Citizen Receives Over 650 Emails Regarding Transactions Related to the Ministry of Defense and Other State Structures

Since June 2020, Mariam Khachatryan has been receiving notifications from the "Haybusinessbank" to her email address. These are excerpts of banking transactions belonging to various individuals. As reported by Hetq.am, initially, Mariam thought it was a mistake and deleted the messages.

According to the publication, "Before this, Mariam Khachatryan did not have any accounts in Armenian banks. She moved to Yerevan from the Russian Federation in 2020, during the coronavirus pandemic."

The flow of emails to Mariam's electronic address did not stop. She contacted the bank by responding to the email address from which she had received the message. The bank's employee replied, stating "Ok." After some time, she received messages again, wrote to the bank, and this time the bank employee apologized and thanked her for the notification.

About two weeks ago, while talking to her husband, she mentioned that she had received more than 650 emails, which were not addressed to her. Her husband suggested she speak out about the issue. Mariam began to categorize the messages and saw that during this time she had also received emails from three other banks in Armenia: "Evocabank", "Converse Bank", and "Inecobank." "I didn’t realize that they were from different banks; then I started to sort them out and saw that I had received 422 emails from 'Haybusinessbank', 16 from 'Converse', 38 from 'Evocabank', and 177 from 'Inecobank', and these are the messages I haven’t deleted," Mariam shared.

Mariam decided to go public with this, as she has been receiving emails containing personal data of unfamiliar individuals for over 3 years. The emails from "Haybusinessbank" contain information about transactions related to the Ministry of Defense and the bank. One of the companies applying for the ministry’s closed tender had obtained a guarantee from "Haybusinessbank." In another email sent in 2020, Deputy Prime Minister Tigran Avinyan had contacted the Chairman of the Central Bank, Arthur Javadyan.

The messages sent to her email are considered bank secrecy. All documents state that they cannot be transferred to a third party. In the case of "Haybusinessbank," Mariam also received messages addressed to an employee with the same name (Mariam Khachatryan), and all internal messages of the bank meant for employees were sent to her email.

"It turns out that I have access to the full data of completely unfamiliar individuals without my will. I receive account statements, information about banking transactions, repayment schedules for loans, and if these fall into the hands of fraudsters instead of me, they could easily manage people’s finances,” Mariam stated.

“Hetq” also wrote to all four banks and the Central Bank to clarify what supervisory mechanisms the institution has for the safety systems of banks and the protection of personal data. The banks have not yet responded to our inquiries. The response from the Central Bank states that it cannot be excluded that such problems may periodically arise due to a customer providing incorrect data, and in this case, the issue may be less related to the internal regulations of the financial organization or technical issues.

“The issue you have raised is an important signal for the effective implementation of CB supervision. It should be noted that the financial organization is naturally responsible for the protection of its customers' personal data and for minimizing cases of their leakage. The Central Bank supervises the licensed structures it has, but the aim of that supervision is to ensure that effective systems are in place to exclude individual cases within financial organizations. Currently, a study is being conducted by the institution, and based on the results, regulatory measures and changes will be undertaken if necessary,” the response from the CB states.