The Mizrahi Tefahot FileIndependent investigation
Privacy protection

Unlawful invasion of privacy: a "full service" that never was

Mizrahi Tefahot Bank knew the customer was abroad. Even so, the Execution Office was told that the summons had been served on him personally. That report opened the door to information orders, attachments and an exit ban.

Published: 6 October 2026Reading time: 6 minutes
Read the article ↓

In an Execution Office file there are two words that change everything: "full service".

As long as the summons has not been served on the debtor, the creditor can only wait. From the moment "full service" is recorded and the deadline has passed, the harshest collection tools the state has are unlocked: orders that require authorities to hand over information about the person, attachments wherever he has money, restrictions, and an exit ban.

In the file of the vehicle owner against Mizrahi Tefahot Leasing, the "full service" was recorded on 22 December 2024. The Execution Office registrar later ruled that on that day the vehicle owner was not in Israel at all.

And the bank knew it.

In brief

What the bank knew, and when

On 7 November 2023, a month after the war broke out, the vehicle owner left Israel. He did not return until 12 July 2025.

December 2023. According to the vehicle owner, as early as December 2023 an "economic investigation" was carried out on him, and it noted that he was staying outside Israel. When he asked to access the information the bank holds about him, Mizrahi Tefahot Bank and Mizrahi Tefahot Leasing refused to give him the "economic investigation" and the "background check report", on a single ground: "This is information exchanged between the company and its attorneys".

17 April 2024. As if that were not enough, the vehicle owner wrote to the bank by email: "I am not in the country and I have no intention of coming back in the near future. I want to pay off the loan and sell the car myself."

2 May 2024. He wrote on WhatsApp to the representative of the bank's law firm, Chen Fisher Gabbay, that he had sent a copy of his passport "so that there will be no unknown services in the file", and informed her that he no longer lived at his previous address.

10 December 2024. The law firm contacted him again on WhatsApp. He replied: "Hi. I'm abroad since November 2023. What is the matter at your office?"

In other words, the bank and its collection department, through the law firm, knew in writing where the customer was.

Document 1: The WhatsApp message from the Chen Fisher Gabbay office, 10 December 2024. The vehicle owner's reply:
Document 1: The WhatsApp message from the Chen Fisher Gabbay office, 10 December 2024. The vehicle owner's reply: "Hi. I'm abroad since November 2023." The red frame was added for emphasis. The vehicle owner's identifying details have been redacted.

12 days later: "full service"

15 December 2024. Five days after the WhatsApp message, a promissory notes file for NIS 178,075.22 was opened against the vehicle owner.

22 December 2024. It was reported to the file that a process server had gone to his previous address and "met the debtor", and that the vehicle owner "received the documents and refused to sign". On 20 January 2025 the Execution Office system was updated manually: the summons, "refused to sign", service on 22.12.2024. From that moment the file has been in "full service" status.

What the "service" opened up

DateWhat the creditor requestedWhat was granted
29.01.202533 attachments with third partiesApproved
06.02.2025Enforcement of an attachment at the National Insurance InstituteApproved on 09.02.2025
12.02.2025Information order from the Population RegistryApproved on 18.02.2025: "The information will be handed over to the creditor"
12.02.2025Information order from the Land RegistryApproved on 18.02.2025: "The information will be handed over to the creditor"
06.07.2025Vehicle attachment and restrictionsFive restrictions, among them an exit ban and a restriction on a charge card

All of this was done while the vehicle owner was abroad, and while the bank knew it.

Document 2: Decision of the Execution Office registrar, 18 February 2025, on the application of Mizrahi Tefahot Leasing: the Population Registry is to hand over the information it holds about the vehicle owner,
Document 2: Decision of the Execution Office registrar, 18 February 2025, on the application of Mizrahi Tefahot Leasing: the Population Registry is to hand over the information it holds about the vehicle owner, "The information will be handed over to the creditor". The vehicle owner's identifying details have been redacted.

On 12 July 2025 he returned to Israel, and found that he was barred from leaving the country and that his accounts were attached.

