The Information Regulator has fined First National Bank R1-million after finding that a misconfigured setting in the FNB app let 696 customers view the home loan applications of 88 other people – and that the bank failed to fix the flaw after customers twice reported it.
The fine relates to an offence under section 105 of the Protection of Personal Information Act (Popia), which deals with the mishandling of bank account numbers. Nine of the 88 people had their account numbers exposed. The regulator announced the fine on 27 October, SABC News reported, alongside a R500 000 fine against Central Johannesburg TVET College.
According to the enforcement notice, signed by regulator chair Pansy Tlakula and dated 21 October, some account holders had been incorrectly classified as FNB employees. That gave them access in the banking app to a list of names and ID numbers of people with home loan applications in progress. Clicking on a name opened the full application, including contact details, physical address, income and salary information and, in some cases, account numbers.
A customer alerted FNB on 30 March 2022 that they could see other customers’ loan applications. A second customer reported the same problem on 3 May 2022. In each case, the regulator found, FNB removed the individual’s access but treated the report as an isolated incident rather than a compromise of personal information, and did not report it to the regulator. The regulator only became involved after a complaint was lodged with it in September 2022.
“FNB did not address this vulnerability to the confidentiality of personal information even after two alerts by two parties who were mindful of the fact that they should not have been able to have access to such personal information,” the regulator said in the notice.
It described FNB’s handling of the incidents as “lackadaisical” and questioned how much longer the information would have remained exposed had it not intervened.
Beyond the breach
The regulator said the exposed information put the affected customers at risk of identity theft, Sim-swap fraud and attempts to get around banks’ know-your-customer checks. It said that risk was made worse by credit bureau data from earlier breaches at Experian and TransUnion already circulating online, which criminals could combine with the FNB data to build fuller profiles of victims.
The notice goes beyond the app breach. The regulator also found that FNB could not lawfully justify collecting personal information from newspapers under the section of Popia it relied on. The bank gathers such information mainly to screen politically exposed persons – people in prominent public positions whom banks must vet more closely under anti-money-laundering rules. The regulator said a newspaper is not a “public record” as defined in the act. FNB must now document whether another legal ground permits the collection, and stop if none does.
FNB’s records retention schedule also allowed some personal information, including cancelled employee tax certificates and registers of securities, to be kept indefinitely without a stated legal basis. The bank must appoint a records management company to destroy such records and give the regulator a certificate of destruction.
The regulator further ordered FNB to amend its privacy notice, finding that it relies on grounds such as “legitimate interest” to share customers’ information that are not valid exceptions for further processing under Popia, and that it fails to set out all of customers’ rights under the act.
FNB must report back to the regulator with evidence of its compliance within 90 days and has 30 days to appeal against the enforcement notice.
Hangi Mbedzi, the regulator’s acting senior manager for Popia, told SABC News the fines reflected the seriousness of the breaches and the risk they posed to the people affected.
TechCentral has reached out to FNB for comment, including on whether the bank intends to appeal the enforcement notice. — (c) 2026 NewsCentral Media
