Bank won't reimburse Ottawa woman who lost $23K to fraudsters, family says
BMO says transactions don't follow 'specific fraud pattern' despite security breach
The family of an Ottawa woman says she lost about $23,000 of her life savings after fraudsters gained access to her personal bank account and transferred money through a series of bogus transactions.
Sayeda Nazma Yousuf, 66, has banked with Bank of Montreal (BMO) for 38 years, during which time she never set up online banking, instead relying on monthly paper statements and in-person trips to the branch on Prince of Wales Drive.
That's why Yousuf's daughter knew something was amiss four months ago when she noticed a number of unfamiliar transactions on the joint account the two share, including Interac e-transfers and payments to a prepaid credit card registered with another bank.
"I was shocked," said Sharmeen Yousuf, who's speaking out on behalf of her mother due to a language barrier and because Nazma is uncomfortable going public on her own.
"I looked at the transactions — I couldn't believe what I was seeing," said Yousuf.
This is every senior's worst nightmare.- Sharmeen Yousuf
In the span of four weeks, $23,716.38 was transferred out of the account, according to bank records viewed by CBC. The money was moved using six e-transfers sent to two separate email accounts, four payments to a prepaid CIBC Visa card, and three bill payments.
The transactions were partially funded by a $15,000 mutual fund redemption.
The Yousuf family is adamant all these transactions were done without their knowledge or consent, and the family has no connection to the email accounts or credit card that received the money.
Victim was impersonated, security breached
In a recorded phone call reviewed by CBC, a senior BMO employee admitted a bank telephone agent had breached security protocol when he granted online account access to someone posing as the mother — one day before the first suspicious transaction.
However, the bank has refused to reimburse Yousuf due to "inconsistent information" gathered during its investigation, thereby casting doubt on the family's account of events.
Sharmeen Yousuf said the experience has left her mother feeling embarrassed, ashamed, stressed and anxious.
"When we put our money in the bank, we trust the institution. We trust that our money will be safe," she said.
"This is every senior's worst nightmare."
Fraudster set up online banking
The saga began March 16 when a caller impersonating Yousuf called BMO's contact centre to reset a "forgotten" PIN and set up online banking. The person provided her debit card number and answered security questions satisfactorily, thereby gaining access to her account.
The questions were:
- Where was the account opened?
- What kind of BMO products do you have?
- Name one direct deposit received in the past 30 days.
The family criticized these questions as too simple.
The BMO phone agent provided the caller with an online banking password and helped reset the account's debit card PIN. A PIN change was completed shortly after at an ATM in Montreal — a two-hour drive from where the Yousufs live — but no cash was withdrawn.
The family suspects this transaction was done with a copied card because they say Yousuf's debit card never left her possession and she hadn't travelled outside Ottawa. BMO says it has ruled out the possibility of a duplicate card, though it hasn't explained how.
WATCH | Sharmeen Yousuf on her mother losing more than $23,000:
The bank's fraud investigators later determined the caller wasn't Yousuf, according to audio recordings of a BMO customer relations employee, but rather an "elderly woman probably trying to impersonate her."
The employee conceded the telephone agent who spoke to the impersonator didn't follow bank procedure by granting both a PIN change and an online banking setup during the same call. The employee said the bank considers this a "red flag situation," and the phone agent shouldn't have processed both requests.
"There's a lot of fault that happened by the employee that took that call and that's being taken care [of] on our end," the BMO employee said in the recording.
The employee also said camera footage showed a male conducting the Montreal ATM transaction.
Bank rejected claim due to peculiar activity
Sharmeen Yousuf and her mother reported the fraudulent transactions to the branch manager on April 12, one day after noticing them. The family said the manager told them they would likely be reimbursed within five to nine business days.
In an email sent June 8, BMO denied the family's $23,000 fraud claim.
"Although I can't get into all of the particulars of our internal review, it was confirmed that the card has not left your possession and legitimate transactions took place during the same timeframe as the reported unauthorized transactions, which do not follow a specific fraud pattern," the email said.
"Due to the inconsistent information obtained during our review, we are unable to offer reimbursement for the disputed transactions."
There's a lot of fault that happened by the employee that took the call and that's being taken care of [on] our end.- BMO customer relations employee
The bank denied the fraud claim, in part, due to some peculiar activity on the account that neither the family nor the bank have been able to explain.
One example is that Nazma Sayeda Yousuf said she made two purchases using her debit card and original PIN, even after the passcode had apparently been changed.
Another relates to three bill payments made during the period in question — two to Yousuf's Hydro Ottawa account, and another to her daughter's former Carleton University account. The family believes the fraudsters made these payments. They don't know why, but they say the hydro account had a surplus and the university account has been inactive for more than a decade. BMO says it's unusual for a fraudster to direct payments to a victim's legitimate accounts.
BMO raised the fact the fraudster was able to provide specific and accurate personal information, including the debit card number, the hydro account number, and answers to security questions.
"Someone … from her surrounding might have the information or her information might have been provided to someone else," the senior BMO employee was heard saying in the recording.
The family can't explain how the fraudster obtained Yousuf's personal information, and they deny anyone close to them is involved. BMO has left them feeling unfairly blamed.
"I thought that losing $23,000 was bad, but what is even worse is being blamed for losing that $23,000," Sharmeen Yousuf said.
"That really hurts."
Bank missed red flags: expert
Vanessa Iafolla, a professor at Saint Mary's University in Halifax who researches financial crime, said Yousuf's bank records show several telltale signs of fraud.
Iafolla said the fact all the e-transfers were for amounts slightly less than $3,000 — a common threshold at which some customers have to wait to send another payment — demonstrates a certain level of sophistication and knowledge of the financial system.
She said a series of high-volume online transactions done in quick succession on the account of a senior citizen, who has no history of online banking and who normally completes only a few transactions per month, should have caught the attention of the bank's fraud prevention systems.
"It seems pretty clear to me that there were several important lapses of security that happened with respect to her accounts," said Iafolla.
"Any kind of financial transaction that significantly deviates from what a person might normally do should present a red flag."
WATCH | Prof. Vanessa Iafolla says irregular transactions should have sparked more scrutiny:
The Yousuf family filed a police report, but Ottawa police confirmed it has since closed the case. A spokesperson said the force could reopen the file "should the involved bank in this matter provide evidence of an offence."
BMO did not answer CBC's questions about the case, instead stating the bank has "reviewed the matter" and will be "in contact with the customer."
A day after declining CBC's interview request, a BMO regional vice-president sent a letter to Yousuf reiterating its earlier findings.
"We cannot conclude at this point that you have been the victim of fraud by a third party," the letter read. "We are, however, prepared to consider any additional information you can share with us and will continue to work with you to clarify what happened and come to a conclusion."
Sharmeen Yousuf said her family has lost faith and trust in the institution.
"We were really hoping that they would be able to help us and resolve this issue for us," she said.