Bank Insider Who Opened Accounts in Customers' Names

The customer never gave out a password or clicked a link. The misuse came from a person with legitimate access to the bank's records.

By Siddharth ShankarUpdated October 11, 2026

An insider with a legitimate login can be harder to catch than a stranger breaking in. This Australian case shows what the misuse of staff access can look like from the customer's side: accounts and cards in your name that you never asked for.

What happened

According to the AFP, while the man worked at a bank, he accessed customers' accounts and personal details without authorization. He used identification information to open falsely registered accounts and to obtain multiple debit cards. He obtained more than $53,000 in criminal proceeds from a financial organization.

The AFP dates the report of the matter to June 2022. Police searched his home on August 10, 2022. He pleaded guilty in September 2023 to four offenses under the Criminal Code Act 1995 and the Crimes Act 1900 (NSW), and was sentenced on August 27, 2024.

How it worked

Staff access to customer records is necessary for the job but also open to abuse. The release says he used customers' identification information to register accounts that looked legitimate and then got debit cards for them.

During the search, police seized six phones, four laptops, roughly 50 to 60 debit cards in his name, six in victims' names and many SIM cards.

What was exposed

Staff-level access to customer records was used to open fraudulent accounts. The identification information of customers, which the bank held for ordinary purposes, became the material for the false accounts.

How it ended

The man was sentenced to an intensive correction order of 2 years and 8 months plus 500 hours of community service. The release does not describe repayment to the bank or customers.

A timeline of the case

The AFP dates the report of the matter to June 2022. Police searched the man's home on August 10, 2022. He pleaded guilty in September 2023, and sentencing took place on August 27, 2024, two years after the search.

That means customers whose identities were used lived with the possibility of misuse for years. The release gives no description of how they were told, so we do not claim they were notified.

Key facts at a glance

• Sentence: intensive correction order of 2 years and 8 months, plus 500 hours of community service
• Sentencing date: August 27, 2024
• Proceeds: more than $53,000
• Bank report: June 2022; search August 10, 2022
• Items seized: six phones, four laptops, many debit cards and SIM cards
• Plea: guilty to four offenses in September 2023

Why this case matters

Customers cannot see who inside a bank views their records. The protection is partly legal and partly technical: access logs, audits and alerts. In this case, the AFP dates the report of the problem to June 2022.

For you, the lesson is to look for the effects of misuse in places you control: your credit file, your accounts and your mail.

What you can do

What the seized items suggest

The AFP's list of seized items, six phones, four laptops, a large number of debit cards and many SIM cards, suggests a continuing operation that could be run from several devices. We offer that as an observation, not a finding: the release does not say what each item was used for.

The quantity of cards in the man's own name also shows how accounts can be multiplied. For an ordinary customer, the only reliable way to notice such activity is to check the one place that lists everything attached to your identity, which is your credit report.

What the release does not say

The release does not say how many customers were affected or how the access was detected. For a Canadian bank insider case, see the Charlottetown teller fraud.

Your own exposure is the part you can still change. These guides cover how to prevent identity theft, what to do if your identity is stolen and when to freeze your credit. You can also try our free digital footprint check.