think i've fixed it
mainly because the site is heavily modded
adding:
tep_redirect(tep_href_link(FILENAME_CHECKOUT_PROCESS, 'order_id='.$insert_id, 'SSL'));
to hsbc_return file and having
tep_redirect(tep_href_link(FILENAME_CHECKOUT_SUCCESS, 'order_id='.$insert_id, 'SSL'));
at the end of checkout_process file seems to have cured it