The registrar: he was abroad

On 21 October 2025 the Execution Office registrar ruled:

"As of the date of service of the summons reported by the creditor (22.12.2024), the debtor was outside the borders of State Israel"

The registrar ordered "the cancellation of all the proceedings carried out in the file", and cancelled the five restrictions.

Document 3: Decision of the Execution Office registrar, 21 October 2025: on the date of service of the summons (22.12.2024)
Document 3: Decision of the Execution Office registrar, 21 October 2025: on the date of service of the summons (22.12.2024) "the debtor was outside the borders of State Israel"; cancellation of all the proceedings and of the legal fee. The red frame was added by the vehicle owner. The vehicle owner's identifying details have been redacted.

But the information had already been handed over. What the Population Registry and the Land Registry passed on to the creditor cannot be taken back. And the header of the file in the Execution Office system, as of October 2026, still reads: "full service as of 22.12.2024". In June 2026, after the proceedings were renewed, two more orders to hand over information about him were issued.

Consent, or legal authorization

The Privacy Protection Law opens with a single sentence: "No person shall infringe the privacy of another without his consent".

The Privacy Protection Authority clarified in a position paper from February 2026 that the collection and use of personal information "may be carried out by virtue of legal authorization or with the consent of the data subject", and that an infringement of privacy "in the absence of legal authorization or consent constitutes a breach of the provisions of the law". The paper further states that the collection and use of personal information that are not accompanied by valid consent or by legal authorization "constitute a civil wrong and may constitute a criminal offence".

Consent. The agreement on which the loan rests was signed in 2021 with Igud Leasing, and according to the vehicle owner it contains no provision governing the collection and processing of personal information about him for collection purposes, or its transfer to third parties.

Legal authorization. The Execution Law empowers the registrar to issue information orders, restrictions and an exit ban only after the summons has been served on the debtor and the deadline set in it has passed. That authorization rests entirely on one thing: the service. Here, the registrar himself ruled that on the date of service the vehicle owner was outside Israel.

When the service did not take place, the basis for the authorization fell away. And when there is no consent and no authorization, all that remains is personal information that was collected about a person, passed on to the creditor, and used against him.

When he asked to know what they know about him

In January 2026 the vehicle owner contacted the bank, the leasing company and the law firm, and asked to access the information they hold about him, as the Privacy Protection Law permits.

The law firm replied that it acts as the agent of the creditor, and that "all the information transferred to our office is protected by attorney-client privilege, which is sufficient not only to exempt our office but also to prevent it from disclosing the information and its source".

The bank and the leasing company gave him ledger statements and an inquiry log, but not the economic investigation and not the background check report. In response to a further request, the bank replied that the law "does not grant you a right to demand information retroactively ... or to conduct a 'fishing expedition'".

Document 4: The reply of Mizrahi Tefahot Bank and Mizrahi Tefahot Leasing to the access request, 4 February 2026:
Document 4: The reply of Mizrahi Tefahot Bank and Mizrahi Tefahot Leasing to the access request, 4 February 2026: "economic investigation" and "background check report", "Your request is denied. This is information exchanged between the company and its attorneys". The vehicle owner's identifying details have been redacted.

The question

May a bank, through its collection company and its law firm, create for itself a right to infringe its customer's privacy, request information about him from state authorities, attach his money and bar him from leaving the country, when it knows that the customer is not in Israel at all, and when no such right ever arose for it, neither by consent nor by law?

About this article: The article is based on the documents of the Execution Office file (registrar decisions, the creditor's applications, Execution Office system data as viewed in October 2026), the Population Authority certificate, the vehicle owner's correspondence with the bank and with the law firm, the bank's replies to the access requests, and the position paper of the Privacy Protection Authority of 25 February 2026. What is attributed to the vehicle owner is his account. Quotations are given verbatim, including the term "the debtor" in the original documents. File numbers and the vehicle owner's identifying details have been redacted in the documents shown. The article was written with the assistance of artificial intelligence on the basis of the documents, and was reviewed and approved by the vehicle owner. This English version is an AI-assisted translation of the original Hebrew article; the quotations were translated from Hebrew. The Hebrew version is the controlling text.