Ottawa woman warned BMO of suspected bank fraud, still lost $15K | Page 4 | BMO | Discussion forum

If etransfer was used then defrauded customers must have received an email notification after each transaction. Did they raise alarm after the first transaction?

Preventing phishing attacks from someone who knows your social media friends and relatives can be really tough. Closing public access to that kind of information must be the first line of defence.

Completing training courses on phishing is well worth it.

Another inevitable question is whether some of these were “inside jobs”. Thats a scary thought.

Post #62 already linked the CBC story. FWIW, I would be surprised to see any legal firm attempting to take this on as a class action, at least not on contingency. The evidence, as we know it, does not support it.

Okay, I understand that once someone has the right login credentials, alerts wouldn't have worked in this instance. BUT someone representing her with her correct login and security credentials had the e-transfer limit raised.

It keeps coming back to people who are not taking ownership for the integrity of security on their devices, including malware such as keyloggers.

I would like this case to actually go to court and see all the gory details to be spilled. It might be the only way to encourage improvement of security algorithms on the bank's end and wish-beyond-wish that people will take more responsibility for security of their devices. The amount of sophisticated phishing that comes to me via SMS texts and emails almost every day is astounding. People have to stop clicking on links!

P.S. Another mitigation option: Don't do business with FIs that do not have all the right security selection options in place. FWIW, BMO has a ton of them if people would be willing to avail themselves of them.

Again missing the point for some reason.
Banks need to be forced to allow people to put certain limits on their accounts, and to disable things like Global Money transfer if they don't want it. They need to increase security.
But banks do not want to do this, as it costs them more labour costs to deal with customers, and validating them, its more friction.
The banks want to move everything to AI and if you get robbed for 100K, tough for you.
BMO has absolute gaping holes in their security, and yet people are still defending them. Better hope it doesn't happen to you for some karma.

Not sure I understand what would be the point of disabling Global Money transfers.

Before transferring, one has to add recipient details, complete 2FA, etc. If a malicious actor can do all that then he can surely enable Global Transfers in the first place. Or he can use another Canadian account for moving money, eg with one of numerous international money transfer companies like Wise.

This court case is probably a good thing. Hopefully we’ll find out the actual mechanism for money leaving the accounts and whether there was a specific action by individuals which left accounts vulnerable. Also, if the bank left its system vulnerable.

My wife was a victim of something similar a couple of years ago with Meridian. It was a freshly opened account. Suddenly she received hundreds of spam emails within a short period time. Then she got a message about this etransfer, I think it was $2K. Thankfully she spotted this notification email among all the spam. We got on the phone with Meridian. While we were on the phone talking to the rep who was in the process of locking it, we saw account balance change as two more transactions left the account.

Meridian refunded the funds. No quibbling. We had laptops and phones checked professionally. No malware identified. I can’t help suspicions that this was an inside job.

Financial Institutions love trying to download responsibility to clients. Many say it is the responsibility of the client to keep up to date on the latest security information. And, to be sure, there's no way the FI can protect unknown systems from attacks... but security is a constantly-evolving cat-and-mouse game that most "normal" people simply have no hope of winning.

At the least, new or zero-day attacks that are the result of poor planning or attention to detail by the FI should be refunded.

As you all probably know by now, my approach is to not allow any online access to my accounts. And anything done by FI employees rather than myself is easy to blame on them, not me.

Nothing's perfect. I do what I can.

RetirEd said
As you all probably know by now, my approach is to not allow any online access to my accounts.

If you have account with FI, it is set for online access. I don't know FIs that don't offer online access. Even if you haven't configured it, someone with enough information about you could configure online access to that account, without your knowledge.

That someone will appreciate that you check your account status monthly only, when you receive bank statement by snail mail.

Also, can you explain how are you paying bills, set pre-authorized withdrawals such as property taxes, receive pension, do grocery shopping?

RetirEd said
Financial Institutions love trying to download responsibility to clients. Many say it is the responsibility of the client to keep up to date on the latest security information. …

Responsibility has always been a shared one. Client can't be irresponsible, suffer a loss, and expect the financial institution to make up the loss.

