On 1 April 2024 an employee of Mizrahi Tefahot Leasing was looking for a way to reach a customer who was abroad.
She did not find the customer. In the systems of Mizrahi Tefahot Bank she found the phone number of a woman, called her from her own mobile phone, and wrote down in the customer's file what she heard.
"Call from my mobile", she wrote. "The customer is not available, in Mizrahi I found a contact person who was apparently his partner many years ago". And at the end of the note: "not in touch with him and asked to delete her phone".
Between those two sentences the employee wrote down the woman's full phone number.
The woman asked for her number to be deleted. It was not deleted. In June 2024 Mizrahi Tefahot Leasing, through the law firm Chen Fisher Gabbay, filed an application to enforce a pledge on the customer's car. Attached to it was an affidavit by the company's employee Yaniv Perlov, and attached to the affidavit, as Annex 5, was the company's call log. The note of 1 April, number included, is there.
The enforcement application and its annexes have to be served on the debtor. Process server Salameh Naamneh reported on 21 April 2025 that he met the addressee and that the addressee refused to sign. Four months earlier, on 22 December 2024, the same process server reported in another case against the same customer that he handed him the documents and that he refused to sign. On that day the customer was not in Israel. The proceedings opened on the basis of that service were cancelled by a decision of 21 October 2025.
The account holder says he never received the documents. Where they are today, nobody knows.
And there is a third case. On 10 February 2026 Mizrahi Tefahot Bank itself, through attorney Keli Vahadat, filed an application to enforce a liquidated claim against the same customer. The application form states: "the contract is attached as Annex A". Process server Menashe Cohen reported that he handed the warning to the customer in person on 23 April 2026 and that the customer refused to sign. The customer says he never met any process server. When he called the number listed in the server's affidavit, the man who answered denied that his name was Menashe Cohen and denied that he serves legal documents.
To this day the bank has not presented any confidentiality agreement with the process servers, nor said who else received the information.
In brief
- The phone number of a woman who is not a party to the contract was found in Mizrahi Tefahot Bank's systems and used by the leasing company to trace a customer.
- The woman asked for the number to be deleted. It was filed in the enforcement case as an annex to an affidavit.
- The loan and account documents were handed to two process servers. Both times "refused to sign" was reported, and the documents never reached the account holder.
- The company's representative testified that he did not know of the financial investigation. Three weeks later the bank and the company wrote that it was "information exchanged between the company and its lawyers".
What the bank's representative testified
On 13 January 2026 Yaniv Perlov was cross-examined at the Haifa enforcement office in the pledge case. He testified that he is an employee of Mizrahi Tefahot Bank, that the leasing company is a subsidiary of the bank, and that the company's offices in Lod are the bank's head offices.
Asked about the note of 1 April 2024, he answered: "If customer service recorded it, then yes. I did not call. It was customer service."
Asked whether in January 2024 the company had received a private investigation on the customer with all his details and phone numbers, he answered: "It is unlikely that we received it". And to the next question: "I don't know it".
On 4 February 2026, three weeks after the hearing, Mizrahi Tefahot Bank and Mizrahi Tefahot Leasing answered the customer's access request. They refused to provide the "financial investigation" and the "background check report" on one ground: "this is information exchanged between the company and its lawyers". It follows from this answer that the investigation exists, and that it passed from the company to its lawyers.
Emails between clerks
In the same answer the company attached its call and correspondence log on the customer. The log shows how information moved inside the group. On 26 March 2024 it records: "I sent an email to the account representative ... at branch 472 to check the status of the account". The same day it records: "Limor replied that the account was transferred to legal handling, therefore the file is also transferred to legal handling".
The status of a customer's account travelled by email from a bank branch to the leasing company, and the bank's decision to send the account to legal handling led to the whole file being sent to the lawyers.
What the bank promises in its privacy policy
The privacy policy published on Mizrahi Tefahot Bank's website says: "as a rule, we will keep the information about you confidential". The bank writes that it "takes many measures to protect your privacy and secure the information", and that service providers may hold and use the information "all subject to the bank's instructions". The policy recognises the customer's right to see the information held about them and to ask for it to be corrected or deleted, through the bank's privacy officer, privacy@umtb.co.il.
Against that promise stand the documents. A contact person's phone number, the call log and the account documents reached a law firm, an enforcement file and process servers, with no prior notice to the customer. On 4 February 2026 the bank refused to hand over the financial investigation, the background check report and the correspondence with the lawyers. On 11 August 2026 the customer sent the bank's privacy officer a request to access, correct and delete personal data. According to him, no answer has been received to this day.
Bank secrecy: what the law says
Israel has no single statute called "bank secrecy". The duty was created by the courts. The Supreme Court held that a bank owes its customer a duty of confidentiality arising from the nature of the contract and of the relationship between them (Civil Leave to Appeal 1917/92 Skolar v Jerby, PD 47(5) 764). In doing so Israeli case law adopted the framework set in England a century ago.
Tournier v National Provincial and Union Bank of England, [1924] 1 KB 461: a bank told a customer's employer that one of the customer's cheques had been paid to a bookmaker. The employer did not renew his contract. The Court of Appeal held that confidentiality is an implied term of the contract between bank and customer, and that breaching it gives rise to damages. It recognised four exceptions only: disclosure compelled by law, a duty to the public, the interest of the bank, and the customer's consent.
