I have tried to trace the source but I'm not skilled enough
Its not that difficult, but it does take a bit of practice to do it in a reasonable timeframe.
how can one hit back?
Hitting back per-se is not a wise idea.... you'll probably find yourself on the receiving end of more spam or a DoS attack.
However, what you can/should do is copy/paste the raw source text of the email into Spamcop. The spamcop system will automagically parse the email and send report emails to the right places.
If you want to go one step further, you can track down an email address for the security department at HSBC and send a copy to them. Not all organisations make such details readily available publicly, but those with half a brain do (e.g. Apple, Microsoft, Paypal etc.) because they know its not in their interests to allow scams to operate in the name of their company.
The police also operate an ActionFraud service you can report it to.... you used to be able to forward the email, but now its a simple online form. Despite the name, they are also interested in scams, phishing and malware ... not just fraud.