Wishing you all a HAPPY NEW YEAR… It’s definitely time to BE AWARE … 2 Very Real Stories as Warnings!

As we welcome a new year filled with hopes and possibilities, it’s crucial to stay vigilant about the rising threat of scams and identity theft that continue to plague our digital and financial lives.

These crimes are not just statistics—they are deeply personal invasions that leave lasting impacts. Consider these two stories: One individual faced a devastating “Complete Takeover” of their bank accounts. and another fell victim to a seemingly innocent email thanking them for renewing a McAfee subscription they’d never purchased.

STORY #1

The Journey From Having My Bank Accounts Hacked to Laughing Out Loud Written by an Anonymous and Concerned Reader

What follows is an account of a devastating turn of events that occurred this year in what my local bank referred to as a “Complete Takeover” of my accounts, followed by the revelations that I encountered about the state of our banking, and ending with a surprising belly-laugh.

I will not share my identity in order to lessen the risk of further defrauding attempts.

A man showed up at a Montreal branch of Scotiabank. He showed identification that suggested he was me. He told them he’d just retired and moved from another province. He proceeded to open a new Business Line of Credit under my name and proceeded to transfer nearly $50,000 from my existing Line of Credit to this new account. He transferred $3000 from one of my accounts into this Business Line of Credit. He then proceeded to physically withdraw $10,000 from that account. That’s when the Fraud Department called me to ask if I had just made such a withdrawal in Montreal. I noted that I was still in my home province. The worker suggested that I would be liable for the withdrawn funds. I adeptly informed her that I would not be paying for their lack of competence in defending my money. She suggested I go to my home branch as soon as possible.

I arrived at the branch with my wife. The competent teller before me quickly assessed the situation. I asked her to relay what she was seeing on the screen, as she had a puzzled look. She told me that the fraudster got my mother’s maiden name wrong but was allowed to proceed regardless; this being the central point that I would later stand on as the basis for my claim. She slipped me a piece of paper and asked me to write my mother’s maiden name which I did and she confirmed that this was correct.

I asked her to quickly empty my other bank account, which had not yet been touched and contained $10,000. She prepared a bank draft and handed it to me. Suddenly, my phone beeped and I was alerted by Scotiabank that an attempt to withdraw $100.000 from a Line of Credit was just made in Montreal. I noted to the teller and Assistant Manager that this obviously was not me. I suggested they contact the Montreal branch to let them know the fraudster was perhaps still in building, which they did.

The Assistant Manager told me that the bank has six weeks to sort through the matter and to make a determination on the fraud case. She also noted that they deal on the basis of “Shared Responsibility”; a term that struck a shock wave down my spine as I felt that I was suddenly speaking with an insurance agent after a claim was filed. I reasserted that ‘I’ was the victim in this and that it was ‘they’ who faltered by letting him into my account!

I cancelled the credit cards and Lines of Credit with Scotiabank while standing there. I left only one account open, one that was so old it would not pair with the new card which meant that I could not use it as a debit – an nor could any fraudster. I further cancelled all online and telephone banking.

I suddenly realized that I had to augment their system’s consumer protection facets in order to make my account secure. I had them write a note on my profile, which any teller in their company would see, that I only authorize in- person transactions on this account that occur at ‘this’ particular branch. I had them write out a physical description of me that I provided. I noted that much of this would have been avoided if they included a picture of clients in their file so that in-person fraud would be negated. In the absence of that, I gave my written description and a link to my website which contains a photo of me; their client.

I contacted Equifax and Trans Union as per their suggestion, to let them know of the fraud.

After several hours at the teller, with her diligently working with the Fraud Department to separate purchases made from my accounts by me versus the fraudster, we left. We were frazzled and felt a level of insecurity like never before. We had to now rethink all of our financial arrangements that were handled through auto-deposit and automatic payment arrangements and fashion new arrangements with all such businesses.

I determined to leave only $150 in that account, an amount that would ensure that I not get daily reminders of the sub $100 balance. I would bring cash to the bank to have them forward money to any business that I could not pay in-person directly. This arrangement took many hours to transition from direct-withdrawal arrangements but once it was complete I felt much more secure.

Several days later, we went to a different bank company which was also in a different community. I deposited $500 into each of the three accounts that we had set up. We applied for a credit card from this institution. After a few days of there being no infringements on our new accounts, we deposited the $10,000 bank draft from Scotiabank.

