SC: Banks must disclose account holder data in cybercrime cases

A ruling was issued by the Supreme Court stating that banks must disclose account holder information to law enforcement in cybercrime investigations, as the country’s bank secrecy laws do not shield the identity of suspected scammers.

In a decision by Associate Justice Ramon Paul L. Hernando dated 29 July 2025, the SC’s First Division rejected a petition by EastWest Rural Bank, which argued that bank records are inviolable and immune from disclosure orders under the Law on Secrecy of Bank Deposits.

The high bench held that the Cybercrime Prevention Act of 2012 allows law enforcement to compel the disclosure of computer data, including the identity of account holders, provided they obtain a court-issued warrant.

It stated in the ruling, “The Bank Secrecy Law protects the confidentiality of bank deposits and their financial details,” but noted it does not prevent the disclosure of identifying data necessary for investigating cyber offenses.

In its argument, EastWest said it should not be subject to the Cybercrime Law’s disclosure rules because it is a bank, not a telecommunications or internet service provider.

However, the SC rejected the argument, ruling that banks are indeed service providers under the law because they operate online banking platforms and mobile applications, use computer systems to facilitate communication and transactions, and process and store massive amounts of digital data on behalf of users.

The case stemmed from a “vishing” (voice phishing) incident involving victim Leonard Vendiola.

A fraudster posing as a bank employee tricked Vendiola into revealing his email and one-time password (OTP), which led to an unauthorized transfer of P10,000 to an EastWest account.

When the Philippine National Police Anti-Cybercrime Group (PNP-ACG) obtained a Warrant to Disclose Computer Data to identify the recipient, EastWest challenged the order by citing the Bank Secrecy Law.