FNB fined R1 million after 696 customers viewed 88 loan applications

First National Bank has been fined R1 million by the Information Regulator after a misconfigured setting in its app allowed 696 customers to view the home-loan applications of 88 other people.

Nine of the 88 affected people had bank account numbers exposed. On 27 October, the regulator announced FNB’s penalty alongside a R500,000 fine against Central Johannesburg TVET College, SABC News reported.

What did the FNB app expose?

The enforcement notice, signed by Information Regulator chair Pansy Tlakula and dated 21 October, cited section 105 of the Protection of Personal Information Act, or Popia, which addresses the mishandling of bank account numbers.

Some account holders had been wrongly classified as FNB employees. That status gave them access to a list of names and identity numbers belonging to people with home-loan applications in progress.

Selecting a name opened the full application. It showed contact details, physical address, income and salary information and, in some cases, an account number.

The breach gave users personal and financial details tied to 88 people, not just a list of applications.

Why did the regulator intervene?

A customer alerted FNB on 30 March 2022 that other customers’ home-loan applications were visible. A second customer reported the same problem on 3 May 2022.

After each report, FNB removed that customer’s access but treated the matter as an isolated incident, not a compromise of personal information. The bank did not report either incident to the regulator.

The Information Regulator became involved only after a complaint was lodged with it in September 2022. Two customers had now identified the flaw, while FNB still had not escalated it.

According to the notice, FNB “did not address this vulnerability to the confidentiality of personal information” after two alerts from parties who knew they should not have had access.

The notice called FNB’s handling lackadaisical and questioned how much longer the information would have remained exposed had the regulator not intervened.

FNB treated two credible alerts as isolated incidents, and that failure became the core of the enforcement action.

What risk did the breach create?

The regulator said the exposed information placed customers at risk of identity theft, SIM-swap fraud and attempts to get around banks’ know-your-customer checks. It said the risk increased because credit-bureau data from earlier Experian and TransUnion breaches was already circulating online and could be combined by criminals with FNB data to build fuller profiles of victims.

The exposed FNB data could therefore enrich information already available from other breaches, making misuse of the customers’ details easier.

What must FNB change?

The order extends beyond the app. The regulator found FNB could not lawfully justify collecting personal information from newspapers under the Popia provision it relied on.

FNB gathers such information mainly to screen politically exposed persons, or PEPs—people in prominent public positions whom banks must vet more closely under anti-money-laundering rules.

The regulator said a newspaper is not a “public record” as defined in Popia. FNB must now document whether another legal ground permits the collection and stop if none does.

FNB’s records retention schedule also allowed some personal information to be kept indefinitely without a stated legal basis, including cancelled employee tax certificates and registers of securities. FNB must appoint a records management company to destroy those records and give the regulator a certificate of destruction.

The regulator further ordered FNB to amend its privacy notice. It found that grounds such as “legitimate interest,” used when FNB shared customer information, were not valid exceptions for further processing under Popia, and that the notice failed to set out all customers’ rights.

FNB must report back with evidence of compliance within 90 days and has 30 days to appeal the enforcement notice.

Hangi Mbedzi, the regulator’s acting senior manager for Popia, told SABC News: “The fines reflected the seriousness of the breaches and the risk they posed to the people affected.” TechCentral has asked FNB for comment, including whether it intends to appeal the enforcement notice.

FNB’s 90-day response must now document lawful collection, destruction of improperly retained records and a fuller privacy notice.