"Tax evasion: client list available."

By DAVID GAUTHIER-VILLARS And DEBORAH BALL NICE, France—The anonymous emails carried a tantalizing subject line:

"Tax evasion: client list available."

The messages, sent two years ago to tax authorities across Europe, made an audacious claim: The sender could provide a large client list of a Swiss-based private bank, plus access to its computer systems.

The emails were sent to Germany's secret police, the French police and the U.K.'s tax authorities and foreign ministry.

The emails came from the computers of Hervé Falciani and Georgina Mikhael, two employees of HSBC Holdings PLC, people familiar with the matter say. The caper has landed the two at the center of a controversy over whether governments should use data obtained by dubious means to bring tax evaders to justice.

 HSBC officials allege that Mr. Falciani copied thousands of files of wealthy clients of its Swiss private-banking arm. Swiss authorities are investigating whether Mr. Falciani, 38 years old, stole bank records and violated banking secrecy laws.

Mr. Falciani, a Franco-Italian computer engineer, and Ms. Mikhael, 35, went on a border-hopping odyssey to offer the data to governments and other banks in Europe and the Middle East, according to people familiar with the investigation. To do that, they allege, he and Ms.

Mikhael set up a virtual company, with Mr. Falciani using an alias.

Mr. Falciani admits being in possession of the data and confirms contacting governments about it. But he and Ms. Mikhael both deny breaking any laws. The emails sent regarding the data didn't ask for money. He says his goal wasn't to profit from the data, but rather to expose secrecy in banking practices.

"I am not a Robin Hood, I'm not a mercenary," Mr. Falciani said in an interview. "I acted like a citizen."

Whatever the case, his plan rocked the banking world.

Copies of the HSBC data did wind up in the hands of French tax authorities, who are now using it to chase alleged tax dodgers with money stashed in Switzerland. The French say they didn't pay for the trove, which includes the names and account details of thousands of customers from 180 countries.

The French acquired it when police raided Mr. Falciani's home in southern France 18 months ago at the behest of Swiss authorities, who had launched an investigation into allegations of violations of bank secrecy. France sent copies of the data to Switzerland, but kept the original files for itself, to pursue possible tax cheats.

Mr. Falciani, who remains in France, denies preliminary allegations by the Swiss authorities of breaching banking secrecy and stealing banking records. Ms. Mikhael is being investigated on similar preliminary allegations, Swiss prosecutors say, which she denies.

French authorities aren't investigating the two.

Switzerland strenuously objects to foreign authorities using the HSBC data to pursue tax dodgers and has warned it won't cooperate with any investigation stemming from what it regards as stolen data. An HSBC spokesman said the bank had no comment on the use of the data by foreign tax authorities.

France has said it would use the data to pursue tax cheats. "We obtained those data in a legal manner," then-budget minister Eric Woerth said in February. "France isn't on the line for fraud, tax evaders are."

In a twist, it is the French government that is now making the data available, promising to hand it over to other governments in pursuit of tax cheats.

 In June, Spain's tax authorities said they had received some of the HSBC data from France and had started examining it. In May, Italian tax officials said they received from the French details on some 7,000 Italian account holders, involving nearly $7 billion in assets, and are sifting through the records.

The size and scope of the HSBC case is acutely alarming to Switzerland's $2 trillion offshore banking industry. Swiss bank-secrecy laws date to 1934, when the country made disclosing bank data a crime. "If governments are in the market of buying illegal data, that changes the world," UBS Chief Executive Oswald Grubel said recently.

In another case earlier this year, Germany bought stolen Swiss bank account records from a bank employee. It isn't known which banks'

records were acquired. Two years ago, Germany paid €4.2 million ($5.3

million) to yet another bank employee to buy stolen data from a Liechtenstein bank to chase tax evaders.

Mr. Falciani was 28 when he joined the private banking arm of HSBC in his native Monaco in 2000. He held a degree in computer programming and wrote security software for the bank. He was promoted several times and, in 2006, he was transferred to HSBC's private banking headquarters in Geneva to improve database systems and security.

Around that time, according to HSBC and people familiar with the Swiss probe, Mr. Falciani copied thousands of files onto personal storage devices and began considering ways to monetize the information.

