Host: Matt Galloway

SCAMS

Guests: Melissa Plett, Carmi Levy

MG: Ida Pala Wished she’d listened to her husband for once when she got a call from her bank asking her about unusual spending.

SOUNDCLIP

IDA PALA: My husband kept saying, hang up, we’ll go to the branch. Hang up, we’ll go. Of course, I never listen to him, you know?

MG: As you probably guessed, it wasn’t her bank calling. It was fraudsters. They convinced her, the 71-year-old Montreal woman, that there had been fraud on her account, and she ended up sharing her banking info, and in the end, was out some $25,000.

SOUNDCLIP

IDA PALA: It feels awful. I felt like just a sinking feeling. Seniors need to know. Don’t trust anyone. If they say it’s the bank, hang up. I will call you. I mean, you think I’d be smarter than that.

MG: Ida Pala is part of an ever-growing number of Canadian scam victims, especially now that scammers are using artificial intelligence. If you haven’t been personally scammed, you probably know somebody who has. Canadians lost $647 million to fraud last year, and according to the Canadian Anti-Fraud network, that’s just a fraction of all fraud because so much of it goes unreported. A lot of those scams involve money taken fraudulently from Canadians’ bank accounts and investments. This summer, Canada’s big banks joined with the country’s biggest telecom and tech companies to create something called the Anti-Scam Coalition, saying they aim to raise awareness and foster collaboration. But some experts say the banks can do more to stop scams and to reimburse victims. We’ll hear more about that in a moment, but first, I’m joined by Melissa Plett. She was a victim of a scam this June. Melissa, good morning.

MELISSA PLETT: Good morning, Matt.

MG: How did this start?

MELISSA PLETT: Oh, for crying out loud. Well, they called me when I was in a stressful situation, and I was hangry and hungry. And they called me and said that I was, money was being moved out of my account in Vancouver and asked if it was me, and I said no, it wasn’t. So then they claimed the fraud was happening and told me to secure my account, excuse me, through an RBC app.

MG: And so what did you do? You go to the app?

MELISSA PLETT: So I went to the RBC app on my phone. I didn’t click any links. I didn’t share any personal information. Yet, while I was using the app, they somehow gained live access to my accounts. They then walked me through fake security steps while moving money out in real time, and a total of $14,510 was stolen via two wire transfers and a couple e-transfers from my personal account.

MG: How convincing were they? I mean, if you go to the actual app, that suggested that they sounded like this was a legit call.

MELISSA PLETT: Well, because they called from the RBC phone number. I verified the number on the back of my debit card, and everything they said was correct. And they weren’t sending me links. They weren’t asking me for information. They were just telling me to secure my app. So why wouldn’t I believe that?

MG: How much money did they end up taking from you?

MELISSA PLETT: Just over $14,510, to be exact.

MG: That’s a lot of money.

MELISSA PLETT: It is a lot of money, especially when you think you’re securing your account, only to find out that it was gone.

MG: And so when you contacted RBC, the real RBC, how did the bank respond?

MELISSA PLETT: So the best part is when I got off the phone, the real RBC called me. Same phone number showed up on my phone. Same thing. You’re having fraudulent activity in your account. I said, yeah, I know because I was just on the phone with you. And they told me that wasn’t them. That’s how I found out.

MG: They told you that the people who had called initially were not from the bank.

MELISSA PLETT: Exactly. And I didn’t even know that the wire transfers had gone out of my business account until they told me that as well.

MG: And so what did they say about the $14,510?

MELISSA PLETT: Essentially, they said because I was logged into the app at the same time, it’s, I mean, in not so many words, that it was my fault, that I was at fault here too.

MG: Because you had gone through the app, you had followed the instructions despite the fact that you thought you were speaking with representatives from the bank.

MELISSA PLETT: Exactly.

MG: I can’t imagine you were particularly pleased with that response.

MELISSA PLETT: No, I wasn’t. And so I went on a bit of a rampage, and I took to social media, and I’ve been telling as many people as possible. I’ve been emailing them and emailing them and escalating and escalating. I’ve escalated all the steps, and they keep saying that no, it’s not, they’re not responsible at all. And I finally started receiving some emails from TD Bank, which I’m not a member of, stating that I can check my online bank account, and it was the scammer’s name that was on those statements. So I started forwarding those to my police that I had investigating, that I had made a report to. And then on August 21st, they emailed me and said that arrests were made. But that’s all I know.

