Ottawa worker also accessed Prime Minister Mark Carney’s banking profile
A former Royal Bank of Canada (RBC) employee’s guilty plea in a fraud scheme that included viewing Prime Minister Mark Carney’s banking profile highlights employers’ responsibility on the matter of data privacy.
When a staff member misuses data privacy access, the organization still answers for the personal information that staff member could reach. Under the Personal Information Protection and Electronic Documents Act (PIPEDA), that accountability covers who gets access, how it is monitored and how quickly a breach is contained.
Ibrahim El-Hakim, a client adviser at an RBC branch in downtown Ottawa, pleaded guilty in August 2026 to fraud over $5,000, unauthorized use of a computer and identity theft, The Canadian Press reported.
His sentencing is set for later this month.
How the insider fraud scheme worked
The case began with a recruiter, not a hacker. An agreed statement of facts filed in an Ontario court says El-Hakim was approached on Telegram by a contact using the alias AI WORLD, someone he believed “to be associated with organized crime.”
Between November 2023 and June 2025, he used stolen identity data supplied by that contact to open at least 43 fraudulent accounts. He was paid $500 per account, at least $5,000 in total. At the time of charges, RBC’s investigation linked $68,500 in credit card fraud to the case, Banking Dive reported in September 2025.
On June 17, 2025, he also opened the profiles of Carney and two others. His explanation was a familiar one. “Mr. El-Hakim stated that he participated in the scheme because he was experiencing financial difficulties,” the statement says.
Why training alone falls short on data privacy
What makes the case instructive is that RBC had done the standard work. “Mr. El-Hakim committed these offences despite having received training in ethics, privacy, security and fraud prevention as part of his employment at RBC,” the statement says. The bank later paid $14,634 to give 27 clients two years of credit monitoring.
RBC caught the activity internally. “We worked closely with law enforcement to support their investigation,” RBC spokesperson Cheryl Brean told CBC News in September 2025.
That detection matters, because regulators have long warned that trust is not a control. In a 2020 investigation of a breach at a financial institution, the Office of the Privacy Commissioner of Canada (OPC) cautioned that a “climate of trust” must be matched by a “culture of vigilance.” François-Philippe Champagne, finance minister at the time, made a similar point after the charges. “It just reminds everyone that privacy and having systems to prevent fraudulent access to anyone’s file is something we should all be concerned about,” he told CBC News.
Courts and regulators are setting a high bar. In April 2026, an Ontario court upheld the firing of a medical secretary for patient privacy breaches despite her privacy training. In Saskatchewan, Information and Privacy Commissioner Grace Hession David found a health authority was too slow to contain a breach after a hospital employee fired after accessing 98 patient records was caught.
