The Lahore High Court (LHC) has delivered an important ruling concerning the misuse of confidential banking information, observing that customers’ private banking data can be treated as “property” under the law.
The ruling came in a cybercrime case involving allegations of leaked bank information, fraudulent SIM cards and unauthorized transfers of more than Rs104 million from the accounts of six customers.
Bank Employee Faces Criminal Liability
Justice Tariq Saleem Sheikh issued a detailed 19-page written judgment while deciding post-arrest bail petitions filed by the accused persons.
The court refused bail to a bank employee accused of improperly accessing confidential customer information. According to the judgment, employees who are given authorized access to sensitive banking records but subsequently misuse that access may potentially face charges including criminal breach of trust.
The court noted that banking has increasingly become dependent on digital systems, making customer information closely connected with their financial assets and interests. As a result, unauthorized access or misuse of such information can have serious financial consequences.
How the Alleged Fraud Took Place
According to the case record, the investigation began after the Pakistan Telecommunication Authority (PTA) filed a complaint with the National Cyber Crime Investigation Agency (NCCIA).
Investigators allege that confidential banking information was unlawfully obtained and subsequently used to arrange fake SIM cards in the names of bank customers.
Those SIM cards were allegedly exploited to carry out unauthorized transactions involving approximately Rs104 million belonging to six individuals.
The allegations have raised concerns about the risks created when sensitive customer information is accessed by people who have legitimate access to banking systems but allegedly use that information for illegal purposes.
Court Examines Each Accused Separately
While dealing with the bail applications, the LHC emphasized that the role of every accused person must be examined independently rather than treating all suspects in the same manner.
In the case of the bank employee identified as Atif, the court found sufficient prima facie material indicating that he had accessed confidential customer information and may have been involved in the alleged scheme.
On that basis, the court declined to grant him post-arrest bail.
However, the court reached a different conclusion regarding SIM franchise owner Muhammad Usman. He was granted post-arrest bail after furnishing Rs1 million in surety bonds.
PECA and Pakistan Penal Code May Both Apply
Another significant aspect of the judgment is the court’s observation that cyber-enabled financial crimes may attract provisions of both the Prevention of Electronic Crimes Act (PECA) and the Pakistan Penal Code (PPC).
This means that an individual allegedly involved in the misuse of electronic banking information could potentially face multiple forms of criminal liability depending on the evidence and the specific conduct involved.
A Significant Message for the Banking Sector
The ruling sends a strong message about the importance of protecting customers’ confidential information.
Bank employees routinely have access to highly sensitive records, including account details and other information connected to customers’ finances. The judgment highlights that such access comes with significant legal responsibilities.
If confidential information is deliberately accessed or disclosed for an unauthorized purpose, the consequences may extend beyond internal disciplinary action and potentially result in criminal prosecution.
The case also demonstrates how seemingly separate systems — banking records, telecommunications services and digital transactions — can become interconnected in modern financial fraud.
What the Judgment Could Mean Going Forward
The LHC’s observations could become important in future cases involving the theft, disclosure or misuse of banking information.
By recognizing the connection between confidential customer data and financial interests, the court has highlighted the potential seriousness of insider access to sensitive information.
At the same time, the proceedings remain subject to the normal criminal justice process. The denial or grant of bail does not by itself establish whether an accused person is ultimately guilty. That determination will depend on the evidence presented during the trial.
The case nevertheless serves as a warning that confidential banking data is not merely information to be protected by corporate policies its unlawful misuse can carry serious legal consequences.