MG: What is, you still don’t have the $14,000 back, right? 14,510, technically.

MELISSA PLETT: No. So I emailed the bank again and said, you need to reopen this account because clearly, there’s illegal activity, and you have insurance for this.

MG: What is, and I paused because I was trying to figure out, I mean, what does, according to the bank’s own policies, what would the bank owe you, do you think?

MELISSA PLETT: Like what I feel they owe me?

MG: Yeah.

MELISSA PLETT: I mean, that is such a good question, because I would say they owe me everything. But I understand that you have to be accountable for your actions to a certain extent. But the fact that these phone numbers are so easily hacked, and the fact that when I logged into my bank account, there was already money that had been transferred that I hadn’t transferred, like they transferred $10,000 from my mortgage line of credit into my personal chequing account. I didn’t move that. So clearly, someone else had access. So, you know, we pay for protection, we pay bank fees and service fees all the time. So I feel like the bank is totally responsible for how a third party got in my app.

MG: We went through the fine print of RBC’s digital banking guarantee, and it reads in part, “We will reimburse you for monetary losses to your accounts resulting directly from the following: Unauthorized transactions in your accounts using digital banking or mobile payments, for transactions where it can be shown that you have been the victim of fraud, theft, or have been coerced by trickery, force or intimidation so long as you report the incident to us immediately and cooperate and assist us fully in any investigation.” We also asked RBC why you weren’t being reimbursed under their policy. They didn’t respond to our questions directly, but they put a statement in our hands that said, “We work with our client throughout the review process. We keep them informed. We explain the reasons for our decisions. We continue to communicate with our client directly and remain available to them to discuss any questions or new information.” What say you to that statement?

MELISSA PLETT: Like I’m almost speechless because on one hand, they’re like, we’re going to help you. And then on the other hand, they’re like, well, we’ve done everything we can, and we keep you informed. And that’s what I keep hearing back from them. Which policy are we going with? That they’re going to reimburse me or that they’re, you know, they’ve done their job? I don’t understand that.

MG: And the policy, I mean, suggests that you have been a victim of fraud, theft, or have been coerced by trickery. I mean, it’s there in the fine print, as we say.

MELISSA PLETT: 100%. When they sent me why they weren’t going to give me my money back, they had a whole new list of reasons why they’re not responsible. And so I don’t know which one they’re going with. This is the confusion.

MG: What do you think needs to change when it comes to how banks and governments deal with scams? I said in the introduction that if you haven’t been a victim of a scam, you know somebody who has.

MELISSA PLETT: Yeah, yeah, for sure. I just feel like there has to be pressure put on, I guess from the government, because the bank doesn’t care. Obviously, they don’t care. They just wash their hands clean of it. More people need to put pressure on the government to put more pressure on the bank. It feels like that’s the only way we can go about change, because it doesn’t appear like the bank cares. Like you said, it was over $6 million that’s been claimed this year alone. That’s an insane amount of money.

MG: What did you say? You described it as going on a rampage after the initial… I mean, social media is one of those accelerants for outrage. Did you hear anything back on social media, I mean, officially from the bank saying, listen, this is a public thing now. We’re going to try to figure out how to address this.

MELISSA PLETT: No, I haven’t, and I’ve done multiple media interviews. Like they are aware of me. If they’re not aware, they should be, because it’s like I’ve been doing my best to blow it up. And there’s not that many of us in Canada, but there’s enough to make a noise. So I feel like they’re just hoping I go away.

MG: What is your advice to people who are listening who, again, the fear is that if it’s not me, it’ll be my parents. It could be someone’s grandparents. The call that you got and what you did sounds so authentic in some ways. Log in to your app. You go on to your phone, the number’s the same on the back of the card, and yet it turns out that it’s not connecting to the bank itself. What would your advice be to people who are listening?

MELISSA PLETT: It honestly is so simple. Just hang up the phone. If anybody calls you to talk about money, hang up the phone. Individually dial their number back. Don’t hit redial because that’ll go to the scammer. Just dial their number back and verify it’s them. Because if it is the person that they say they are, they’ll be okay with you hanging up and calling them back.

MG: Do you think you’ll get your money back?

MELISSA PLETT: I mean, I got to stay hopeful, but I don’t know. I don’t know.

