'No one has called me': Simplii customers complain of response to breach

CTV National News: Simplii, BMO data breach Personal information may have been stolen from thousands of Canadian customers of Simplii and BMO. John Vennavally-Rao reports.

Jennifer Gaudet was shocked to learn Sunday that nearly $3,000 was missing from her Simplii Financial bank account.

“When I asked (a customer service representative) why I wasn’t alerted to these fraudulent charges, she said, ‘Oh yes, we’ve tried to contact you… we called the number on file,’” the Ottawa resident told CTVNews.ca. “When I asked for the number on file, I was told it was changed to a new number.”

Gaudet is one of an estimated 40,000 Simplii clients whose bank account information may have been compromised in an alleged data breach that Simplii has blamed on “fraudsters.” According to Simplii, the company became aware of the potential breach on Sunday. The Bank of Montreal has also said that it was contacted by “fraudsters” Sunday who claimed they were in possession of client data.

Simplii says it is currently investigating the alleged breach.

“We're taking this claim seriously and have taken action to further enhance our monitoring and security procedures," Michael Martin, the company’s senior vice-president, said in a written statement. "We feel that it is important to inform clients so that they can also take additional steps to safeguard their information."

Media outlets received a letter via email Monday from someone claiming to have stolen the data and threatening to sell it if the banks did not pay $1 million by midnight. The email closed with personal information, including social insurance numbers and answers to online banking security questions for two clients: a man in Ontario and a woman in B.C.

‘NO ONE HAS CALLED ME’

Gaudet, however, says that she only became aware of the alleged data breach through media reports on Monday.

“Still to this day, no one has called me once,” she claimed.

Gaudet said that it took multiple telephone calls and “a lot of leg work” over the weekend before she learned that her account had been compromised and money had been fraudulently withdrawn via two e-transfers, one for $10 and another for $2,889. All of her personal information -- email, address, phone number, password and security questions -- had also been surreptitiously changed online.

“Now my account is completely frozen,” Gaudet said. “There was nothing they could really do… I don’t feel supported and I completely feel violated. I feel like my information is out there and they can’t even tell me what’s out there.”

A Simplii spokesperson said in an emailed statement to CTVNews.ca Tuesday morning: “We are continuing to work with cybersecurity experts, law enforcement and others to protect our Simplii clients’ data and interests. While the issue affects a limited number of individuals, we are providing updates to all Simplii clients through social media, Simplii.com and via email messages. We are also reaching out directly to clients who may have been impacted‎.”

BMO said it has “proactively shut down access to customer accounts identified as potentially impacted by the breach. Credit and debit MasterCard customers can still conduct chip and PIN transactions, but customers with BMO blue debit-only cards will be unable to transact. BMO will be calling each potentially-impacted customer in the next 24 hours to offer complimentary monitoring, replace cards, ensure all passwords get reset, and determine if there was any financial impact.”

‘LEFT ME FEELING DEFEATED’

On May 22, Shawn MacIntyre of Kitchener, Ont. noticed that $1,169 had been withdrawn via an e-transfer from a Simplii account he shares with his business partner, leaving a balance of just 60 cents.

“He called into Simplii and basically was met with roadblock after roadblock,” MacIntyre said. “He said it was very difficult.”

A customer service representative, MacIntyre explained, had asked for his business partner to verify his identity by relaying the account’s recent transactions.

“They were more interested in transactions (than his personal details), which he would have no knowledge of anyways because they were fraudulent transactions,” MacIntyre said. “They should have a better system in place to authenticate people’s identity when these types of situations happen, because how are the legitimate account holders supposed to have knowledge of these fraudulent transactions?”

After much back-and-forth, the account was eventually closed. MacIntyre said the company made no effort to retain their business and only expressed an interest to “make this right” after he complained in a public social media post.

“All of a sudden, the tone has changed,” he said. “It’s frustrating -- definitely frustrating.”

MacIntyre said that he now has had to borrow money from his line of credit to cover business expenses this week. And like Gaudet, he also only heard of the alleged breach in the media.

“It’s certainly left me feeling defeated,” MacIntyre said. “I just felt like I wasn’t treated as though my business was valued by them or that they were concerned about it.”

‘FIVE DAYS TO CATCH ON’

Toronto DJ Ryan Carroll says he feels lucky to have some cash and a credit card to live off of after $1,500 was stolen from his Simplii account through fraudulent e-transfers.

“But clearly they have my personal data now, so I’m really concerned about that,” he told CTVNews.ca Tuesday. He says he was alerted to an issue Friday when he got an email saying an e-transfer had been accepted that he did not send.

He tried logging in to his account but was locked out. His password had been changed, along with all his security questions. He immediately called the bank and while on hold there, watched two more fraudulent e-transfers clear his bank account. The scammers were using an existing recipient’s name on Carroll’s account but had changed the email destination to a phone number.

His account was closed and he’s waiting for a new bank card to arrive by mail.

Carroll says a customer service representative told him that the problem could be a virus on his computer. But he wonders why the bank wouldn’t have already flagged an issue because he says customers began posting concerns on social media on Wednesday.

“It seems like it took them five days to catch on to this.”

Carroll expects to eventually get his money back but wonders how long that will take. In the meantime, he’s contacted the credit bureau to flag his account and has changed all the passwords he uses.

SIMPLII’S SOLUTIONS?

Simplii is now asking its clients to make sure they have a complex online password and that they are monitoring their accounts for unusual activity. The company has also promised to reimburse all money that has been fraudulently withdrawn.

Simplii, a direct banking subsidiary of CIBC, was formed in Nov. 2017 after President's Choice Financial ended its relationship with CIBC, which had provided back-end banking services for PC Financial for nearly two decades. All two million PC Financial accounts were turned into Simplii accounts at that time.

With files from The Canadian Press