Bank customers’ data constitutes ‘property’, misuse may be criminal, rules LHC

• LHC rejects bank employee’s bail plea in cyber fraud case.
• Court says unlawful use of costumers’ data grave offence.
• Prosecution alleges case involved organised cyber fraud.

LAHORE: The Lahore High Court (LHC) has ruled bank customers’ confidential data to be “property” in the eyes of the law, saying that employees who misuse their official authority to access such information may be liable for criminal breach of trust.

The ruling came in a cyber banking fraud case involving the alleged illegal use of confidential customer data, issuance of fake SIM cards and fraudulent transfers worth more than Rs104 million from bank accounts, according to The News.

LHC’s Justice Tariq Saleem Sheikh issued a 19-page written judgment on Friday while deciding post-arrest bail petitions filed by the accused.

The court rejected the bail plea of bank employee Muhammad Atif, while granting post-arrest bail to SIM franchise owner Muhammad Usman against surety bonds of Rs1 million.

The judgment observed that in modern banking, access to customers’ confidential data is effectively equivalent to access to their financial interests.

It held that the unlawful use of such data constitutes a grave offence.

The court further ruled that in cyber banking fraud cases, the role of each accused must be assessed independently on the basis of available evidence.

It noted that there was sufficient prima facie evidence suggesting that Atif had accessed confidential customer information and allegedly played a role in the fraud, warranting the rejection of his bail application.

According to the judgment, the case was registered by the National Cyber Crime Investigation Agency (NCCIA) on a complaint filed by the Pakistan Telecommunication Authority (PTA).

Investigators allege that confidential banking data was leaked and used to obtain fake SIM cards in the names of customers.

Those SIMs were then allegedly used to transfer Rs104 million from the bank accounts of six individuals.

During the hearing, Counsel for Usman, the SIM franchise owner, argued that their client neither issued the alleged fake SIM cards nor was any suspicious device or proceeds of crime recovered from him.

The counsel for the bank employee contended that mere access to bank records was insufficient to establish criminal liability.

The prosecution maintained that the case involved an organised cyber banking fraud in which each accused had played a distinct role.

It alleged that confidential customer data was leaked to facilitate the issuance of fake SIM cards and that Atif exploited his access to sensitive banking information to assist in the fraudulent scheme.

Granting bail to Usman, the court held that further inquiry was required to determine the extent of the direct evidence against him.

He was granted post-arrest bail against surety bonds of Rs1 million, while the investigation and trial will continue in accordance with the law.

The judgment also observed that, in light of the allegations, the accused may be prosecuted not only under the Prevention of Electronic Crimes Act (Peca) but also under the relevant provisions of the Pakistan Penal Code.