Bank is left unlocked for 19 hours

Little Oliver was at the HSBC with mum, Alison, and dad Daniel, when the family visited the cash machine at Easingwold, North Yorkshire, on Saturday afternoon.

Mrs Pettigrew said: "We usually go into the bank and so Oliver just pushed the door and wandered in.

"I was at the cash machine and it was Oliver's dad who started saying, 'where's Oliver? where's Oliver?' "Then Oliver appeared again. He and his dad ended up wandering around the place, which was totally deserted. There were computers everywhere and there was no alarms sounding.

"We just had to call the police. Thank goodness it was our family who found it and not a criminal."

Dad Daniel walked right up to the vault without an alarm sounding. The Pettigrews called 999.

The HSBC tried to downplay the breach saying the emergency services would have been summoned automatically if someone stepped inside.

However North Yorkshire Police have confirmed that the only call received was from Daniel Pettigrew.

The bank had been closed for business at 4.30pm on Friday and Oliver opened the door at lunchtime on Saturday.

A spokeswoman for the bank said there had been a malfunction with the catch on the door.

Daniel Pettigrew said: "Oliver vanished and then appeared again while we were at the cash point. He said, 'Dad, the bank is open.' "At first I thought he was joking and I said 'yeah, right.' But it was.

"When I realised the bank was empty and the service times said Monday to Friday I phoned 999."

Mr Pettigrew, who is director of his own York-based training consultancy, walked right into the bank and saw computers lying on desks which he said could easily have been stolen.

He and Oliver also walked right up to the door of the vault where money is kept.

Mr Pettigrew, who lives in Easingwold, said: "There was the big safe, right in front of us. I wish I'd taken a picture of it. There were computers and walkie talkies lying around in there. Anyone could have stolen them.

"The hard drives were in there too. In the current climate it makes you wonder if anyone could have got the database with bank customers' details on it.

"There were no alarms going off or anything like that. If it hadn't been for Oliver that door could have been left open until Monday."

The Pettigrews stood guard at the bank until police officers arrived.

A North Yorkshire Police spokesman confirmed officers had received a call from Mr Pettigrew.

He said: "We received a call from a member of the public who said he was standing in the middle of the bank and the bank was supposed to be shut. He said there was no one around.

"We tried to contact HSBC and spoke to an out-of-area call centre. Police attended and found there was no sign of any break-in. The bank sent a representative from their security company."

Mr Pettigrew said: "Nobody even phoned us to say thank you. When I phoned the regional department and spoke to them about it, they didn't even know it had happened.

"They then sent Oliver a letter, saying he had saved the day.

"They offered him a book token, but I told them he had always wanted his own bank card and asked if they would open an account for him.

"They opened an account and put £10 in it. The only thing I was slightly disappointed with was the amount. We could have saved the bank thousands of pounds and yet all they gave him was £10."

A spokesman for HSBC, which made profits of about £11bn in 2006, said there was no danger to bank customers.

She said: "Basically, what happened was there was a malfunction with the door catch. Once the door was pushed open it would have alerted the police anyway.

"It was very sweet of Mr Pettigrew and his son to do the right thing and alert the police and we opened an account for him to say thank you."

She said the doors were all part of a CCTV network and linked to London, so security would have been alerted once the door was opened.

She said: "There would have been no danger to customers in terms of cash or information being stolen. Obviously we don't want security issues but sometimes these things happen."

A human rights watchdog has criticised the bank.

Simon Davies, director of Privacy International, said it was an "extraordinary state of affairs" which could have exposed thousands of customers to a "grave risk".

He said: "I cannot believe that a bank would not have procedures in place to make sure all exits are sealed at close of business.

"This is a situation I have never encountered before. It is a failure on multiple levels, on the human level and on the technical level and what it does is expose thousands of customers to a grave risk.

"It could be that the computers are part of a central control system and are password protected and contain no information locally, in which case you don't have the same level of threat.

"But if they are just password protected then someone could have gained access to the whole central resource of data."