Ottawa woman warned BMO of suspected bank fraud, still lost $15K | Page 5 | BMO | Discussion forum

In almost every situation, the client has done something inappropriate: Shared a PIN or had an easy PIN like 1234, does not run malware sweeps regularly or automatically on their devices, has easy passwords for email and banking, does not have the wide range of alerts set up on their email and financial accounts to alert of any activity or change in account, does not use MFA/2FA, or uses public computers for email and banking, and first and foremost cannot resist the tendency to click on unsolicited links in their text messages and email that puts malware on their devices to begin with!

kelbee said
I don't think anyone should be too confident their computer doesn't have malware. Consider the Solar Winds supply chain attack. The update was hacked. You dutifully applied the update, best practices after all, and now you have loaded up malware.

Geez even a technician could load a keylogger on your machine, if they will snoop in your photos, I don't think it is not a possibility.  

It certainly is possible but those cases are rare and NOT how the majority if people got malware on their devices. Basically everyone who got scam money will always cry foul and claim they do nothing wrong. Otherwise can’t really portrait themselves as the victim that deserves compensation…

And if a bug in your operating system allows for exploitation by malware, yet the bug has yet to be patched, if even known of, then that should not be on the bank customer.

Which may make one worry about all the bugs lurking in bank systems.

Exactly, making the claim that you are a victim doesn't make it so.

I wish some of the folks on here were running a bank, sounds like I could secretly give a friend or relative my password for him to empty my account and then go to the bank (or maybe to media first!) to be fully compensated as a "victim of fraud" based just on my version of events.

Alexandre said

Does car insurance cover a stolen car even if you left your keys in it?

Whether you left your vehicle unlocked, have a spare key in your glove compartment, or even left the keys in the ignition, in most cases, your claim will be settled.

Society in general seem to be OK with that, when it is car theft. Why are we not on the same page when it is money theft from someone's bank account?  

If insurance can prove that you purposely left the car not locked and key readily available, do you think insurance will reimburse the theft ?
In some cases, the withdrawal happened after successful MFA, or even from the trusted IP, the bank has to draw the line that it past all the test as a legit withdrawal, thus no compensation, same diff.

Alexandre:

If you have account with FI, it is set for online access. I don't know FIs that don't offer online access. Even if you haven't configured it, someone with enough information about you could configure online access to that account, without your knowledge.

I make sure that there is NO online access configured and notes on my accounts to not allow it. I originally signed up for Peoples Trust precisely because they had no on-line access back then!

I do use call-in and touch-tone banking, though one FI uses the same code for touch-tone and on-line, and I can't use touch-tone there as a result. Could someone get enough info to enable on-line banking? Perhaps, though it's getting harder with more questions asked. I also have strong verbal passwords (never recorded anywhere except in one-time-pad encrypted form) wherever they are in use. In one case, I had the agent create a random password by flipping to random pages in the manual nearest them, not tell me what it was, and put notes on my account to that effect.

That someone will appreciate that you check your account status monthly only, when you receive bank statement by snail mail.

I do call in or use touch-tone banking to check accounts regularly, reconciling when the statements arrive.

Also, can you explain how are you paying bills, set pre-authorized withdrawals such as property taxes, receive pension, do grocery shopping?

The same way I always had before the on-line cesspool! I don't use pre-authorized regular payments, paying my bills individually and checking account statuses when I do. Direct debit/credit I call in for. My credit (or debit) card works just fine for shopping. I get my pensions by cheque; they keep bugging me for direct deposit but I say no. I never shop on-line or click on pop-ups or spam.

There's only one payor who refused to send cheques, and I set up a separate account just to receive their cash. As soon as it shows up (by touch-tone) in the account at the predictable date, I drop a cheque off in my local ATM (a short walk) to suck it out. There's never any money there but for an inaccessible account that requires special authorization for withdrawals, which can take a month to fulfill. That keeps them happy with me as a customer though they get no fees from me.

Most of my financial institutions are only used for GICs, only requiring occasional monitoring.

I know I'm not bulletproof, but I do what I can (unless I've exposed too much here...). Oh, and those contactless payments that are guaranteed for zero-loss protection - that's only at the bank's discretion! I'd much rather use a PIN.

RetirEd said
Alexandre:

If you have account with FI, it is set for online access. I don't know FIs that don't offer online access. Even if you haven't configured it, someone with enough information about you could configure online access to that account, without your knowledge.

I make sure that there is NO online access configured and notes on my accounts to not allow it. I originally signed up for Peoples Trust precisely because they had no on-line access back then!

I do use call-in and touch-tone banking, though one FI uses the same code for touch-tone and on-line, and I can't use touch-tone there as a result. Could someone get enough info to enable on-line banking? Perhaps, though it's getting harder with more questions asked. I also have strong verbal passwords (never recorded anywhere except in one-time-pad encrypted form) wherever they are in use. In one case, I had the agent create a random password by flipping to random pages in the manual nearest them, not tell me what it was, and put notes on my account to that effect.

That someone will appreciate that you check your account status monthly only, when you receive bank statement by snail mail.

I do call in or use touch-tone banking to check accounts regularly, reconciling when the statements arrive.

