For 20 months, a Colombian bank has been emailing me a stranger's finances. Every card transaction, her monthly credit statements, the paperwork for a loan she signed. I live in rural Suffolk. I have never banked in Colombia.

I tried every channel I could find to report it. In all that time, exactly one human being replied. They wanted my passport number.

What landed in my inbox

The bank is Banco Davivienda, one of Colombia's largest. At some point before February 2025, one of its customers registered my Gmail address as her own. I'll call her the customer. She has had enough of her privacy given away already.

Since then, the bank has sent me:

  • an alert for every transaction she makes
  • her credit statements, with the full statement attached as a PDF
  • marketing addressed to her by first name, quoting the last four digits of her Visa card
  • a notification that she had electronically signed a promissory note for a loan
  • pre-approved credit offers, cash advance offers and reminders to switch on her card's security features

A sister company in the same banking group now emails her at my address too. The bad address has spread beyond the bank itself. In under four weeks this month, 15 of these emails arrived.

None of it stays with me. I set up a Gmail filter that bins anything from the bank the moment it lands, because this is data I have no right to hold. The only exceptions were a handful kept briefly as evidence while my complaint was open, deleted when it closed.

Every door I knocked on

I don't speak Spanish. It turned out not to matter, because nothing I sent reached a person.

  • February 2025. I replied three times to the transaction alerts. The sending address doesn't accept replies. Nothing.
  • 2025 to 2026. The chatbot on the bank's website. A bot can't change a customer record. It didn't.
  • Repeatedly. The unsubscribe link in the marketing emails, clicked more times than I can count. The marketing kept coming.
  • April 2026. I replied to the marketing address. It bounced.
  • 12 October 2026. A formal petition under Colombian data protection law, sent to the bank's official contact address. No acknowledgement, no reply. A fresh credit statement ten days later.
  • 24 October 2026. A complaint to the bank's Financial Consumer Ombudsman. A reply in two working days. Read on.

The irony of the first one: the bank's own statement emails say the sender can't receive replies, and point you to a contact address instead. That address never answered either.

The punchline

The ombudsman is the independent office meant to protect the bank's consumers. My complaint named the customer, the last four digits of her card, the reference number of her loan note, and the exact email address to remove. Everything the bank needed to find the record and fix it in five minutes.

The reply asked for two things before they would open a case: my full name and my identification number. Since I'm not Colombian, that means my passport.

Sit with that for a second. The bank never verified the address it has been sending a customer's financial records to for 20 months. But the person reporting the leak must prove who he is with a government document, by email, to an office on another continent.

I declined, told them what I thought of the arrangement, and closed my side of it.

What went wrong, as a security problem

Strip out the bureaucracy and this is a textbook data breach, still running, with seven separate failures stacked on top of each other.

An unverified address. The bank accepted an email address without confirming it. One confirmation link at sign-up would have caught the typo, or whatever it was. Instead a customer's financial life has gone to a stranger since at least February 2025.

Documents where a notification would do. Attaching full statements as PDFs means whoever holds the inbox reads the statement. "Your statement is ready, log in to view it" would have leaked nothing except that a statement exists.

The inbox is often the key to the account. If that same address handles password resets or one-time codes, its holder may be able to take the account over. I don't know whether it does, and I'm not going to find out.

A ready-made phishing kit. Her name, her card digits, her loan, her spending pattern, and dozens of genuine bank emails to copy the look of. A less scrupulous recipient could phone her as "the bank" and be believed.

No way in. No-reply senders, a marketing address that bounces, a chatbot, and a contact address that ignores formal petitions. No security contact, no "you sent this to the wrong person" link. If reporting a leak to you is harder than receiving one from you, your incident process is broken.

An unsubscribe button that does nothing. When opt-outs are ignored, the suppression list isn't connected to anything. That's a compliance failure, and a sign nobody owns the data flow end to end.

Verification pointed the wrong way. All the identity checking landed on the person reporting the problem. None of it landed on the address receiving the data.

What your business should take from this

Misdirected email is not an exotic threat. Data emailed to the wrong recipient was the most common incident type reported to the UK's ICO in 2023: 1,744 reports, 16% of the total (source). Most of those are one-off slips. This one was a system that kept making the same mistake every day, with nobody able to stop it.

If you send customers anything sensitive:

  1. Verify every email address before it receives anything sensitive, and verify it again when it changes.
  2. Send notifications, not documents. Keep statements, invoices and contracts behind a login.
  3. Give non-customers a way to report misdirected data: no login, no ID, a human on the other end. Publish a security.txt while you're at it.
  4. Treat "you're sending me someone else's data" as a security incident, not a customer service ticket. Under UK GDPR it's a personal data breach, and notifiable breaches go to the ICO within 72 hours.
  5. Make the unsubscribe link work.

If you're the one receiving it

Report it, then get rid of it. In the UK, knowingly keeping personal data without the consent of the organisation it came from can be an offence under section 170 of the Data Protection Act 2018. Twenty months of a stranger's bank alerts would make a tidy profile of her spending habits. Building one would be a crime, and a creepy one. That's why my filter deletes them on arrival.

The customer, as far as I know, still has no idea any of this is happening. Her bank does. It just never answered.

Sources