Mr. Falciani said that in Monaco and Geneva, he copied data onto personal computers and remote servers as part of his routine work, essentially for backup purposes. He denies that he considered selling or tried to sell data. HSBC says bank policy forbids employees from storing client data on personal computers.

In early 2007, Mr. Falciani began consulting experts on how to set up a company to sell customer bank data, according to people approached by him. During these meetings, Mr. Falciani claimed the data came from his expert mining of open, public sources, these people said.

Cracks in Swiss Bank Secrecy

June 2008 through August 2009: U.S. authorities accuse UBS of having helped thousands of American taxpayers evade taxes by hiding money in secret Swiss accounts. After a bruising battle, UBS agrees to hand over the names of 4,450 U.S. taxpayers to the IRS by August 2010.

April 2009: The OECD puts Switzerland on a so-called gray list of uncooperative tax havens, raising the specter of sanctions against the Alpine country. The Swiss government subsequently agrees to relax bank secrecy laws.

September 2009 through April 2010: Italy launches a tax amnesty aimed at luring tax dodgers to come clean by paying a very low penalty on offshore accounts. The move spurs Italians to declare nearly €100 billion, with two-thirds of that from Switzerland alone.

January 2010: A confidential informant offers to sell to Germany stolen Swiss account data containing details on alleged German tax cheats. The price tag: €2.5 million.

March 2010: HSBC alleges a "serious data theft" by former employee Hervé Falciani of account details of 24,000 current and former clients of its Swiss private bank. Mr. Falciani denies having stolen the data.

Source: WSJ research

"Yet, he said he needed a helping hand to understand whether his data were legal," said Guillaume Brachet, a Monaco-based fiscal consultant who dealt with Mr. Falciani's request. "Each time I asked how he got them, he grew nervous, and I couldn't catch his explanations."

Mr. Falciani says he and Mr. Brachet must have had "a misunderstanding," because "my plan wasn't to set up a company." Mr.

Falciani said his goal was to expose security gaps at the bank, which he thought could harm clients and governments.

Mr. Falciani says he alerted his bosses at HSBC in 2006 about flaws in data storage that could affect client confidentiality, but no one listened. HSBC officials said they found no such warnings by Mr.

Falciani.

Around that time, Ms. Mikhael, an HSBC colleague, entered the picture.

A Franco-Lebanese computer programmer, she joined HSBC in Geneva on a temporary contract in 2006, but had no access to sensitive data, the company says. Soon after arriving at the bank, Ms. Mikhael and the married Mr. Falciani began a romantic relationship, which has since ended, according to their respective lawyers.

The pair set up Palorva, a virtual company that had a website with the

motto: "Business is the art of extracting money from another man's pocket without resorting to violence."

The duo also had business cards presenting Ms. Mikhael as a public-relations manager and Mr. Falciani as a sales manager, but under the alias of "Ruben Al-Chidiack." The website claimed it could help banks recruit new wealthy customers by combing through public data bases.

In February 2008, Mr. Falciani and Ms. Mikhael flew to Lebanon, where according to their lawyers they met Beirut representatives of five

banks: BNP Paribas, Société Générale de Banque au Liban, Blom Bank, Audi Bank and Byblos Bank.

According to officials at the banks familiar with the meetings, Mr.

Falciani, who was still employed by HSBC, introduced himself as Ruben Al-Chidiack and made a short marketing pitch. He evaded questions about how he obtained the data he offered to sell, these people said.

Mr. Falciani, in the interview, said the idea of marketing data was just a cover. He said he was acting on a request by a foreign intelligence service—which he declines to name. He says his assignment was to identify potential enemies of HSBC clients, within or outside the bank.

"When we went to Lebanon, I was on a mission," he said.

Through her lawyer, Thierry Montgermont, Ms. Mikhael said she didn't know how Mr. Falciani had gotten hold of the data he displayed in Beirut. Ms. Mikhael simply designed and registered the Palorva website, her lawyer said. Ms. Mikhael thought she was working on an independent project during the trip to Lebanon, the lawyer said.