The next morning, I woke up to a notification from the new bank saying that all of our money was gone and that my contact information had changed; my new address was in a third province and my listed phone number had changed!

I quickly contacted the new bank and made plans to come in immediately. I learned that the teller should have encoded the money order in a way that would put a three-day freeze on it, but did not do so, leaving the funds accessible to the fraudster. This bank quickly acknowledged their error and reinstated all funds within a few days.

I soon realized that the police had not been contacted by Scotiabank, nor by the new bank. I phoned two provincial police department detachments, covering the regions for each of the banks. I was then put in contact with a third regional police expert who specialized in fraud and who could devote more time on these matters. I learned a lot from this contact.

He, too, had been the victim of fraud. (The Scotiabank Assistant Manager had been the victim of fraud three times!) Most banking employees and police that I spoke with told me the same thing; that fraud is spiking as a major concern for them lately.

I learned that a person can get a copy of someone’s driver’s license and other material online, in a format where they can insert their own photo, for just $400. I was informed by police that, for between $50-$200, someone could also get our passwords. Additionally, control of someone’s computer or online banking device could also be purchased so that the transactions made would appear to come from our devices! All of this can be made available as a package! Recalling how I was told by bank personnel at Scotiabank that they deal in ‘Shared Responsibility’, I quickly realized that trying to convince the bank that online transactions that came from our computer or device’s IP address were Not ones that we made would be an uphill battle and that clients would be put in a ‘guilty until/unless proven innocent’ scenario.

I recalled how, in reading through Policy and Procedures manuals at places that I’ve worked, I read that the agency must ‘destroy’ the photocopier’s hard drives and not just ‘delete’ files on them, given that there are ways to ‘undelete’ hard drives. I was mindful of how many of us hand over our driver’s license to car rental, U Haul or hotel businesses and of how valuable any of those copiers might be to fraudsters. It would not be difficult to imagine how easily they could be secured for this reason. My eyes were being opened.

I also learned that the fraudsters may be operating as individuals but also work in teams.

I do not recommend doing what I did next. Sitting there with the fraudster’s phone number, I took the opportunity to call the number. It rang. He picked up. I asked who he was. He recited my name back to me. I asked how he liked Montreal. He started to tell me that he did then caught himself and stopped. I told him that there are three provincial police departments who are after him and that they also now have both his phone number and his address. I said that they’ll be coming for him. I told him to have a nice day and hung up. (The address change on the new bank was done so that the new credit cards would be forwarded to his home, which I interpreted as being a rookie mistake.)

The next day, I got a call from another lending institution; one that was near the address that I had for him and in that province. The banker didn’t seem to take the matter too seriously at first, stating that he was going through the formality of calling me directly given there was a fraud-alert note on the Equifax file. I suggested to him that it was likely a good thing for him that he did, as the man before him had defrauded two banks of over $60,000 and that he might be wise if he did Not lend him any money today. The banker suddenly let out a “Wow!” I suggested he might also consider phoning the police department in his area. He thanked me and we ended the call.

A few hours later, I got a short call from the fraudster. He said that he was not done with me yet, and then hung up. This gave me some satisfaction. I told the bankers that they are left playing ‘defense’ rather than having any offensive play on the matter. This chap will now be wondering if/when the police will be showing up at his door. I do not know if that banker phoned the police. He did not return my phone call or that of the investigating officer.

During my many calls to Scotiabank’s Fraud Department, I had to answer three Security Questions to validate that it was actually me calling. I was, at one point, asked if I would like to switch to Voice Recognition verification as part of their vetting. I agreed. I later asked someone, off the record, if that was indeed ‘more or less secure’ than three questions. My suspicions were confirmed by this expert that the three questions would be more secure. I phoned Scotiabank back again to say that, for the sake of security, I would like them to use Both the three questions and the Voice Recognition. I was told that they could only offer one of the two options. I quickly surmised that moving to only Voice Recognition would appear to be a cost-savings venture by the company (with this person no longer employed) while concurrently lowering the threshold of security that someone might have in getting into my accounts. I instructed them to revert to the three questions.

I later realized that, once a fraudster learns the answer to their standard set of questions, in regards to a victim’s presentation, the ‘three question’ hurdle is no longer a safety mechanism. Given this, I presented the bank with a list of highly personalized questions and answers that could not be looked up in any birth/death registry. I was informed that they would not allow for personalizing security questions, as some other financial institutions do. This, along with the lack of a photo of their clients or any other modern method of verifying that a person is who they say they are, does not reflect a company that is rising to the threat-occasion that they are experiencing with the rising frequency of fraud.

