Manchester City Council Stored Photos of Vulnerable Families' Bank Cards in an Open Staff Chat for Months. Nobody Told the Information Commissioner.
Estimated reading time: 7 minutes
In short. A report to Manchester City Council's Audit Committee on 13 October 2026 gave only "limited" assurance, the second-lowest of its four ratings, over how the council's Children's Services district offices pay families and carers directly [1]. Auditors found photographs of residents' bank cards stored in a Microsoft Teams channel open to every social worker, business support officer and finance officer in a locality, a risk they rated "critical" and called "avoidable" [2]. After auditors raised it mid-audit, the practice was supposed to stop; a follow-up check still found card details being kept in two of the council's three district offices [3]. The same audit found cash payments to families disguised as something else, emergency housing booked through Airbnb and Booking.com with no checks on safety, and purchase card spending the council could not document [3]. Neither the council nor its auditors has referred the data issue to the Information Commissioner's Office, and a Liberal Democrat member of the Audit Committee says he is worried about "a culture of not referring" [4].
What the audit looked at
Manchester's Children's Services Social Care teams make cash and cash-alternative payments directly to families and carers: emergency funds, travel costs, support for essential items, administered out of three district offices [1]. The South office pays almost entirely through petty cash, the North uses a mix of cash and cashless methods, and only the Central office has moved to a fully cashless system [3]. Internal Audit's review of that arrangement went to draft on 29 April 2026 and was finalised on 6 July 2026, with a "High" business impact rating attached [3]. Of its four test areas, auditors rated payment accuracy and timeliness "limited", and documentation and approvals "limited" too [3]. The report reached members as part of the routine quarterly Internal Audit Assurance Update, taken to Audit Committee on 13 October 2026 [1].
Bank cards in a Teams channel
Two findings were rated "critical", the top of the audit's four-point scale, and both concern how District Offices check who they are paying [3]. To verify a resident's bank details before sending money, staff had been photographing bank cards and saving the images to a Microsoft Teams channel used by the Business Support team, open to "all social workers for that locality, business support and the relevant finance officers" [4]. Auditors call the practice an "avoidable data security risk" and say they raised it with the Business Support lead during the audit [2]. The council says the images were then removed, but a follow-up check by auditors still found bank card details being stored in the Central and North teams' records, which the report describes as leaving an ongoing data security risk alongside a gap in compliance with the Payment Card Industry Data Security Standard [4]. The council's own Internal Audit section separately records that it is working with an external assessor ahead of a formal compliance assessment it is required to pass this year [2].
The version of this finding now published on the council's own committee pages is marked "Redacted": the words describing exactly what was photographed and stored are blanked out throughout the document, though the surrounding sentences, about a Business Support lead being told to stop and a follow-up check finding the problem persisted, read identically to contemporary press reporting of the same report [3]. This site checked the quotations above, describing what those redactions conceal, against that press reporting before using them, rather than relying on the council's current published text alone [4].
Payments that were not what they said
The audit's other critical-risk finding is separate from the data issue: auditors found "instances where payments that appeared to be to citizens were actually staff expense reimbursements being processed through petty cash" [3]. One example in the report: a 193 pound payment recorded as a public transport cost for a social worker's train ticket was authorised on a minute sheet stating the cash was intended for a citizen's aunt, even though she had not incurred the expense; auditors say they have still been unable to obtain evidence the cost was legitimately incurred [3]. A separate 700 pound petty cash reimbursement for taxi costs in the North office pointed to the same pattern [3]. Purchase card testing found three of 58 transactions sampled, totalling 1,136.95 pounds, lacked supporting minute sheets, invoices or receipts, and two further transactions where the supplier named on the minute sheet did not match the supplier shown on the bank statement [3]. Both critical recommendations, stopping the card image practice and routing staff reimbursements through the council's ordinary expenses system instead of petty cash, carry a three-month deadline for action [3].
Emergency housing on Airbnb and Booking.com
A further finding, rated "significant" rather than "critical", concerns how the council houses homeless families with children in an emergency. Auditors found "significant use of AirBnB and Booking.com" for temporary accommodation, which the service told auditors is meant as a last resort once other housing options are exhausted, to meet the council's statutory duty to homeless children under the Children Act 1989 and the Housing Act 1996 [3]. The report describes cases where families turned down suitable housing, making themselves "voluntarily homeless" and so ineligible for the council's ordinary homelessness service, before needing emergency accommodation under the children's duty regardless, which the auditors say bypassed the process that would normally apply [3]. Auditors found no evidence of checks that the properties booked this way were "appropriate, safe, compliant with required safety standards, or free from potential related-party conflicts" [3]. Internal Audit says it is still working out how much the council has spent this way, and wants a cross-service control framework for emergency accommodation in place within six months [3].
No referral to the regulator
Asked at the 13 October meeting whether the bank card issue had been reported to the Information Commissioner's Office, a council official was unable to confirm whether it had [4]. The regulator told local reporters on 16 October that it had not received a report from the council about the matter [4]. Councillor Richard Kilpatrick, the Liberal Democrat member for Didsbury West who sits on the Audit Committee, said: "I'm concerned there's a culture of not referring when they know that they've done something wrong, even though it is absolutely in the interest of the council once a mistake has been made to accept it made a cock-up and investigate it properly" [4].
A council spokesperson's response did not dispute the facts auditors found: "The issue about the retention of some bank card details was identified and management action taken to address it, although at the time of audit it was noted that a small number of records remained to be removed. These have all since been removed and there is no evidence that the information was accessed beyond its legitimate use by the team who were collating and retaining it" [4]. On the audit function itself, the spokesperson added: "The role of the council's internal audit service is to identify, review and act on areas where improvements are required... As part of our commitment to transparency and accountability, we publish substantial details of audit work which are discussed in public in our audit committee. This is more than many other councils do" [4].
What is still open
The audit's own deadlines are the next checkpoint: three months to stop storing card images and move staff reimbursements onto the council's proper expenses system, six months to fix the voucher process, the financial authorisation form, the purchase card documentation gaps and the emergency accommodation controls [3]. Internal Audit's own figures on Airbnb and Booking.com spending, and whether the council has by then referred itself to the Information Commissioner's Office, are not yet public. This site will report both when they surface.
Sources
- Manchester City Council, "Internal Audit Assurance Update Quarter Two 2026/27", report to Audit Committee (13 October 2026). https://democracy.manchester.gov.uk/documents/s67740/Internal%20Audit%20Assurance%20Update%20Quarter%20Two%20202627.pdf
- Manchester City Council, Appendix 1 for Internal Audit Assurance Update Quarter Two 2026/27, Summary of Audit and Assurance Work 2026/27 (13 October 2026). https://democracy.manchester.gov.uk/documents/s67741/Appendix%201%20for%20Internal%20Audit%20Assurance%20Update%20Quarter%20Two%20202627.pdf
- Manchester City Council, Appendix 2 for Internal Audit Assurance Update Quarter Two 2026/27 (Redacted), executive summary and findings for the Children's Services Payments to Individuals audit (13 October 2026). https://democracy.manchester.gov.uk/documents/s68176/Appendix%202%20for%20Internal%20Audit%20Assurance%20Update%20Quarter%20Two%20202627%20-%20Redacted.pdf
- Hits Radio Manchester / Local Democracy Reporting Service, Stan Tomkinson, "Photos of bank cards stored on Manchester council systems created 'critical' security risk, report finds" (21 October 2026). https://www.hellorayo.co.uk/greatest-hits/manchester/news/manchester-council-bank-card-data-security