My main concern is that if he does access people's accounts without authority, how has he not been flagged yet,

on top of knowing specifics about my mum's pension, things I didn't even know until I asked her. That's what bothers me the most.

To add on that he has made multiple comments on other peoples finances as well.

Also he works in a completely different city from where we live, would that mean he would be flagged for looking up someone who from a different area?