Before this started, my unused Lines of Credit and strong Credit Score were seen by me as ‘assets.’ Given the new reality of rapidly rising fraud cases, I now see them as ‘liabilities.’ Note: the Line of Credit that he stole from was attached to my home as collateral. I could have lost my home… That sobering thought shook me to the core and caused me to change how I use, or don’t use, banks going forward. If I continue using the same practices then I would blame myself for not having learned what this matter has taught me.

For the fraudster, and future would-be-fraudsters, I initially presented as a ‘good yield/low risk’ banking target. I’m now a ‘near-zero-yield/very high risk’ banking customer/target.

I will no longer trust the banks to do that which they are unable to do; to provide adequate protection for my money – either in an online format or in-person. I had read that there is a Class Action lawsuit against another bank for similarly failing to protect customers’ accounts from fraudsters who gain access to the accounts and etransfer tens of thousands of dollars out of province. I learned that the provincial police tend to operate independently and that this is a barrier to them mobilizing their efforts on such matters. I learned that the criminals take advantage of this.

I have found the front line tellers that I have met in my branch to be very good and caring people; something that I have intentionally mentioned to their supervisors. I learned that the person who let the fraudster into my accounts in Montreal is no longer with Scotiabank.

Scotiabank took much, much longer than the six weeks to settle my account. The Credit Line portion was resolved by the Fraud Department within that time however the missing $3000 from one of my accounts was one that was not resolved more than two months later. I had made over a dozen in-person queries when I was in the bank (which was daily for several weeks), sent emails and phone calls; few of which were responded to despite being told they would get back to me in a few days. Only after I made an in-person formal appointment with the branch’s Manager did the matter get resolved within an hour. It appears the Montreal branch had received that portion of the resolution from the parent company as part of their reimbursement monies earlier but had not released the funds to my local branch or made them aware of same until the point was pushed forward by my branch’s Manager. They were not returning calls to my branch’s Assistant Manager, putting her in a precarious position. Given such behavior, deliberately avoiding calls from my branch’s Assisstant Manager, I have serious doubts as to whether they might have volunteered that their employee failed to adequately screen the fraudster which would have left me in the dark on the matter.

Incidentally, it was suggested to me by the police that I would eventually get my money back because I was “smart” and understood systems. He noted that many people feel intimidated and roll over when banks make their decision. It opens the question as to how much the bank profits from such situation. I speak from experience given that I received a banking statement from Scotiabank in the weeks after this started, noting that I owed the interest on the money that the fraudster had withdrawn! They quickly withdrew that request when I challenged it. However, in the milieu of ‘shared responsibility’, when a customer cannot prove that the transactions did not come from themselves, how many people are left ‘repaying’ amounts that have been taken from them by fraudsters simply because they lack the resources or assertiveness to challenge such decisions? How much profit is then made, rather than loss, by the bank when a customer replays both the stolen money as well as the interest on the ‘loans?’

I am not sure as to whether my Social Insurance Number was used in the fraud, as Scotiabank has not responded to my direct inquiry on this. I was informed by the Ministry that I would require a letter outlining the fraud from both the bank and the police department should I wish to get a new number. I am currently in the process of seeking such a letter from Scotiabank though this too is taking weeks. In the interim, I hope that my information is not reused to successfully set up loans elsewhere.

The question of how well supported fraud victims are, following the events, is one that might be of good review by journalists.

I had been hounded by what purports to be a Montreal based Credit Collection agency for the repayment of the fraudster’s withdrawals. When I finally had contact with the Montreal branch manager via email, I asked that he contact them directly to halt such actions, if indeed they were a legitimate agency and if they were subcontracted by the bank. I heard nothing further on the matter from either the bank nor this agency following that email; the calls had stopped.

I learned, and let Scotiabank know that I was aware, that there are two levels of appeal within the banking system itself as well as an Ombudsman type of appeal, should I not agree with their (biased) findings. I also learned that I could take them to court.

I was very surprised to learn that the banks do not contact the police when fraud occurs. Police informed me that I was the victim, should my money not be replaced, and that the bank doesn’t typically seek out their services but has their own internal mechanisms.

I learned that the bank personnel in Montreal who let this fraudster in was ‘no longer with the company.’ I was not informed as to whether their dismissal was due to collusion or incompetence. Regardless, that information only served to help Scotiabank.