The bank's interest exception is what allows a bank to sue a customer and put before the court what it needs to prove a debt. It does not turn everything a bank holds about a person into open material. The phone number of a woman who is not a party to the contract, and a description of a personal relationship that ended years ago, are not part of the debt.
The Israeli Privacy Protection Law lists among invasions of privacy "a breach of a duty of confidentiality laid down by law in respect of a person's private affairs" (section 2(7)), "a breach of a duty of confidentiality in respect of a person's private affairs laid down in an express or implied agreement" (section 2(8)), and "the use of information about a person's private affairs, or its transfer to another, for a purpose other than the one for which it was given" (section 2(9)).
A phone number kept in a bank's systems and later used to trace a debtor, in an affidavit in an enforcement case and in handing papers to third parties is exactly the situation section 2(9) describes. Here the woman herself asked for it to be deleted.
Informed consent: what the Privacy Protection Authority says
On 25 February 2026 the Israeli Privacy Protection Authority published its final opinion on consent. Under the opinion, consent is valid only if it is informed: the person must receive information that lets them understand what they are agreeing to, including their right to refuse and the consequences of the decision. Consent given for one purpose does not by itself permit use for another, and a new use generally requires new consent. Vague wording such as "among other things" and "etc." is not enough.
In the case of the contact person there is no need to argue about the quality of her consent. She consented to nothing. She asked for deletion.
Who received the information, and what the bank should have required of them
When a bank hands an activity to an outside party, responsibility for the information does not go with it. Proper Conduct of Banking Business Directive 359A of the Supervisor of Banks, which deals with outsourcing, requires the bank to check that the service provider can maintain information security and privacy. Under the directive the agreement should define which information the provider may access, and prohibit the provider and those acting on its behalf from using or disclosing the information of the bank's customers.
In both cases the information passed from the bank to a law firm, and from there to process servers. Salameh Naamneh signs his service reports as "Naamneh Salameh Legal Service". The customer was unable to verify the identity of the person who signs as Menashe Cohen. No agreement, instruction or undertaking of confidentiality between the bank and either of them has been presented.
When documents vanish: a European judgment for comparison
Read also: Unlawful invasion of privacy: a "full service" that never was · Mizrahi Tefahot Leasing car loan? · Sewer Service ISRAEL: the American method that reached the Execution Office
On 25 January 2024 the Court of Justice of the European Union decided an almost opposite case (C‑687/21, MediaMarktSaturn). A shop mistakenly handed another customer a sales contract and a credit agreement containing a buyer's details. Staff recovered the documents within half an hour, and the other customer had not read them. The court held that where the fear of misuse is clearly unfounded, the fear alone does not justify compensation. A month earlier (C‑340/21, 14 December 2023) the same court held that a well-founded fear of misuse of personal data can amount to non-material damage.
Here the documents did not come back after half an hour. They did not come back at all, and nobody can say whose hands they are in. EU law does not apply in Israel, and the comparison is for illustration only.
Questions for Mizrahi Tefahot Bank
- From which of the bank's systems was the contact person's phone number taken, and who allowed the leasing company to access it?
- Why was the number not deleted after the woman asked, and why was it filed in the enforcement case?
- What confidentiality agreement exists between the bank and process servers Salameh Naamneh and Menashe Cohen?
- Where are the loan and account documents that were handed to them today?
- Who else received the financial investigation and the background check report?
- Why has the request of 11 August 2026 to access, correct and delete personal data gone unanswered?
This article is based on documents filed in the proceedings and on the bank's answer to an access request of 4 February 2026. The contact person's name and phone number are not published. The bank's response will be published if received.
Frequently asked questions about bank secrecy
What is the bank's duty of confidentiality?
A bank must keep information about its customer and the customer's account secret. In Israel the duty arises from the contract between bank and customer and from case law. The Supreme Court recognised it in Civil Leave to Appeal 1917/92 Skolar v Jerby.
When may a bank disclose information about a customer?
Under the case law, in four situations only: where disclosure is required by law, where there is a duty to the public, where disclosure is needed to protect the bank's own interest, for example when it sues the customer, and where the customer has consented.
May a bank give a contact person's phone number to a lawyer or a process server?
The Israeli Privacy Protection Law treats as an invasion of privacy the use of information about a person's private affairs, or its transfer to another, for a purpose other than the one for which it was given. According to the Privacy Protection Authority's February 2026 opinion, consent given for one purpose does not by itself permit use for another.
What can I do if my bank passed on my personal data without consent?
Submit an access request to the bank under section 13 of the Privacy Protection Law and ask who received the data. You can also turn to the bank's privacy officer, to the Privacy Protection Authority and to the Banking Supervision Department of the Bank of Israel.
Is Mizrahi Tefahot Leasing part of Mizrahi Tefahot Bank?
Yaniv Perlov, an employee of the company, testified on 13 January 2026 that Mizrahi Tefahot Leasing is a subsidiary of Mizrahi Tefahot Bank and that he is an employee of the bank.