A Waterloo man is warning others to regularly check their cellphone accounts after he says multiple unauthorized phone orders were placed through his Rogers account in less than 24 hours. Richard Lah said he was first alerted to the problem on Sept. 10, when he received an email confirming an order for an iPhone 17 Pro Max. The problem was that he hadn’t ordered it. “I said to myself, ‘OK, well this is obviously fraudulent. Something’s happened, or a mistake in the system,’” Lah told CTV News. Later that evening, Rogers’ fraud department contacted Lah’s wife and flagged the activity. Lah said he was told the first order would be cancelled. But less than a day later, he said two more unauthorized iPhones had been ordered through the account — one on each of the couple’s cellphone lines. “It’s like, ‘Oh no,’ this isn’t the end of it. Something else is going on here.” The two iPhones were shipped to a Quebec address in Terrebonne, despite the couple’s legitimate billing address being in Waterloo. Lah said he contacted the courier and was able to stop one of the shipments. The other device was delivered to the Quebec address on Sept. 15, according to shipment records reviewed by Lah. The delivery required a signature. “What I wasn’t aware of is this shipment was split into two, because I couldn’t see that from my account page on Rogers,” he said. “It got delivered, it got signed for. And that was it.” Lah said he contacted Rogers repeatedly, worked with the courier to intercept the shipment, and reported the incident to Waterloo Regional Police. He believes his wife’s personal email account may have been compromised, allowing someone to gain access to the Rogers account. Rogers says account takeover fraud likely involved Rogers told CTV News its fraud team reviewed the case and determined it was most likely an instance of account takeover fraud resulting from compromised personal email accounts. The company said the email accounts associated with the Lahs’ Rogers account were compromised and that fraudsters were able to order devices after successfully completing authentication steps, including multi-factor authentication. In a statement, a Rogers spokesperson said the company has since worked directly with the customer to address the concerns and has waived all charges associated with the fraudulent transactions. “We understand how difficult it can be for consumers who become victims of fraud and understand how upsetting it can be when their personal email accounts are compromised by fraudsters,” the spokesperson said. Rogers also apologized for what it described as a frustrating experience, and said it is continuing to strengthen its security measures as fraudsters evolve their tactics. ‘These scams are continuously evolving’ Cybersecurity and technology analyst Ritesh Kotak said account takeover scams can be particularly difficult for consumers because fraudsters can exploit legitimate accounts rather than creating entirely new ones. “These scams are continuously evolving, and at the end of the day, individuals are paying the price,” Kotak said. He said companies need to have strong safeguards in place to detect unusual activity and prevent fraudulent transactions. “This is where I think that we need better protocols, security, safety in place, more checks and balances,” he said. Rogers has said it is continuously working to improve its customer service and security measures. Account restored after fraudulent orders Lah said his Rogers account has since been restored to its pre-fraud state and the unauthorized device financing has been removed. He also changed the passwords and email information associated with the account, enabled additional security measures and removed the payment card and automatic payments as a precaution. Rogers said the fraudulent charges have been waived. Lah said he is still looking for answers about how the second round of fraudulent orders was able to occur so soon after the first one had been identified. “How did we allow this to happen, and what can we do to prevent this from happening again?” he said. The experience has prompted him to encourage other cellphone customers to take a few minutes each month to review their accounts. “Be diligent. Check your accounts. Just because you have something recurring every month, check it, check it once a month. Make sure that everything looks right.” Rogers advises customers who suspect fraudulent activity to contact the company immediately. Customers can also report suspected fraud to the Canadian Anti-Fraud Centre and local police.