MG: It’s a lot of stress. I mean, I can hear the big sighs in this conversation. That’s a lot of stress, right?

MELISSA PLETT: It’s a lot of stress because it’s been like since June. And I don’t think people understand when they go, all these people, they’re so dumb they get taken for their money. It’s not that simple. And I don’t want it to happen to everyone, obviously, but it is, there’s a weird trauma that goes along with it. There’s a shame that people get. They don’t want to talk about it. They don’t want to go through the hassle. And it’s exhausting. It’s exhausting.

MG: Melissa, I’m glad to talk to you. I wish you the best of luck.

MELISSA PLETT: Thank you so much.

MG: Melissa Plett is a victim of a scam. We reached her just outside of Montreal. Carmi Levy is a technology journalist and analyst who covers scams in the financial sector. Carmi, good morning.

CARMI LEVY: Good morning, Matt. Great to be with you.

MG: Great to have you. The sophistication of that scam in particular I think will raise a lot of eyebrows.

CARMI LEVY: It absolutely should. I mean, you get a call, and looking at the call display, it’s coming from your bank, the number that is on the back of your card. That is some sophisticated spoofing of the telecommunications network, and that really is at the core of most of these calls. You look at it and immediately, oh, of course, it’s my bank. And now, they’re inside your circle of trust. Of course, you know, Melissa’s advice on, you know, hanging up the phone and calling back, that’s exactly what I advise anyone to do. And immediately, as soon as you cut that communication link, that immediately ends the threat. However, most people, because it looks so real, it looks so legitimate, and they have enough information about you to reinforce that notion that they are the legitimate bank. This is who they say they are that you just, you don’t hang up. Your sensors, you know, your spidey sense is not tingling. And as a result, you continue the call.

MG: What are some of the more prominent scams that are out there right now? Because this isn’t the robotic voice on your voicemail saying, you know, press five here, you’re going to go to prison. This is much more, as I said, sophisticated than that. What are some of the other scams that are out there?

CARMI LEVY: I mean, they’re using different platforms. And so in some cases, it could be a call that looks like it’s originating from a legitimate institution. In other cases, it’ll be an email that when you look at the header information, if you don’t dig too deeply, it looks also like it’s coming from your bank, your insurance company, the government, the CRA, your employer, you know, a payment processor, and then there’s, you know, and it’ll be the same thing. There will be a feeling of urgency. You know, something is wrong with your account. We’ve detected some kind of fraud. Click here in order to either download something or be taken to a website where we can fix it, we can address it. It can be an email. It can be a text message. It can be a social media direct message. And of course, they all have, they’re all variations on the theme, but they’re all based on the fundamentals of what we call phishing, that’s with a PH, which is a message designed to fool you into believing that they are someone or something that they are not. And then as soon as you engage with them, of course, you’re now engaging with a criminal. And so the sophistication is that they’re so good. It’s not a robotic voice. It’s not misspelled. The grammar isn’t pathetic anymore. I mean, these things are amazingly sophisticated. The logos are there. It looks like something you would get from your bank or whatever company you’re dealing with. So you’re lulled into that sense of belief, sense of trust. And of course, that’s when things begin to spiral.

MG: The voice can also sound like somebody that you know and love because of artificial intelligence, right? How has AI Changed the game here?

CARMI LEVY: Fundamentally, because, for example, voice cloning. They can literally go online, and using just a few seconds of maybe a video, of, you know, audio clip from a video that you might have posted from your kid’s birthday party, they can then create your voice in AI and then essentially put any word in your mouth in real time. So it sounds just like you or a member of your family, or maybe your bank manager or someone who is legitimate, and it sounds like them. I mean, we’ve heard this implicated in grandparent scams as well, where it’s your grandchild. And of course, you have to send the money. So what it does is it helps you overcome that initial sense of mistrust. Oh, I know that voice. Therefore, of course, I’ll believe it. You’re not inclined to kind of bail on the call and then do your own research. And thanks to artificial intelligence, that fidelity is incredibly good. And so you can’t even lean in and sort of, oh, this sounds automated. This sounds robotic. No, in many cases, it sounds so fluid, so smooth. And it isn’t just recorded audio, it is actual real time audio. They can actually have a conversation in the voice of someone who they have cloned their voice. And so the, and the technology literally gets better by the day, by the week, by the month. And so we can have this conversation six months from now, and it’ll be a video call that will be that high fidelity, because the technology will have moved ahead even further in that time.

