Hero or Villain? The Strange Case of HSBC Whistleblower Hervé Falciani

Falciani posing in July on the Champs de Mars in Paris Photograph by Philippe Wojazer/Corbis

On Feb. 1, 2008, a man and a woman boarded a plane in Geneva and flew to Beirut. Over the next week, they visited managers at four Lebanese banks. The man, who identified himself as a Lebanese national named Ruben El Chidiak, told the bankers that he ran a consulting firm and had valuable information to sell.

In fact, his name was Hervé Falciani, and he was a systems engineer at the Geneva-based private banking unit of HSBC. The bank would determine later that he had carried out one of the biggest security breaches in Swiss banking history, obtaining details on the accounts of some 24,000 HSBC private-banking clients.

The account data later was passed along to tax authorities in European countries—including France, Spain, and the U.K.—who have used it to collect more than €1 billion ($1.34 billion) in back taxes. Falciani says the data has also provided leads for ongoing investigations of corruption, money laundering, and terrorist financing. The Geneva bank provided an “open door” for such illicit activity, Falciani told a Spanish court earlier this year.

Falciani, 41, fled Geneva at the end of 2008 and since then has hopscotched around Europe, one step ahead of Swiss prosecutors who have accused him of data theft, a charge that carries a sentence of up to three years in prison. Spain refused to extradite him after a hearing in April at which a government prosecutor praised him as a whistleblower. He moved this summer to France, where he has testified behind closed doors to parliamentary committees.

With his computer-geek credentials and Mediterranean good looks, Falciani is a cross between Edward Snowden and Robin Hood—”The man who makes the rich tremble,” as the French magazine Le Point put it.

Still, what was he doing in Beirut? Over lunch at a Paris café, Falciani tells a story that raises as many questions as it answers.

Falciani, who has dual French and Italian citizenship, joined HSBC in 2000 in Monaco as a computer specialist. After being transferred to Geneva to work on a document-management system, he says, he discovered that clients’ account information was not being adequately safeguarded. He says he alerted his superiors, but they ignored him. “The bank was working mainly to protect its own profitability,” he says.

HSBC disputes this. “We do not have any record or knowledge of any previous attempts made by Falciani to alert his line manager or the bank’s management,” says David Bruegger, a bank spokesman in Zurich. Bruegger says the bank has safeguards “designed to prevent clients from abusing our services for tax evasion,” and that the bank ends relationships with clients who are “not tax-compliant.”

Falciani says that his job did not give him access to client accounts, but that other employees shared his concerns and began leaking account data to him in 2006. HSBC says its internal investigation showed that Falciani alone took the information.

Falciani says he tried to pass the data to Swiss law-enforcement authorities to demonstrate the weakness of HSBC’s control systems, but was thwarted because they refused to protect his anonymity. He then contacted intelligence services in several other countries, he says, because he “had started having doubts about Swiss justice.”

Late one evening in the summer of 2007, Falciani says, he was walking in Geneva when some men jumped out of a van, forced him to get in, and took him to the basement of a deserted building. They identified themselves as agents of Israel’s Mossad intelligence service, he says, and asked if he would help them ensure that HSBC “did not continue its practices.” The men didn’t say specifically what they were concerned about, but Falciani says he later suspected they were worried about hidden sources of terrorist money. Falciani says he agreed to help, although he says he had no way to verify whether the men actually worked for Mossad.

According to Falciani, it was the Mossad agents who proposed the Beirut trip. They said that if Lebanese banks learned that HSBC account secrecy had been compromised, they would alert law-enforcement authorities and “draw attention to the bank.” He says the agents suggested that he enlist the help of a Lebanese-born woman named Georgina Mikhael, who had recently started working at the bank as an IT contractor, without telling her the real purpose of the trip.

Mikhael, who now lives in Beirut, tells a different story. She says she and Falciani began dating shortly after she began working at HSBC in late 2006. Falciani, who was married and had a small daughter, told her he wanted to leave his wife but needed money for a divorce. “He said the only reason he went to work at HSBC was to steal data to get a large sum of money,” Mikhael says.

She says Falciani told her he had used Internet data mining to assemble information on wealthy individuals. He said he planned to sell the data to banks, and asked her to help set up meetings with potential clients in Beirut. Mikhael says she agreed, although she became suspicious when he insisted on using a false name. He explained that he wanted “to give [the bankers] confidence by giving the impression that he was Lebanese,” she says. She says Falciani never told the bankers what he wanted to be paid. “He always said, ‘We’ll talk about that later,’ ” she says.