I then put it to the Manager that in my work I have offered a client several hundred dollars worth of free service when I once missed an appointment. I noted that I told my client that I valued her time and that, in addition to the day’s free service on her appliance, she had my profound apology for wasting her time the morning that she waited for me and I forgot to show up. He agreed that this was a good example of ‘ethics in action.’

Given that, I said “Now I put it to you sir, how will your company demonstrate to me their ‘ethics in action’? I noted that I have, because of their company’s human error, incurred many sleepless nights/many hours attending their bank/many hours communicating with each of my payees to make different payment arrangements/taken care of myself and my wife’s emotional journey through this horrendous chapter/etc.

I noted that the repayment of funds to my accounts was the minimum that a company should do for a client that has suffered due to an act of negligence. He agreed and sent the request for this question to be vetted by his superiors.

I would note that an entity which offers some form of proportional atonement for the harm that they have done should be regarded as one with positive character. One that fails to do so, while concurrently basking in billions of dollars of profit from its clients, would be one whose character is sorely lacking.

It has been several months since that request was sent and then it came! The answer to how much Scotiabank values me as a 40 year customer whose life was upended by their employee’s negligence was now to be communicated to me through their gesture of good will and ‘ethics in action’! I had received the grand sum of $200.00 (two hundred dollars)!

With that, I let out a huge belly laugh when my branch manager told me of the company’s decision! I apologized to the manager for laughing so, in the face of being offered some form of ‘compensation’, which they dubbed a courtesy amount, though I shared the humour that I see in the situation. He offered to re- approach the topic with the company but I said, “No. It ends here.” Their actions have told me all that I need to know of the company’s character and how they value their customer’s time and suffering when they err.

I will again note that the staff at my local branch revealed themselves to be very supportive and kind throughout this six month process.

I would say that there should be a standard checklist of statements that every defrauded banking client receives from the bank itself; one that is made mandatory by legislation. This would include such things as;


— We will not be contacting the police but you might wish to do so

— Contact Equifax and Trans Union

— We will have six weeks (or similar) to come to a determination

— Should you not agree with our findings, here is the appeal process within the bank itself

— Should you not agree with the appeal process, here is the Ombudman form of resolution

— You may consider legal action against the bank

— You may expect responses from our staff within 48 hours as per our Policy and Procedures

— We have a Service Complaints procedure for customers should you wish to use it at any time

Some advice that I might offer you, though not an extensive list would be;
— Don’t use online banking

— If you’re using online banking, ‘lock’ your credit cards when not in use

— If you can’t change the security questions, you might consider using a nonsense form of response that only you will know

— Set limits on Credit Cards and instruct them that only in-person changes are approved by you (Have the bank write it on your profile.)

— Close lines of credit or credit cards that you are not using. You can always apply for them should you later need them

— Use Pre-paid cards where possible.

— Fully shut down your devices at night, as some viruses get shut down when you do so.

— Assume that your identification is already out there, awaiting purchase by a fraudster, and act accordingly so that your vulnerability is diminished

— There are now ‘non-click’ viruses that don’t require you to click a malware-infested link. They can let themselves into your device and delete themselves on the way out, after gathering your passwords. Consider this when weighing the cost-benefit of online banking.

— Use cash as much as possible.

— Keep a paper copy of your passwords, hidden, and change them frequently.

— Do not reuse passwords for multiple reasons as that reduces their effectiveness

— If you use a home safe, bolt it from the inside into the floor or wall stud so that it cannot be taken away

— Consider using Safe Deposit Boxes, given the personnel have to vet you and that you each have a unique key to open the box. Consider converting cash to gold or such so that it will appreciate in value while in storage.

— Consider using Equifax or Trans Union’s fee-for-service alerts that protect against someone opening up an account in your name

— Consider the very low rates of interest that bank accounts give. Then consider the effective rate when you have reduced the savings earned by the service fees to determine whether they are financially worth having, let alone the increasing risks as noted above.

— Set your phone to direct any unknown callers to voicemail so that fraudsters will not readily record your voice pattern. Similarly, use the default answering message from your phone service company so that your voice is not recorded. Consider deleting online videos of yourself speaking for the same reasons.

— Pay as many as possible directly to the companies to minimize the reliance on the increasing vulnerabilities within the bank’s ability to protect funds from fraudsters.

— Enjoy getting to chat with people at the businesses you use, when you go to pay them directly. Enjoy chatting with the bank tellers when you go in to use their services; for both social reasons and for them to recognize your face.