MG: Yikes. What is it that the banks can do? I mean, Melissa’s bank called her back and said something strange is going on, but by that time, it was too late. What tools do the banks have to stop this kind of stuff?

CARMI LEVY: I mean, if you think about it, anytime you and I sign on to a network, we have to authenticate onto that network to prove that we are who we say we are. So username, password, you know, pass key, biometric, whatever it is, we have to confirm that we are who we say we are before we can do what we want to do. Well, why are criminals not subject to the same law? How is it that they’re able to authenticate onto, say, a phone network and pretend to be some other caller? How can they authenticate onto banking networks without the banks being aware of this? How are their platforms, their infrastructure, so porous to this kind of thing? And if a bank can transact something in one direction, in other words, move the money from a victim to a criminal, what is it about their financial networks that they can’t reverse that transaction? Why are they not using technology to right these wrongs? And then, you know, at the same time, this is less, this is more policy than technological, but why are banks allowed to shrug their shoulders? They write these wonderful things in their terms of use. We will reimburse you in cases of fraud. You know, if you are coerced by trickery, if you’re a victim of fraud, as long as you report it immediately, which was all the things that were done in this particular case and so many others, and yet they can still say, no, not us, and we are not going to reimburse you because you committed gross negligence. This was misconduct on your part, that blame the victim. If we had better legislation in place, banks would be compelled to operate at a higher standard, to be much more consumer friendly and work with them to address these frauds. So there are many technological and legislative tools available to us to force the banks to raise their game, but up until now, there’s been radio silence from the federal government on making banks behave in a more, let’s call it not fair and equitable manner.

MG: We asked to speak with the Canadian Banking Association. They said no, but they sent us a statement. It reads in part that, “Banks are united in their commitment to protecting customers and communities from fraud by continually strengthening cybersecurity and fraud detection measures.” You’re suggesting this isn’t anywhere near enough.

CARMI LEVY: It sounds like they used ChatGPT to write that, and their PR team needs to be fired. But know, this is the industry claiming that they’re doing the right thing when they’re absolutely not. This anti-scam alliance that they’ve or coalition that they’ve set up is sort of a typical response, right, because there is no, there’s nothing, it’s voluntary, first of all. They can say whatever they want. But that isn’t backed up in their actions, and they’re not going to change their fundamental ways because no one is requiring them to do so.

MG: So what could they do instead? What would you want to see? We just have a couple of minutes, but what would you want to see instead?

CARMI LEVY: More robust financial networks so that these kinds of transactions, for example, you know, in this case, she reported that some transactions had already happened without her involvement. How is that? Why is this process so opaque? Let’s open that up and make it a little bit more clear so that the networks themselves, the technology is better protected against this kind of fraud. We also need better resources so that victims know what to do when something like this happens. In other words, the public education from the industry, woefully inadequate. And we all need to be better educated. Of course, that means we have to do our homework, but the industry needs to play a role here. And then, of course, there needs to be penalties so that if the banks don’t behave in a way that is, let’s call it morally, legally and ethically acceptable, that there will be consequences for that, because right up until now, the bank can say no, and no one is going to punish them for it. And unfortunately, the victim list continues to grow by the day.

MG: I have to let you go, but if people are listening, I mean, your first bit of advice was hang up the phone, but everybody thinks they’re smarter than the scammers. They’re not, because the scammers continue to do this work. What is one bit of advice beyond hang up the phone that you would give somebody?

CARMI LEVY: This is an emotional thing, and it’s very emotional. I’m being defrauded, so you feel that you need to listen to what people are saying to you. Do not trust. Do not let emotions lead. Be distrustful. I know it sounds very un-Canadian, but just don’t believe anything that anyone says either on the phone, in your email inbox, in a text message. Do your own research. Cut it off and call back.

MG: Carmi, good to talk to you as ever. Thank you very much.

CARMI LEVY: Appreciate it, Matt.

MG: Carmi Levy is a technology journalist and analyst. He was in London, Ontario. Have you been the victim of a scam? Do you know somebody who has? What happened? And what do you think needs to be done to stop scams and get the money back? You can email us, thecurrent@cbc.ca. Your CBC news is coming up next, and then.