The CRA E-Transfer Scam

The intention of today’s post is to provide some information to protect you from fraudsters.  

As some of you know, I am a defence lawyer who represents persons accused of fraud and other property crimes. I have seen everything from sophisticated frauds involving millions of dollars to unintentional incidents that were in no way criminal. 

I too have been a victim of fraud.

In today’s information sharing climate, I am sure many of you have also been the victim of fraud, identity theft or both. The reality is, our identity is exposed on a quotidian basis, with unfortunately very little protection from large corporations and Canadian banks -- organizations that make billions of dollars in profit by holding our money. In my life, my personal information has been exposed at least once (through Nissan Canada) and I am presently dealing with the Royal Bank of Canada (RBC) on an issue that involves one of Canada’s major life insurance companies. I am also the target of scam telephone calls by sophisticated fraudsters.  These happen just about everyday. 

By way of example, a timid person might think the Canada Revenue Agency (CRA) is going to have them arrested just as easily as an unsuspecting person might think that the caller asking for their credit card information to lower an interest rate is acting in their best interest. The type and sophistication of telephone, text and email fraud is becoming so pervasive that I no longer accept information from any telemarketers; to me, they are all just scammers.  Frankly, it’s safer not to speak with telemarketers or email marketers at all.

My advice is that all Canadians simply make it a policy to ignore all telemarketing, text-marketing and email marketing inquiries asking for any information at all. If you happen to be interested in whatever the marketer is offering, get off the phone and do your own due diligence.

A recent fraud, however, has come to my attention that could have catastrophic consequences for its victims.  It is yet another CRA Scam.  This fraud is a personal information hijacking, where the fraudster is claiming to offer a tax refund from CRA by way of a “direct deposit” or e-transfer.

Interact Email Money Transfer or “e-transfer” is an incredibly convenient method for instantly transferring money. From a business perspective, it is a preferred method of payment because the transferor immediately gets an e-receipt from the transferee. The process is also simple, convenient and if used properly, very secure.

On Good Friday, however, I was the target of an attempted e-transfer fraud. Of course, I did not fall for the fraud, but I decided to follow the process to see how it worked.

 The attempted fraud was executed as follows:

1. I received a text message indicating that I was the recipient of a “tax refund” in the amount of $54.69.
2. Just as any e-transfer message would contain, a link was embedded in the message. 
3. By clicking the link, I was taken to an “unsecured” site with a highly suspicious domain address.  That domain address identified the icons for what was apparently every Canadian Bank, including RBC, TD Canada Trust, Scotia Bank, Bank of Montreal and CIBC.  Other than the suspicious domain address, the page otherwise appeared identical (or nearly identical) to the actual E-Transfer page that one would receive during a normal e-transfer transaction.
4. I selected a bank icon and clicked. From there, I was taken to what appeared to be an actual “sign-in” page for the bank.  Again, the unsecured domain address was the giveaway.
5. I then inputted some false numbers, along with a false password. Interestingly, my information was confirmed as correct and I was sent to a page to provide answers to security questions.
6. I then provided bogus answers to various security questions. From here, I was taken to a different page to input credit card information.  Again, I inputted bogus credit card information.
7. From here I was taken to a page that said “please wait while we process your information”. 

 Of course, this entire process was a highly sophisticated online scam designed to steal your personal banking information.  It takes little imagination to understand the havoc that this fraud could cause. The intention of this fraudster is to steal everything in your bank and to use your credit card for an unlawful purpose.

I may by a Calgary fraud lawyer who defends all property offences, but I am still an honest Canadian who does not want you to fall prey to this -- or any type -- of life changing scam. 

Use due diligence when surfing the Web and do not EVER share your banking information with anybody. Remember, a legitimate business, doing a proper e-transaction, will give you its details so that you can identity the legitimacy of the e-transfer. For instance, if you pay fees to me by e-transfer, I will give my email address and provide the password.  I will never ask for your personal information.

 The Internet is a valuable information resource, but it must be used intelligently.  

 I wish you all the best.

Surf Wisely.