Ex-RBC worker found guilty after viewing Carney’s data, opening accounts
A former Royal Bank of Canada employee has been found guilty of three criminal charges after opening fraudulent accounts and viewing the personal banking information of Prime Minister Mark Carney.
Ibrahim El-Hakim, who worked at a downtown Ottawa bank branch, was recruited by someone he believed “to be associated with organized crime,” says an agreed statement of facts in the case filed in an Ontario court.
The RCMP began an investigation last year following a complaint from RBC.
The agreed statement says El-Hakim opened at least 43 fraudulent accounts at the bank between November 2023 and June 2025.
In late June 2025, El-Hakim admitted his involvement in the fraud to an RBC corporate security official, saying he was recruited on Telegram, a social media messaging app, by a person using the alias AI WORLD, the statement says.
Story continues below advertisement
“Mr. El-Hakim stated that he participated in the scheme because he was experiencing financial difficulties,” it adds.
RBC employee allegedly accessed Mark Carney’s banking information
Court documents show El-Hakim pleaded guilty in August to fraud over $5,000, unauthorized use of a computer and identity theft.
El-Hakim did not turn up for a sentencing hearing late last month.
Get daily National news
Get daily Canada news delivered to your inbox so you'll never miss the day's top stories.
His lawyer at the time told Ontario Court Justice Norm Boxall that El-Hakim was no longer in Ottawa.
The court has set a new date for sentencing later this month.
The agreed statement of facts says El-Hakim described how he created bank profiles and opened credit products after receiving requests from AI WORLD via Telegram.
AI WORLD would send instructions and personal identifying information, including name, date of birth, social insurance number, driver’s licence information, passport data and customer profile information. It would request that a credit card be linked to a particular account.
Story continues below advertisement
El-Hakim would also send identity information back to AI WORLD, including online banking passwords.
El-Hakim received at least $5,000 in compensation — $500 for each account issued in the form of an e-transfer deposited into one of his accounts at other banks, the statement says.
It adds that, shortly after interviewing El-Hakim, RBC became aware he had used his work computer and software to conduct unauthorized queries on customer profiles.
Massive data breach leaks 16 billion passwords
On June 17, 2025, El-Hakim accessed the customer banking profiles of Carney, Justin Trudeau and another individual, the statement says. The Trudeau account he accessed “was determined not to belong to the former prime minister,” the statement adds.
While accessing these profiles, El-Hakim was observed consulting a smart watch, the statement says. On the surveillance video, he was seen at one point taking a cellphone out of his pocket, using it and alternating his gaze between the phone and the computer screen of his bank workstation.
Story continues below advertisement
“Mr. El-Hakim committed these offences despite having received training in ethics, privacy, security and fraud prevention as part of his employment at RBC,” the statement says.
“He used customer information provided by third parties, opened fraudulent accounts, attempted to obtain credit products, accessed customer information without authorization, verified and transmitted identifying information, and received compensation for his participation.”
RBC has had to pay $14,634 for 27 clients to receive a two-year credit monitoring service as a result of their identity being stolen, the statement says.
RCMP Cpl. Erique Gasse said in September 2025 the investigation did not lead Mounties to believe there was any threat to Carney’s safety or to national security.
Since the investigation involved the prime minister, it was assigned to the RCMP’s Integrated National Security Enforcement Team in Montreal, where the report was made.
KioskNews shows a cleaned-up reading view extracted from the publisher’s page — the original always lives on their site, not ours.