin and issue a new one but the result's the same.
HSBC are, unfortunately, s**t in many ways. Chiefest of these ways is the way that almost every call to them gets funnelled through their enormous offshore callcentres, even with the best training in the world no one person could know the answer to all the questions they're supposed to field… Not that they have the best training in the world either. So she should get a refund as long as she's not done anything recklessly stupid (or more importantly, doesn't admit to it) but she might have a hassle, not because they're not trying to help, just through incompetence.
Whenever we deal with HSBC, the approach is basically if the first person that answers doesn't sound like they know what they're doing, just instantly hang up and call back and get someone else, it's quicker to speak to half a dozen front-line callcentre people til you get a good one than it is to have the first half-trained one try and help. Though for sport we do sometimes see how many times we can get transferred, I had them up to 11 different departments once before the 11th helpfully transferred me back to the same massive call centre