Randy Chester was visiting one of his usual second-hand haunts this summer, a Value Village in Toronto’s east end, when he spied a beautiful shirt and vest for $20. Excited about his new finds, he tapped his debit card, only to be shocked by the resulting message: Insufficient funds.
“I was upset because I knew I had money,” he recalls. He tried the card again at a variety store, a restaurant and then at an ATM belonging to his bank, CIBC, and got the same message. When he called the bank to see what was going on, they asked him if he had been shopping at Yorkdale Mall in the city’s north end. There was a $1,500 purchase debited from his account, but Chester, a cancer patient on disability who uses a walker, had been at a medical appointment at the Princess Margaret Cancer Hospital that day.
“It’s like, hello!” he jokes. “Value Village, yes. Yorkdale Mall, no. I couldn’t get there with my walker.”
Then he remembered that a young man had called him on his flip-phone a few days before, claiming to be from CIBC and saying there was a problem with his debit card. Chester knew better than to talk to anyone about his banking information and hung up. The next day, he got a text message, purportedly from CIBC, that had the last four digits of his debit card number in it, and asked him to text back “Y” for yes if it was his account. He assumed because they had his number already, it was legitimate. He hit Y and send.
“The bank told me they would never send a text message,” says Chester, 61. “I didn’t know that.”
Once he reported the problem, the bank locked down his account, reversed the charges, and gave him a new bank card. But it’s impossible to tell how the scammers got his bank information, which is often the case when it comes to identity theft, says Jessica Gunson, the acting call centre and intake unit manager at the Canadian Anti-Fraud Centre in Thunder Bay, Ont.
“It certainly sounds like a variation on phishing,” she says, but notes that it’s unusual because the thief already had Chester’s bank information when he or she sent the text.
“We do know thieves have been known to dumpster dive, and it underlines the importance of having a paper shredder in the home and in the office. We need to treat our personal information like cash.” For that reason, experts advise leaving your Social Insurance Number card and birth certificate in a safe place at home, since thieves can do a lot of damage with your name, birth date and SIN.
The Canadian Anti-fraud Centre, jointly managed by the Ontario Provincial Police, the RCMP, the federal Competition Bureau, manages the central database for fraud complaints. Investigators across the country rely on its vast stores of data to compare notes on mass-marketing fraud and online scams. In 2016, it logged more than 77,000 complaints that resulted in losses of more than $99-million, with the top scams by complaint involving extortion, phishing, and fake computer-service companies. The frauds that resulted in the most money lost were romance scams, at more than $20-million.
Though Gunson could not begin to guess how criminals got Chester’s information, she said it is important never to leave a paper receipt of a transaction in or near the banking machine, and to use online banking to check balances, rather than printing them out at ATMs.
“When it comes to identity theft and identity fraud, the difficulty is in pinpointing the source. Unless (investigators) find a boiler room where people are mass producing ID, it is difficult to determine on an individual basis where it is coming from.”
The good news is most cases of identity theft and identity fraud result in little financial loss to the victims, but Gunson says it takes time and effort to untangle the mess.
In Montreal, actor Paul Burke figures someone used a surveillance camera or fake keypad or card reader to obtain his PIN, which they used to empty his account of $700 in the summer of 2010. He called the bank, which contacted the RCMP. And then he waited.
“ I called them back after a week and I said, ‘I have zero money. I need my money back,” says Burke, 48.
Within a day or two of that call he had the money in his account, but to this day he has no clue what happened.
“It was so bizarre. I consider it a one-off, but obviously I should be more careful.”