Canadian High Interest Savings Bank Accounts

I'm trying to catch a crook who accessed my Mom's HSBC chequing account via the Internet. Does anybody know if it is possible to decode HSBC's transaction codes for online banking transactions? They have this format: "HIB- 12345×56789″. I found a FAQ that said these codes were "time-sensitive". But, I don't know if that means there's a date or time-of-day code embedded in them.

I notice that a set of 9 online transactions throughout a certain month all had the same 5 digits before the "x" in the code above while the last 5 digits were all close to each other — varying in only the final 2 digits even though the transactions were several days apart.

The first 5 digits vary from month to month and sometimes within a month (though not usually) which seems to suggest that they may be a random (?) number specific to a customer for a certain time period (several days). The final 5 digits also seem to be a series of transactions for that customer although they do not increase sequentially or monotonically.

Anybody out there with some deep insight into HSBC's codes that can help? Bank staff give me the brush-off. There's large amounts of money at stake and the possibility of somebody going to jail. Please help me catch a crook who abused my mother.

This is a case where family members are suspected of 'assisting' my elderly mother by managing her assets. Unfortunately, it appears they have helped themselves to much of her net worth. I'm looking at many, many things but the point of the posted question is to determine if the HIB codes embed the time of day of the transaction. With that info, I may be able to prove fraudulent access to her HSBC account — just one 'brick in the wall'.