TD Bank customer lost $480 after e-transfer cancelled — despite having autodeposit
Erica Johnson, Kimberly Ivany | CBC | Posted: March 6, 2023 9:00 AM | Last Updated: March 6, 2023
When is a 'confirmed' e-transfer not really confirmed? Go Public puts it to the test
Christine Mason of Edmonton says she was pleased last September when someone wanted to buy the power tools she'd advertised on Kijiji — a cordless grinder, charger and two batteries.
A man who said his name was Steve said he'd head over after work and would pay $480 by e-transfer, since he didn't carry a lot of cash.
"It sounded plausible to me," said Mason. "He was in the trades and I thought, 'OK, that's fine.'"
After inspecting the tools, "Steve" opened a banking app on his phone.
Mason entered her email, watched him type in $480 and hit "send." She then read a confirmation number, indicating the transaction was done.
She'd set up her TD Bank account with autodeposit — a feature designed to protect against the risk of fraudsters intercepting funds, because money is directly deposited into an account, with no additional steps needed, such as answering a security question.
- Got a story you want investigated? Contact Erica and the Go Public team
Autodeposit is advertised as being "fast" and "secure." Mason added it specifically for the e-transfers she'd get selling items online, so she was confident the money would soon show up.
It never did.
A Go Public test has since found that some e-transfers can be cancelled, even when the recipient has autodeposit, depending on what financial institution the money is sent from.
A software engineer who's worked in fintech and banking says the Interac system — used for e-transfers in Canada — "is not bulletproof."
"It's good for people to know that there's risk involved," said Mattias Eyram, who's studied how money gets transferred from one financial institution to another.
"You're not really protected until you've seen that money settle inside your account [by checking your balance]."
That's not how e-transfers are promoted online by the big five banks — Bank of Montreal, CIBC, Royal Bank, Scotiabank and TD.
All of them call e-transfers "safe" and/or "secure," with no mention of the possibility the sender might stop the transaction even after the transfer appears to have been completed.
After "Steve" drove away with the tools, Mason checked the banking app on her phone, expecting the notification of deposit to show up any minute.
"I was checking constantly," she said. "It kept me up all night."
By morning there was still no notification, no money in her account. So she called TD.
She says she was told $480 had indeed been earmarked for her account shortly after 9 p.m., but the transaction was cancelled about 90 minutes later.
The customer service rep also said the sender's first name was actually Riley, not Steve, but couldn't say where he banked, for privacy reasons.
Mason says she was repeatedly put on hold and then told to go through the bank's fraud department. "And then the conversation was cut off."
WATCH | E-transfer quietly cancelled:
At her branch, she was told to call a toll-free customer service number and that's when she learned something surprising.
She says, on the call, a manager told her that e-transfers — even to accounts with autodeposit — can sometimes be cancelled, even up to 24 hours later.
"I was so shocked," said Mason. "Even when you're on hold on the phone [with TD] it will say, 'Consider doing autodeposit because it's safe' … that's what's so frustrating."
She says the manager said TD wasn't the problem — the bank has safety protocols for e-transfers. Once its customers hit "send" to an account that has autodeposit activated, they can't cancel the transaction.
On the other hand, he said the bank has no control over safety protocols at other financial institutions and some allow customers to cancel e-transfers after they've been sent.
"You're constantly being told … this [autodeposit] is the best way to go," said Mason. "It's just false advertising."
Mason filed a report with the Canadian Anti-Fraud Centre, and says she spent countless sleepless nights, searching websites like Kijiji, Facebook Marketplace and Craigslist, to see if the scammer would post the power tools for sale.
"I don't think people really realize how much effect it has on you. I could not let it go," she said.
After Go Public contacted TD about Mason's case, the bank deposited $480 into her account as a "goodwill gesture."
E-transfer test
Go Public tested how easy it is to cancel e-transfers after they're sent.
We first asked customers with the big five banks and a few credit unions to e-transfer $5 to an account that required a security question be answered to enable the deposit.
In all cases, senders were able to cancel the e-transfer until the recipient had answered the security question. Such transfers expire after 30 days.
Despite that, every financial institution showed a notification indicating the transaction was completed.
"There's definitely a mismatch there, of what's actually happening and the information being displayed," said Eyram, the engineer and fintech expert. He says financial institutions should not tell customers a transaction has been completed until that's actually happened.
In the second part of our test, senders e-transferred $5 to accounts that had autodeposit set up.
When the e-transfers came from one of the big banks, senders never had an option to cancel it.
Some credit unions, though, allowed senders to cancel for more than half an hour after the e-transfer was sent — even though the notification the sender received indicated it was completed.
The would-be recipient was not informed of the cancellation.
"That is very tricky and something that should not be happening," said Eyram.
Mason now believes the man who ripped her off must have sent his e-transfer from a credit union.
"People need to know about that," she said. "Close friends of mine, they're shocked."
Eyram says, generally, the Interac system is fast and efficient, but there's an uneven playing field.
E-transfers are "as safe as whatever the sender's financial institution is and the receiver's," he said. "You can't just trust your own bank, right? You have to trust the sender's."
A spokesperson for Interac declined an interview request, but in an email Adrienne Vaughan wrote that the length of time for a transaction to complete is not related to the size of a financial institution, or whether it's a bank or credit union.
"It is more related to the fraud checks happening by the sending and receiving financial institutions before the transaction is approved," wrote Vaughan.
"Each bank or credit union makes their own decisions regarding which checks to complete, and therefore how much time might be required."
Since customers generally have no idea that processing times can vary between financial institutions — and that some e-transfers can be outright cancelled — Eyram says he'd like to see banks and credit unions use more transparent language.
"Show a little warning next to the transaction," he said. "'This may take longer than expected' and 'Don't trust that it's there just yet.'"
Go Public told TD about Mason's experience, and the fact that she felt misled by advertising that autodeposit is fast and secure.
Spokesperson Ashleigh Murphy said in a statement that the bank is looking into how it can update language around its autodeposit feature "to clarify all nuances for our customers."
Mason says she's still going to sell items online but from now on, people will have to pay cash — other than close friends and family, she says she's done accepting e-transfers.
"Absolutely not," she said. "Because they can pull it back."
Submit your story ideas
Go Public is an investigative news segment on CBC-TV, radio and the web.
We tell your stories, shed light on wrongdoing and hold the powers that be accountable.
If you have a story in the public interest, or if you're an insider with information, contact GoPublic@cbc.ca with your name, contact information and a brief summary. All emails are confidential until you decide to Go Public.
Follow @CBCGoPublic on Twitter.