Thieves steal millions of PC Optimum points, go on shopping sprees

Lenore Biever lost more than one million PC Optimum rewards points after someone apparently hacked her account and went on a shopping spree.

The points — which are worth more than $1,000 in product rewards — were spent on March 7 at two Loblaws-owned Pharmaprix drug stores in Laval, Que.

Biever lives in Saskatoon and has never been to Quebec.

"I was shocked," she said, after discovering the bogus transactions plus an indication that a mystery cellphone had been linked to her online account. "I'm still in shock, like how did [the thief] figure it out?"

Other PC Optimum members are asking the same question.

CBC News interviewed eight people across Canada who say they've each had more than 100,000 points stolen from their accounts after Loblaws merged its two rewards programs — PC Plus and Shoppers Optimum — to form PC Optimum on Feb. 1.

The reported thefts are just one more problem plaguing Loblaws, which is already dealing with technical glitches with PC Optimum, and fallout from a bread price-fixing scandal, including related fallout over asking some people to send ID to collect a $25 gift card as compensation for the overpriced bread.

In the theft cases CBC News investigated, many of the stolen points were redeemed for products at Loblaws-owned stores in Quebec.

All the complainants reported what happened to PC Optimum, but they told CBC they were having difficulty getting their cases resolved. After CBC News contacted Loblaws this week, almost everyone quickly got their points back. 

Biever says she first reported the theft to PC Optimum on March 8, the day after it occurred, and was assured the matter would be dealt with.

​"It's scary," said Biever, who has her PC credit card linked to her account and was worried about her personal data being compromised. 

Four days later, she received an email from the program stating that it had reset her account password after noticing "some unusual activity." It said if her account had been hacked, the culprit would have been able to access her name, address, phone number and points balance.

However, the email said there was no evidence of any "unauthorized activity."

"Are you ... kidding me?" said Biever. "I couldn't believe it."

She called PC Optimum to explain once again that her account had indeed been compromised and that she wanted her points back.

"I'll phone them every day if I have to," she said. 

'Major problem'

Geri-Lynn Slogotski of Victoria told CBC News she lost 120,000 points — worth $120 in rewards — after someone appeared to hack her account on March 5. According to her account records, the culprit spent the points in Montreal at Maxi & Cie, a Loblaws-owned supermarket.

She contacted PC Optimum on March 11 when she noticed the theft and, despite further inquiries, was still waiting for a resolution when CBC News interviewed her on Monday.

So was her mother, Marge Kenney, who also lives in Victoria and had 390,000 points vanish from her account on Feb.24. They were spent at a Loblaws Superstore in Calgary.

"I think it's a major, major problem," Slogotski said. "They're probably really struggling about what to do."

Justin Lim of Toronto lost 650,000 points — worth $650 — on March 17. 

After reporting the theft to PC Optimum, Lim discovered the points were used to buy two televisions at a Shoppers Drug Mart in Mississauga, Ont.

"What are they doing moving forward to prevent these security issues?" said Lim. "I want answers."

CBC News contacted Loblaws on Tuesday, and provided a list of the eight people interviewed for this story. Since then, most got their points back plus instructions on how to secure their accounts.

"We have strong security measures in place across our digital platforms and take any sign of unusual activity very seriously," spokesperson Catherine Thomas said.

She said Loblaws is committed to helping everyone facing points problems but acknowledged some members have faced "unacceptable delays."

At least six million Canadians are PC Optimum members. Thomas did not say how many members have reported points thefts, nor did she explain how the heists might have happened. She stressed that members should create strong, unique passwords.

Biever says a PC Optimum representative restored all her points plus added an extra 100,000 as a bonus. She was also instructed to change her email password.

She says she plans to go on a shopping spree with her one million points, but she's unsure whether she'll collect any more in the future.

"They offer this free program, but then they put you at risk."