Wednesday, 28 October 2026NewsletterAboutInstagramX
Subscribe

FNB Fined R1 Million After App Exposed Home Loan Data

The Information Regulator says a misconfigured FNB app let 696 customers see 88 people's home loan applications, and that FNB ignored two warnings.

2 min read
An FNB bank branch in a gabled building on a street corner in South Africa, with a minibus taxi passing
File photo: FNB branch, South Africa. Simon Harriyott, CC BY 2.0, via Wikimedia Commons

[ The short version ]

  1. 01The Information Regulator fined FNB R1 million under section 105 of Popia after a misconfigured app setting let 696 customers view 88 other people's home loan applications, TechCentral reports.
  2. 02Customers flagged the problem in March and May 2022. FNB treated each report as isolated and did not tell the regulator, which acted after a complaint in September 2022.
  3. 03FNB must also stop collecting personal data from newspapers unless it finds another legal basis, destroy some old records and rewrite its privacy notice.

South Africa's Information Regulator has fined First National Bank R1 million for mishandling customer data, according to TechCentral, citing SABC News. The fine, announced on 27 October alongside a R500,000 fine against Central Johannesburg TVET College, is for an offence under section 105 of the Protection of Personal Information Act (Popia), which covers bank account numbers. The enforcement notice is signed by the regulator's chair, Pansy Tlakula, and dated 21 October.

696
FNB app users who could view other people's home loan applications88 applicants were exposed and nine had account numbers revealed, according to TechCentral

What went wrong

A misconfigured setting in the FNB app wrongly classed some account holders as FNB employees. That gave them a list of names and ID numbers of people with pending home loan applications. Clicking a name opened the full application: contact details, physical address, income and salary, and in some cases account numbers.

A customer alerted FNB on 30 March 2022 and another on 3 May 2022. Each time FNB removed that person's access, treated it as a one-off and did not report it. The regulator became involved only after a complaint in September 2022. "FNB did not address this vulnerability to the confidentiality of personal information even after two alerts," it said, calling the bank's handling "lackadaisical".

The regulator warned that the data could feed identity theft, SIM-swap fraud and attempts to get around know-your-customer checks, especially when combined with earlier Experian and TransUnion breach data already circulating online.

Related · InnovationEthiopia Leads South Africa on EVs, 60% to Under 0.2%A new 16-country electrification index puts Ethiopia in a higher group than South Africa, after a ban on petrol and diesel car imports pushed EV sales up.

The other orders

  • Stop collecting personal information from newspapers, which FNB uses mainly to screen politically exposed persons, unless it can show another legal ground. The regulator says a newspaper is not a "public record" under Popia.
  • Appoint a records management company to destroy records kept indefinitely without a legal basis, such as cancelled employee tax certificates and securities registers.
  • Amend its privacy notice, which relies on grounds such as "legitimate interest" that the regulator says are not valid exceptions for further processing.

FNB has 90 days to show it has complied and 30 days to appeal. TechCentral said it had asked FNB whether it plans to appeal.

Sources and notes
  • #FNB
  • #InformationRegulator
  • #Popia
  • #dataprotection
  • #SouthAfrica

Written by , EditorView editor profile

Next on the Stak

Picked for readers of this story

Keep reading