Also, can you explain how are you paying bills, set pre-authorized withdrawals such as property taxes, receive pension, do grocery shopping?

The same way I always had before the on-line cesspool! I don't use pre-authorized regular payments, paying my bills individually and checking account statuses when I do. Direct debit/credit I call in for. My credit (or debit) card works just fine for shopping. I get my pensions by cheque; they keep bugging me for direct deposit but I say no. I never shop on-line or click on pop-ups or spam.

There's only one payor who refused to send cheques, and I set up a separate account just to receive their cash. As soon as it shows up (by touch-tone) in the account at the predictable date, I drop a cheque off in my local ATM (a short walk) to suck it out. There's never any money there but for an inaccessible account that requires special authorization for withdrawals, which can take a month to fulfill. That keeps them happy with me as a customer though they get no fees from me.

Most of my financial institutions are only used for GICs, only requiring occasional monitoring.

I know I'm not bulletproof, but I do what I can (unless I've exposed too much here...). Oh, and those contactless payments that are guaranteed for zero-loss protection - that's only at the bank's discretion! I'd much rather use a PIN.  

Very interesting. I do wonder if this reduces your vulnerability all that much, given that your money is not stored in a physical vault in a bank like in the olden days and that you still make transactions while lacking ability to check cash flows and balances regularly (or get electronic warnings of unusual activity). Suppose there are fewer points of vulnerability, which is probably why you are doing it all in the first place.

My wild guess is that the main risk with this philosophy is the loss of opportunity. Presumably you don’t invest as surely that would necessitate unwanted financial footprint online?

mordko and Alexandre: I'm old enough to be needing a RRIF. I lived through decades of pre-internet life and never saw the need to dive into an intrusive soup teeming with criminals and corporate thieves. I simply never converted to on-line activity when the opportunities were offered. Took no effort at all!

mordko:

you still make transactions while lacking ability to check cash flows and balances regularly

I can check them much more quickly and easily with a touch-tone phone call than by booting up my computer, logging in, running the 2FA, etc.

My wild guess is that the main risk with this philosophy is the loss of opportunity. Presumably you don’t invest as surely that would necessitate unwanted financial footprint online?

Investing, like any other financial activity, can still be done offline. That's how it was always done before. Being old, though, I avoid risk these days other than some shares at a couple of credit unions.

Alexandre: I, too, have no social media presence and never let my real identity appear on line. I'm careful about social engineering, but once came pretty close to being a "grandparent scam" victim despite long being aware of it; the caller was a perfect match for a known and trusted person - whether accidentally or by AI voice I do not know. I caught on when they asked me to send money to a lawyer, not a court or police agency. I asked for the supposed victim's last name and they hung up. I urge you all to watch the news and consumer affairs shows, and to check in with the Canadian Anti-Fraud Centre regularly: antifraudcentre-centreantifraude.ca/index-eng.htm

And of course I use a dumbphone and secure my Linux computer with whatever tools I know about. I use a separate computer for all my personal and financial data. (I have lots of them... people throw out or give away computers these days. It's an internet connection that costs a lot!)

savemoresaveoften: I always wear a motorcycle helmet when riding my motorcycle. I have yet to be hit by any golf balls.

A bigger question may be whether a non-online life with respect to financial and other business/transactional matters will be viable in 10 years. Some banks are going cashless/transactionless at the front counter already, albeit some kind of 'phone service' and of course 'ATM service' will still be needed for those without any Internet connected smart devices to pull cash and pay bills. The bigger issue for some will be when/if cheques are no longer part of the payments system.

Germany, Sweden and Norway use almost no written cheques, while Finland abandoned the personal cheque in 1993 and Poland followed suit in 2006. These countries now rely instead on payment systems that are totally electronic.

In 9 years, Canada went from 7.9% cheques to 4.1% cheques. Some countries like India, Mexico and USA have seen far more dramatic changes. The USA, Canada and France are now outliers.
https://www.atlantafed.org/-/media/documents/banking/consumer-payments/research-data-reports/2023/07/14/use-of-checks-in-selected-countries.pdf

RetirEd said
AltaRed: The internet was converted for military use. It began as ARPANET, intended primarily for Advanced Research Projects. Only when it was converted to DARPANET (Defense ARPANET) did it become a military priority.  

Sure, most of us know the origin of the Internet and the adoption/transition to civilian use. I had a Tandy 1000 I think in 1985 and my first Windows 3.0 (IBM clone) computer in 1990. Connecting to broadband in 1997 was a gamechanger.

Just because we all functioned without any of that pre-Internet days does not mean we should not have become more productive and efficient with technology. Productivity improvements from technology and innovation are responsible for most GDP growth. We went from desktops that we could not put in our pockets, to laptops, to tablets and now smartphones to optimize productivity.

The next step is AI if we can harness that effectively where our devices know what we want before we know we want it. That may well develop enough by the time I become relatively incompetent in perhaps circa 10 years that it will allow me to be more independent than I would be otherwise.

Same with new payment processing systems and open banking in Canada that is all unfolding here within the next 5 years. Canada is well behind other primarily European jurisdictions, but some Asian ones too (as noted by my links above on changes in the use of cheques). I think we should be embracing change, not rebelling against it.