Cases like this show that some clients don't take their share of the responsiblity seriously:

OBSI: Giving Your PIN to Your Friend
Posted Friday, November 12, 2004

A client and his friend went to a night-club one evening after having several drinks at home. The client was intoxicated by the time they arrived at the club, but he ordered and paid for a round of drinks. He then left his wallet containing his bank debit card on the table while going to the washroom. When the client returned to the table he did not notice that his wallet was gone. Shortly afterwards, the client and his friend left.

The next morning, the client realized that his wallet was missing and reported it to the police and to his bank. The bank immediately cancelled the debit card, but $800 had already been withdrawn from the client's bank account.

The client later identified his friend as the thief from photographs taken by a security camera at an automated banking machine.

When the friend was interviewed, he told us that during the evening the client had boasted that he had plenty of money in his account and had told the friend his PIN. The client denied informing his friend of his PIN, but admitted that he had been intoxicated and did not recall many of the events of that evening at the night club.

It was a clear case of failing to protect the PIN by the client, and we did not recommend that the bank reimburse the client.

(2004)

Some clients will go as far as lying afterwards about the bank staff not warning them about possible fraud:

OBSI: Senior Falls Victim to the Grandparent Scam
Posted Thursday, July 18, 2019

Key lessons

• Bank staff are aware of the tactics commonly used by scammers and will do their best to warn customers when they suspect fraud is taking place. If your bank warns you about a transaction you are trying to complete, have an open mind and take their warnings seriously.
• The bank is not responsible for losses that result from a consumers’ own actions.

An elderly woman, Ms. W, had a grandson living overseas.

In September, Ms. W received a phone call from her grandson, who had been teaching English in South Korea. He indicated that he wished to move to China to continue teaching, and requested financial assistance from his grandmother for the move. As she was close with her grandson and helped raised him after the death of his mother, Ms. W wanted to help. Through her local bank branch, Ms. W sent a wire transfer to her grandson for $35,000.

In October the grandson phoned again, telling Ms. W he had been in a car accident, arrested for drunk driving, and needed bail money to get out of jail. In a later call he told her he needed additional money for legal counsel. Concerned for his safety and well-being, Ms. W wired additional money to China. Combined with the original transfer, Ms. W sent $123,000 to her grandson.

At Christmas, Ms. W's grandson came to visit. When asked about his troubles, the grandson said he had not relocated to China, had not been in an accident, had not been in jail, and had not called asking for money. Ms. W realized she had been the victim of a fraudster. She immediately notified her bank, but the criminals had disappeared and the bank was unable to retrieve any of the money.

Ms. W complained to her bank that they did not properly inform her of the risks associated with the wire transfers, and demanded compensation for her losses.

The bank declined. It explained that bank staff had cautioned Ms. W about the possibility of fraud and even offered ways to mitigate the risks on numerous occasions, to no avail. Unsatisfied, Ms. W brought her complaint to OBSI.

Complaint not upheld

During our investigation, we interviewed bank staff who recalled raising a number of concerns with Ms. W.

Ms. W had instructed the bank to prepare wire transfers to recipients other than her grandson. She had told bank staff that her grandson could not travel to a bank and that the money would instead be delivered by a friend. Bank employees were wary of this story and explained to Ms. W that fraudsters often employed such tactics. They suggested that Ms. W, at a minimum, include her grandson's name in the payment order or send the funds to him “in trust". However, Ms. W declined to take these precautions.

Each time Ms. W went to her bank to make another transfer, branch staff asked if Ms. W had confirmed that her grandson received the money. They also repeatedly warned of the possibility of fraud. Each time, Ms. W indicated her grandson had received the money.

Our investigation concluded that the bank acted appropriately. It had warned Ms. W multiple times that sending the money via wire transfer as she had instructed would leave her vulnerable to fraud. The bank also provided advice on how Ms. W could mitigate the risk, advice that was ignored. OBSI did not recommend the bank compensate Ms. W for her losses.