After a week in Lebanon, Mr. Falciani and Ms. Mikhael returned to Geneva. In March 2008, they appeared to shift direction, sending anonymous emails to European governments, according to people familiar with the Swiss probe.

A message sent to Germany's secret service, Bundesnachrichtendienst, was signed by Ruben Al-Chidiack and claimed access to a list of

127,311 customers, with "all the clients' details of the HSBC Private Bank SA."

Mr. Falciani said he approached "several" foreign services as part of his attempt to expose security weaknesses in bank computer systems. He said he also instructed Ms. Mikhael to contact Germany and the U.K.

Through her lawyer, Ms. Mikhael denies sending messages to foreign governments, claiming Mr. Falciani often used her computer. U.K.

authorities said they found no record of having received emails about HSBC data. German authorities declined to comment.

But France engaged Mr. Falciani. In 2008, Mr. Falciani says he met several times with French officials, including with a psychologist who probed his personality. He says he provided documents to help establish that he was a "credible source."

After checking Mr. Falciani's background, French officials say the police referred him to the Direction Nationale d'Enquêtes Fiscales, or DNEF, France's top financial-investigation body.

DNEF investigators understood that Mr. Falciani could lead them to a mother lode of financial records that France could use to prosecute tax dodgers, the French officials say. But DNEF faced a legal

obstacle: how to use HSBC's data without infuriating Switzerland?

A door would open eventually for the French. One of the Beirut bank branches that Mr. Falciani and Ms. Mikhael visited posted an alert of suspicious activities on a website managed by the Swiss Bankers Association. The notice said someone had been trying to sell "data on clients of various Swiss banks."

Swiss Federal Police, who monitor the site, opened a probe and soon homed in on Ms. Mikhael, who had traveled to Lebanon using her real identity.

On the morning of Dec. 22, 2008, soon after she told HSBC she planned to end her contract with the bank and return to Lebanon, Swiss police took her into custody for questioning. Ms. Mikhael instantly unmasked Mr. Falciani as the mysterious Mr. Al-Chidiack, her lawyer said.

Later that day, Swiss police handcuffed Mr. Falciani at his HSBC office, seized his work computer and searched his Geneva home. In a bedside cupboard, they found pieces of paper with the addresses of police contacts in France and Germany, according to people familiar with the Swiss probe.

After being interrogated for hours, Mr. Falciani was released on the condition that he return the next day for further questioning.

Instead, he rented a car and drove to France, according to Mr.

Falciani and people familiar with the Swiss probe.

Once in southern France, he said, he immediately began downloading the HSBC data he had stored on remote servers and saved them on a computer. "I needed to prepare my defense," he said. He says he told Swiss authorities that he would come back after the Christmas break, but hasn't returned to Switzerland since.

In January 2009, acting on a request from the Swiss prosecutor, Nice prosecutor Thierry de Montgolfier searched Mr. Falciani's parents'

house on the French Riviera, where he was staying. There, the police seized a smart phone, a notepad, a laptop and a personal computer, the prosecutor said.

"Before deciding whether to hand all this to the Swiss, we had to look inside," Mr. de Montgolfier said.

With Mr. Falciani's help, French authorities found thousands of accounts and bank-transfer details. Stripping out names that appeared twice or couldn't be read, the files contain data on about 79,000 clients and 20,000 companies, according to the Nice prosecutor. The list includes more than 8,000 French, about 1,500 Americans and as many British residents, according to Mr. de Montgolfier. He promptly shared the trove with France's tax authority.

François Baroin, who became France's budget minister in March, said recently that inquiries launched on the basis of HSBC data had allowed his ministry to recoup €1 billion in unpaid taxes and penalties.

HSBC disputes the number of clients outed by the French. It says the data are for 24,000 past and current clients. HSBC currently counts about 100,000 private-banking clients world-wide.

Mr. de Montgolfier, who keeps Mr. Falciani's computers in a safe, said he wasn't interested in tracing the origin of the data. "What matters to me is whether the data are genuine and reliable," he said. "So far, I have no doubt that they are both."

Write to David Gauthier-Villars at David.Gauthier-Villars@wsj.com and Deborah Ball atdeborah.ball@wsj.com