Can a private investigator get phone records, bank statements or messages?

What people ask for

The request usually comes in one of a handful of forms. Someone wants to see who their partner has been calling or messaging. A creditor wants a debtor’s bank balance before deciding whether to sue. An employer wants to read a departing employee’s personal email to see whether files went with them. A parent wants a child’s messages.

Each is understandable. Each is also a request for material that belongs to someone else and is held by a third party under a duty of confidence, and the only lawful ways to reach it run through a court, a regulator or the police.

Why no lawful investigator will do it

Three sets of rules stand between an investigator and this material, and each carries criminal liability for the person who breaks it and, very often, for the client who asked.

Obtaining personal data by deception. Ringing a phone company or bank pretending to be the account holder, or bribing someone inside it, is an offence under section 170 of the Data Protection Act 2018. The practice has a name, pretexting, and it is where much of the industry’s poor reputation comes from. A false representation made to obtain the records is also fraud under the Fraud Act 2006.

Accessing an account or device. Logging into someone’s email, cloud account or phone without their permission is unauthorised access under section 1 of the Computer Misuse Act 1990, whether it is done by guessing a password, using one you happen to know, or installing software on the device. Knowing the password does not make the access authorised.

Intercepting communications. Reading messages or listening to calls in transit is unlawful interception under the Investigatory Powers Act 2016. Call records themselves are communications data, which only public authorities acting under a warrant or authorisation can obtain from a provider.

None of these has an exception for good motives. A spouse who suspects adultery, a creditor who is owed money, and an employer who suspects theft are all in the same position as a stranger.

What happens if someone does it anyway

Evidence obtained this way is usually worse than useless. A court can exclude it, and in family proceedings a judge who learns that one party hacked the other’s email is likely to hold it against them, regardless of what the email said. The person whose data was taken can bring a claim of their own, and the Information Commissioner prosecutes section 170 cases against investigators and against the clients who instructed them.

The client is also exposed in a more direct way. An investigator who will break the law for you holds the evidence that you asked them to.

What the law does allow

The material itself is out of reach, but the questions behind the request often have a lawful route to an answer.

• In court proceedings, disclosure. Once a claim or a divorce is under way, each side is under a duty to disclose relevant documents, including bank statements. Where a party is suspected of hiding something, a solicitor can ask the court to order further disclosure, or to order a third party such as a bank to produce records. This is the lawful version of what people ask investigators to do, and it comes with the court’s authority behind it.
• A court order to identify someone. Where you know what was done but not who did it, a solicitor can apply for an order requiring a platform or provider to hand over the account holder’s details. Our online impersonation guide covers when this is worth pursuing.
• What is public. A surprising amount can be established without touching a private record: where someone lives and works, what companies they direct, what property they own, what they have said and shown in public, who they associate with. This is open-source intelligence, and combined with lawful surveillance it answers most of the questions that start as a request for phone records.
• Your own data. You are entitled to your own records. A joint account holder can obtain statements for the joint account. A company can examine its own systems and the accounts it issued to staff, within the limits set out in its policies and the employment legislation.
• A subject access request. Anyone can ask an organisation for the personal data it holds about them. It is a slow route and it only reaches your own data, but it is sometimes what a situation needs.

What the question usually means

When someone asks us for phone records, we ask what they are trying to find out. The answer is almost always a question about behaviour rather than data: whether a partner is where they say they are, whether a debtor has assets, whether an employee took files. Those questions can be answered lawfully, and the evidence that answers them survives contact with a solicitor.

A matrimonial instruction, for example, is normally scoped around observation on specific dates and a review of what is publicly visible, rather than around anything the other party has typed. Our matrimonial page sets out how that is kept proportionate.

How to spot a firm that will break the law

Anyone who offers to obtain phone records, bank statements, medical records, passwords or “phone location” is telling you they will commit an offence on your behalf. The offer is sometimes softened with phrases such as “we have contacts” or “through our network”. Treat it as an answer to the most important question you can ask an investigator, and end the conversation. Our page on choosing an investigator lists the other warning signs.

This guide is general information about the law of England and Wales as we understand it at the date shown at the foot of the page. It is not legal advice and does not take account of your circumstances. Before acting on anything here, particularly where court proceedings, a criminal complaint or an employment decision are involved, take advice from a solicitor. We are investigators, not lawyers, and we will say so if a question you bring us needs one.

Related services