Mikhael says her suspicions deepened during a meeting with a female manager at a large Lebanese bank. After Falciani presented a sample of the data, “Her eyes were wide, she was shocked,” Mikhael says. “She said: ‘It’s not possible to find out this kind of information on the Internet.’”

Falciani was frustrated after the trip because the banks didn’t seem interested in buying the data, Mikhael says. “He said, ‘Since I couldn’t sell them to the banks, I’ll try the intelligence services.’” She says Falciani asked her to help find a contact in Germany, where government authorities have sometimes paid for information to track down tax evaders. However, she says, “They kept switching him around to different people, and he couldn’t reach them.”

Mikhael says Falciani also told her he had held two meetings with French intelligence agents. “He came back annoyed,” she says. “He said ‘They don’t have the price that I want.’ “

Falciani says he never tried to sell the data and has never been paid for it. He says he told the Lebanese banks that his consulting firm was selling “analytical tools” to help determine whether clients’ account data was secure. He also denies that he and Mikhael were lovers.

Unbeknownst to Falciani and Mikhael, the Lebanese bank manager had contacted Swiss banking authorities after their meeting. They tracked down Mikhael, who had used her real name during the meeting, and placed her under surveillance. In late 2008, she says, the police called her in for questioning, and she named Falciani as her companion. HSBC says its internal investigation determined that Mikhael had done nothing wrong.

Swiss police took Falciani into custody on Dec. 22, 2008, released him after several hours’ questioning, and told him to return the next morning. Instead, he fled to southern France with his family. Several days later, French authorities say, he handed them five computer disks containing data on HSBC accounts.

In January 2009, acting on a complaint from Swiss prosecutors, French police raided a house near Nice, at which Falciani was living, and confiscated his computer. According to a French parliamentary report on the case last month, the data found on the hard drive was identical to the material Falciani had turned over earlier. Because it had been seized by police, it could legally be used as evidence in prosecutions. Switzerland, though, couldn’t get its hands on Falciani because France does not extradite its own citizens.

French authorities decrypted the data and matched clients’ names with their account details, then passed the information along to other countries. Tax evasion by the wealthy is a particularly sensitive issue in Europe as governments demand austerity from their citizens, and it wasn’t long before the tax men pounced.

In Spain, Emilio Botin, chairman of Banco Santander, was hit with a €200 million tax bill for having an undeclared HSBC account. Botin paid while saying he had been unaware of the account’s existence. British real-estate developer Michael Shanly had to pay €550 million in back taxes and penalties, while in Greece, a journalist published the names of nearly 2,000 Greeks on the list after accusing the government of sitting on the information.

France says data also was furnished to U.S. authorities, but Bloomberg Businessweek has been unable to determine whether any action was taken. Last December, the U.S. imposed a record $1.92 billion money-laundering fine on HSBC, but that case focused mainly on the bank’s activities in Mexico and the U.S.

In July 2012, Falciani took a boat from the French port of Sete to Barcelona, where police arrested him on a warrant issued by Switzerland. Spain offered no guarantees against extradition, but Falciani says he decided to leave France after U.S. intelligence officials warned him his life was in danger. In May, Spain’s National Court refused to extradite him, saying that his actions were “not considered offenses in Spain.”

Back in France, Falciani is working as an applied mathematics researcher with INRIA, a French research institute. He says he is proud of his role in exposing secret Swiss accounts, even though he says he continues to receive death threats and is under protection by French government bodyguards. “I’m willing to take risks, to expose a problem and put in place the structures to fight it,” he says. And he predicts that more explosive disclosures will come from the investigations he triggered. “We’re just at the beginning,” he says.

Some, though, doubt that the file contains any more bombshells. European tax authorities have had the data for almost five years, but have brought only a handful of major cases, says Olivier Longchamp, an analyst at Berne Declaration, a Swiss nonprofit that monitors banking secrecy and tax avoidance. “Maybe the list has information that’s too old or not reliable, or maybe it’s mostly ordinary small accounts,” he says. The list “has been used mainly as a scarecrow,” he says, to deter people from hiding their money in Switzerland.

Before it's here, it's on the Bloomberg Terminal.