Canadian federal police have charged a former Royal Bank of Canada employee with fraud and other offenses after an investigation into alleged unauthorized access to client banking profiles, including that of Prime Minister Mark Carney.
The Royal Canadian Mounted Police said the accused, Ibrahim El-Hakim, 23, of Ottawa, faces counts of fraud over $5,000, unauthorized use of a computer, identity theft, and trafficking in identity information.
Investigators said they opened the case in early July after a complaint from RBC.
Police allege El-Hakim used the bank’s information technology systems to look up multiple client accounts without authorization for criminal purposes.
Because the case involves the prime minister, the file has been assigned to the RCMP’s Integrated National Security Enforcement Team.
The RCMP said there is no indication of a threat to the prime minister’s safety or to national security.
El-Hakim was arrested on July 10 and released on conditions. He appeared in court in Ottawa on Aug. 6, with another appearance scheduled for Oct. 1, according to police and court records cited in Canadian media.
A charging document filed in the Ontario Court of Justice alleges the conduct spanned from November 2023 to mid-June 2025 and that RBC suffered losses totaling $68,500 over that period. None of the allegations have been tested in court.
RBC said the individual is no longer employed at the bank. The company said it identified the suspicious activity and contacted law enforcement.
An RBC spokesperson said in a statement: “We worked closely with law enforcement to support their investigation.” The Prime Minister’s Office declined to comment, citing the ongoing police matter.
Media reports also cite court filings and interviews that describe an illicit scheme in which a social media contact allegedly offered payments for internal lookups and account changes.
Police have not laid charges related to those specific claims beyond the counts announced, and they said further charges remain possible as the investigation continues.
The case has sharpened attention on insider risk in financial services at a time when banks invest heavily in perimeter defenses but continue to face governance challenges inside the firewall.
Canadian institutions operate under strict privacy and security rules and are expected to maintain robust access controls, logging, and monitoring across teller and advisory systems.
When a breach of confidentiality is suspected, industry practice is to isolate credentials, review audit trails, and notify regulators and law enforcement as required.
“RBC, Canada’s largest lender by assets, has spent recent years touting technology upgrades and automation across its branches and digital channels. It has also continued to adjust its business offerings, such as business GIC rates this month.
RBC, Canada’s largest lender by assets, has spent recent years touting technology upgrades and automation across its branches and digital channels.
The alleged misconduct, if proven, would underscore the importance of least-privilege access and real-time anomaly detection for employee activity, especially around profiles of public figures and other sensitive accounts.
It may also prompt questions from institutional investors about the bank’s internal controls and remediation steps, even if the financial impact outlined in the charging document is modest relative to RBC’s scale.
The allegations are a reminder that most account compromises do not come from cinematic external hacks for customers. They often arise from trusted access that is misused.
Banks typically advise clients to review statements, enable alerts, and report any irregularities immediately.
Ottawa’s investigation, now in the national security portfolio because of the target involved, will determine whether additional criminal conduct occurred and whether other parties were involved.
