Your bank knows almost everything about you, but who is allowed to ask for it? writes Dean Dunham KC
Banks should be expected to take as much care with our information as they demand of us
The Revolut data breach should make every consumer sit up and take notice, but perhaps not for the reason you might think.
Listen to this article
Around 680 customers reportedly had highly sensitive information disclosed after criminals posed as law-enforcement officials using a compromised Italian government communications system. The information reportedly included identity documents, addresses, phone numbers and transaction histories. Revolut says its own systems were not breached.
The obvious question is: how could this happen?
But there’s a much bigger question consumers should be asking:
How much information can governments legitimately obtain from our banks in the first place?
The answer may surprise you.
Banks hold an extraordinary picture of our lives. They know where we shop, where we travel, what subscriptions we have and who we pay. They also hold identification and know-your-customer information.
In some circumstances, public authorities can legally require financial institutions to provide information.
HMRC, for example, has Financial Institution Notice powers allowing it to require information reasonably needed to check a known taxpayer’s tax position or collect a tax debt. Crucially, HMRC does not always need the taxpayer’s consent or prior approval from the tax tribunal, although statutory safeguards apply and an authorised officer must approve the notice.
There are also broader data-gathering arrangements. HMRC says financial institutions already report information concerning certain account holders annually under international automatic-exchange arrangements.
And this isn’t just about tax.
This year the Government published rules for Eligibility Verification Notices, which allow the Department for Work and Pensions to require financial institutions to identify accounts matching specified eligibility indicators as part of efforts to tackle fraud and error in the benefits system.
There are legitimate public-interest reasons for these powers. Governments need to investigate crime, enforce tax laws and tackle fraud.
But the Revolut case highlights the other side of that equation.
If banks are accustomed to receiving legitimate requests from governments and law-enforcement bodies, how do they establish that the person making a particular request really has the authority they claim to have?
Authenticating an email or communications system is not necessarily the same thing as authenticating the individual sitting behind it.
According to the latest reporting, the Revolut attackers claim they exchanged messages with the company for months while impersonating law enforcement and repeatedly requested confidential information about particular customers. That makes the safeguards surrounding disclosure hugely important.
Consumers are constantly told to verify who is contacting them before revealing sensitive information. We are warned that caller ID can be spoofed, emails can be compromised and an official-looking message does not necessarily mean the sender is genuine.
Surely we should expect at least the same standard and arguably a considerably higher one, from organisations holding passports, identity documents and detailed financial histories.
This isn’t an argument that governments should never have access to financial information. There are circumstances where such access is lawful and necessary.
It’s an argument for transparency, proportionality and extremely robust authentication.
The Revolut incident therefore shouldn’t simply prompt the question, “How did criminals obtain this information?”
It should prompt a much wider one:
Who is entitled to ask your bank for information about you, exactly what can they obtain – and what checks must your bank carry out before handing it over?
Consumers deserve clear answers.
____________________
Dean Dunham KC presents LBC's Consumer Hour every Sunday from 9pm-10pm.
LBC Opinion provides a platform for diverse opinions on current affairs and matters of public interest.
The views expressed are those of the authors and do not necessarily reflect the official LBC position.
To contact us email opinion@lbc.co.uk