Online thieves scam Toronto couple out of more than $1,000 in PC Optimum points hack

When Chris Eggers and his wife signed up for an in-store text message promotion at a Toronto Shoppers Drug Mart, they thought they'd collect extra PC Optimum points.

Instead, Eggers alleges, hackers stole them all.

"Every week, [PC Optimum] would text me, 'See if you're a winner and click on the link!'" he explained.

"One of the links I clicked, and I still have the text, asked me to enter my PC optimum information."

So, Eggers, 37, entered the couple's log-in details.

"I believe it is at that point that my identity was compromised," he told CBC Toronto.

All the text messages came from the same number. But only one, he says, asked him to enter his account information.

A few days later, the couple was alerted that all their points had been cashed in.

"My wife got emails saying that our PC Optimum points were being redeemed at Vaughan Mills Mall, 600,000 of them," Eggers explained.

"And so, of course, we panic, you know, try to open the app and change everything, but at that point it was all gone."

Hackers redeemed more than $1,100 worth of points

Emails the couple supplied to CBC Toronto show a total of $1,149.99 worth of merchandise was redeemed at the Shoppers Drug Mart located in the Vaughan Mills Shopping Centre in Vaughan, Ont. north of Toronto.

Eggers notified Loblaw Companies Ltd., the corporation that operates the PC Optimum program, and has since filed a report with York Regional Police.

Scammers have targeted the reward system before.

Two years ago, CBC News interviewed eight people across Canada who said they'd each had more than 100,000 points stolen from their accounts after Loblaw merged its two rewards programs — PC Plus and Shoppers Optimum — to form PC Optimum on Feb. 1, 2018.

The reported thefts are just one more problem plaguing Loblaw, which was already dealing with technical glitches involving PC Optimum, and fallout from a bread price-fixing scandal, including the related controversy over asking some people to send their ID to collect a $25 gift card as compensation for the overpriced bread.

No connection to text promotion, Loblaw says

When the company replied to Eggers days later, he was told his email had been compromised and there was no connection to the in-store text promotion.

That's something Eggers still has trouble accepting.

"I don't believe that because if somebody was going to compromise my email, then they would have gone after my banking," he said.

"It's quite a leap to think that when you get into somebody's email that they have a Shoppers Optimum and that's ... the cherry they want to pick."

In a statement to CBC News, Loblaw says the company reviewed screen shots of Eggers's contest text messages and related links and has "not found any site/page that asked for PC Optimum account information."

"The links provided simply show a promotional code," the statement reads

Loblaw apologizes for 'the inconvenience this has caused'

However, the retailer does acknowledge recent "smishing campaigns" — text messages asking for information, claiming to be from PC Optimum in recent months. 

"We're still reviewing to see if that could be the case in this instance," the company said, adding their investigation is ongoing.

"We are committed to understanding the scenario and how we can best help our customers moving forward."

Loblaws says representatives have worked with Eggers and his wife to restore their points and secure their account.

The company also says it apologizes for "the inconvenience this has caused [for the couple] and the delay in resolving it."

Eggers says he's happy to have their points back but worries others could have also been hacked.