Febelfin, the Belgian Financial Sector Federation, is warning clients to vigilantly guard personal banking information — in a terrifying way.

Read: Don’t lose client data

The federation and its ad agency, Duval Guillaume Modem, sent a random bank customer a phishing e-mail, which he responded to. Then, with one phone call, the agency gained the information needed to drain his bank account and use his credit cards.

Read: Regulators aren’t protecting client data

The agency took the prank a step further: it found the customer’s Facebook account and used the photographs and other information to successfully impersonate him, even fooling his friends.

Also read:

Is your private financial data secure?

Encrypt client statements before emailing

Julius Baer confirms client data stolen