A former employee of United Overseas Bank, a 30-year-old Chinese national and Singapore permanent resident named Cao Wenqing, was convicted in a Singapore district court on Tuesday, October 14th. She was found guilty on a total of 27 charges for her role in a significant data breach that compromised the private information of more than one thousand bank customers.
The conviction comprises 14 charges under the Computer Misuse Act and 13 charges under the Banking Act. Cao Wenqing had contested these charges during her trial, maintaining that she was an innocent victim deceived by individuals falsely claiming to be officers from the Shanghai police. However, District Judge James Elisha Lee, presiding over the case, found her defense lacking.
The judge emphasized that Cao Wenqing, possessing tertiary education qualifications and having undergone specific training from United Overseas Bank, was fully conscious of the highly confidential nature of customer data. She was explicitly aware of the strict restrictions against its unauthorized disclosure and understood that extracting customer information for personal reasons was a direct violation of the bank's internal policies. Judge Lee stated it was "unreasonable" that Cao did not take any steps to verify the identities of the individuals who contacted her, especially since she later demonstrated the ability to do so by calling the Shanghai police herself after reading about a similar scam.
According to the prosecution's case, presented by Deputy Public Prosecutor Ryan Lim, Cao Wenqing was employed as a junior officer in the mortgage department at United Overseas Bank. In this role, her access to the customer database was strictly limited to official duties, which involved selling mortgages to new clients and servicing the accounts of existing mortgage holders.
The illegal activity began in March 2021 when Cao was contacted by persons using the names "Xiang Ying Dong" and "Captain Lu." Believing them to be legitimate authorities, she agreed to assist "Captain Lu" on a voluntary basis. Following his instructions, she used her work-issued laptop to access the bank's internal systems. She systematically searched for customers with common Chinese surnames, then manually checked their profiles to confirm they were Chinese nationals.
For each identified customer, she compiled a list of their sensitive personal details, including full names, identification numbers, bank account balances, and contact numbers, into an Excel spreadsheet. After gathering data on batches of 50 to 100 individuals, she would take photographs of her computer screen displaying the spreadsheet and send these images to "Captain Lu" via the WhatsApp messaging platform, subsequently deleting the photos from her device. She also performed targeted searches on specific individuals requested by the scammer and sent screenshots directly from the customer database.
The prosecution revealed that Cao Wenqing's motivation for complying with these requests was a combination of fear and self-preservation. She was worried about fictitious investigations being launched against her and felt pressured to cooperate with individuals she perceived as powerful Chinese police officials. She also sought to avoid being forced to return to China and potentially losing her job in Singapore. Despite knowing her actions were against both bank policy and Singaporean law, she proceeded with the data leak. It was only on April 22, 2021, after realizing she had been defrauded, that she reported the entire matter to the Singapore Police Force. The case has been adjourned for mitigation and sentencing in December.
Comments
Post a Comment