I’ve noted to bankers that although the bank’s profits are so rich that they are
absorbing fraud losses, with their description of how fast fraud is rising they will soon risk losing market share/clients. I found that it is common for people to tell me of how they, too, have had some form of being hacked in regards to their credit cards or their identity.

My intention is not to scare the reader; though the subject matter itself is scary.

I hesitated to write this article, weighing the benefit to the reader versus the risk of informing someone who might wish to use this information to become a fraudster. In the end, I read that there is ample information in the media to warrant joining the efforts of arming people against the new risks that we are facing.

I now have a system in place that protects me against anyone who has $450 and wants to begin defrauding, and those more experienced. I’m glad for the lessons that this fraudster’s actions have taught me and that I have learned them at a time when my mental faculties are intact.

The laughter that I had at the bank the other day was perhaps a blend of the humour that I saw and an emotional release.

I wish you well and hope that you safeguard your family and business funds wisely given the new reality that we are in.

STORY #2

How I got scammed on December 4th, 2024

Written by an Anonymous and Concerned Reader who thought that she was dealing with McAfee – an American global computer security software company, when really she had been caught in a scam.

When I opened my emails there was one that said thank you for renewing McAfee for another year at $399.99. SO… in fear of being charged $399.99 for something I had never dealt with and certainly couldn’t afford, I got caught in a scam and I ended up losing $9,500. Through the sheer innocence of trust, fear and stupidity.

1st- the message from McAfee in my email said, call this number if you haven’t taken this action.

2nd – I called the number, and was told after being referred to another department that it could be returned to my account. Of course there were questions about which account I used for my transactions, and stupid me said chequing and let them access my account, even getting me to change my password which wasn’t being accepted. All were actions that I took at their directions. I even told them that I only deal with PayPal, so the PayPal logo showed up in the corner of the next screens they showed me, saying I was talking with a PayPal rep from Florida…Then I was told that I would have to fill a certain form which they brought up on my computer. I was told to be very careful in filling the information and not make any mistakes… of course a mistake was made [but not by me] so now they showed me that $10,000 had been deposited in my account because of my mistake.

Hook, line and sinker??? I felt so guilty and was so confused by then that I was hooked. They had me…Convincing me that I couldn’t close the phone connection or they would lose their money… telling me that the only way of returning it was to go to the bank and take it out of my account, make up a story to tell the teller as to why I was taking out that large amount, so with a hint from him I told the bank teller that I found a good deal on a car for my husband and I had to pay with cash….I was told again and again that the bank would lock my account if I moved the money… so with the phone line still open all the way to the bank and money in hand I had to go deposit it in their account at a special ATM, the only one being at the Petro Can on Vincent Massey. When I saw that it was a bitcoin ATM I told him that I wasn’t liking this at all… but of course he told me that it was the only way to return “their” $10,000…

Of course the Teller at the bank had given me all $100. bills and I had to put them in one by one in the machine and after every 6th bill to scan a new QR code…………..but keep $100 for myself for all my troubles, my honesty and my kindness for making sure he didn’t lose his job…Red flags??? Red flags??? Red flags??? Red flags??? So many…

How could I be so dense. Messages of scam kept coming up but I was fearing having to pay for the darn bill from McAfee and how to pay them back for my mistake. In retrospect I feel like I was hypnotized because I was in a trance that I couldn’t shake.

P.S… I have since learned that the $10,000 was taken as a cash advance from my own Line of Credit I now have to change my banking info, my cell phone info, my passwords, probably even my email address. The $10,000 is more than half of the little nest egg I was keeping for emergencies. Retired with only a government CPP and Old Age Pension to count on, I will never be able to replace that money, it makes me mad and very sad.

In retrospect: *I had never dealt with McAfee I should never have phoned and engaged.

*how did I not know that I was giving them access to my banking

*why didn’t I phone my bank << thought of it and tried but of course when you call the 800# you get a computer with all kinds of questions before they link you>>

*I was kept on the phone the whole time with an Adam Stevens @ PayPal in Florida??????? even on my ride to the bank to withdraw the $10,000…

and why didn’t I refuse to use a Bitcoin ATM

These experiences serve as sobering reminders that scams can happen to anyone, anywhere. As we move forward into 2025, let’s prioritize educating ourselves and sharing knowledge to protect each other.

Have you or someone you know fallen victim to a scam or identity theft? Sharing your story might help others avoid similar pitfalls. Let’s start the conversation—because awareness is the first step toward prevention. You can Email us at: [email protected]