RBC customer’s bank accounts looted 3 times by identity thieves

Meghann Johnston, a victim of identity theft, has seen her RBC bank accounts looted three times, amounting to tens of thousands of dollars.

Johnston calls it "an incredibly stressful" situation. 

Each time, a fraudster walked into an RBC branch during business hours pretending to be Johnston, presented fake ID and was allowed to withdraw money from Johnston's account. 

The first time it happened in Toronto in 2012, Johnston was a law student. She was home studying when the call came from RBC telling her she had to get to her branch right away.

"I found out that somebody had gone into a branch and was impersonating me and had withdrawn quite a large sum of money from my student line of credit," she told Go Public. 

Johnston said the fraudster took $26,000. The bank gave her the money back and launched an investigation. Johnston had to go through the process of changing all her accounts and her automatic payments and had to pay the associated fees.

One year later account raided again

A year later, it happened again. This time Johnston was attending university in Kingston, Ont. Someone had walked into an RBC bank in Oakville and taken thousands from her personal account. This time Johnston was not only upset about the crime, but also angry at the bank for allowing it to happen again. 

"I was just so shocked because they told me that they were going to put on file that I was a victim of identity theft and that they were going to increase the security procedures."

"Each time this person presented themselves, they didn't have my client card and they didn't know my PIN and they were using fake IDs to pretend that they were me."

The bank told Johnston the thief used a driver's licence and a citizenship card with her information. Johnston remembers thinking how strange that was — since she was born in Canada. 

So, for a second time, RBC reimbursed Johnston, telling her it would investigate what happened and promising to increase security on her account. This time, the bank said it would put Johnston's physical description on file.

But there were still problems.

"That message doesn't pop up in their computer system automatically," Johnston says.

"The teller has to go into the system and click through a couple of windows to do this. It's not an automatic thing that would pop up and identify me. So when I found that out I was pretty upset." 

Johnston insisted RBC make sure whoever tried to access her accounts provided a client card and PIN. She said the bank refused to do that.

RBC security measures fail despite precautions

Then, unbelievably, Johnston says, in December it happened again. This time the fraudster walked out with almost $7,000 of her money. 

"I was extremely upset that time. This is the third time and they had accessed funds that I had delegated to something else and [RBC] had accepted the same fraudulent ID and this person just walked out with, again, thousands of dollars of my money." 

Johnston says her wallet has never been stolen, so she doesn't know how the fraudster or fraudsters got hold of her personal information. 

"I do not blame RBC for that, but I do blame them for refusing to institute higher security procedures for my account to prevent the fraudsters from doing this over and over again." 

Go Public asked RBC to look into what happened to Johnston.

"We sympathize with the difficult situation the client is in and the inconvenience she has had to deal with. We have taken reasonable steps to further protect the client's accounts and personal information at RBC," wrote Andrew Block, RBC's senior communications manager in an email to Go Public.

Block also tells us the bank has taken "reasonable steps" to further protect Johnston's accounts, but says the bank won't discuss details of its fraud prevention strategies.

Fraud prevention becoming an industry: expert

Tom Keenan, an author and cybersecurity expert, says there's another side to all this and points to what seems to be a growing fraud prevention industry in Canada and the U.S. More banks are offering fraud insurance to clients — for an additional fee. 

"Banks see identity theft as a new way to make money. Let's face it, if they can get $19.99 out of you every month for something that is fundamentally a service they should give you anyway, they'll take it," said Keenan.

RBC offers what it calls Credit Alert. According to its website, Credit Alert helps protect customers against credit fraud and identity theft.

The service costs $19.99 a month plus tax. RBC says the protection goes beyond what it already offers.

"We have sophisticated fraud detection and prevention systems in place to protect our clients' accounts that they hold with RBC," says Block. "Credit Alert is a service that monitors all of an individual's credit activity, not just activity on the individual's accounts held at their financial institution."

Johnston wonders how someone obtained her information in the first place. She says her wallet has never been stolen and she has no idea how her information got out there.

Identity thieves trade info on the "dark web"

According to Keenan, stealing someone's identity is easier than many of us realize. And once it's out there, he says, there's no getting it back.

"You have to remember these are industrial-scale operations. These are not two guys in a garage. These are people making a business out of identity theft. It looks like this woman may have just been one of their favourite targets," Keenan told Go Public. 

He says there are sites on what's called "the dark web" where identity thieves can buy and sell identities for as little as 50 cents each. Keenan suspects Johnston's identification may have been sold over and over again. 

"Once that information is out there, I can tell you, it's never going away, and it's going to be shared among the bad guys."

He says a lot of people give out far too much information that thieves can use, pointing to social media sites like Facebook, and to online and telephone surveys where people give up their date of birth, marital status, kids' names and more.

He says identity thieves look for any personal information to help them build a profile.

"I've heard about victims of identity theft that are so exasperated that they actually change their name, or add a middle name to all their accounts or something like that, simply because they just cannot stand the continuous fear that's it's going to happen to them again."

His advice? Try to fool the fraudsters. Keenan says he personally uses several different birthdays when registering for things online, just in case someone is trying to build a profile on him.

"They get confused. Remember, it's a little bit like trying the door knobs. If you have put so much information out there that you're an easy mark, then they are going to grab you. If they find six different birthdays for you, they're going to move on to the next person."

As for Johnston, she tells Go Public she's at a loss how to protect herself short of legally changing her name and bank, 

So far, she hasn't changed her name but she has changed her bank. She tells Go Public she's given up on RBC and taken her business and her money elsewhere.

Submit your story ideas:

We tell your stories and hold the powers that be accountable.

We want to hear from people across the country with stories they want to make public.

Submit your story ideas to Kathy Tomlinson at Go Public.

Follow @CBCGoPublic on Twitter.