Customers voice concerns with BMO security measures after scammers gain access to their accounts

Several BMO customers scammed Several BMO customers have been scammed out of thousands of dollars after their accounts were hacked. CTV’s Austin Lee reports.

Several customers with the Bank of Montreal are raising red flags about what they call inadequate security measures within the bank's online banking infrastructure.

CTV News has heard directly from four individuals who say they, or one of their family members, have had money stripped from their accounts and sent overseas through global money transfers.

For Ottawa resident Katya Feder, a brief conversation over the phone in April 2023 with a fraudster impersonating a BMO employee cost her $14,500.

"I was completely shocked. Flabbergasted. I mean, I was in disbelief really," she told CTV News.

Feder was told there was a suspicious transaction to purchase cryptocurrency from her account and the bank wanted to confirm whether it was a legitimate.

"I said OK, great! They are keeping on top of things at the bank. Wonderful. Then she said 'we're just going to verify your identity, we're just going to send you a verification code.'"

Feder repeated the code to the woman on the phone and just like that, her account was compromised.

In a statement to CTV News, BMO says it "encourages customers to be diligent in protecting their online and mobile credentials, to sign up for BMO Alerts to monitor their account for suspicious transaction activity, to frequently change their password or PIN and to never disclose passwords and One-Time- Passcodes.

"In the normal course, when a customer receives a one-time passcode, it is accompanied by the following disclosure: 'Warning: this code grants access to your accounts. Calls to request it may be a scam. If called, hang up and call the number on BMO card.'"

Feder says she received some kind of a disclaimer, but says she does not remember seeing the same disclaimer shown above. She added that she was already convinced she was on the phone with a bank representative.

A few days after that phone call, Feder came to learn that her money had been pulled from her account and sent to the United Kingdom in one large lump-sum global money transfer.

She reported the situation to BMO and was told the bank was launching an investigation, but months later, she has not seen any form of compensation, nor has she received any information about how the criminals were able to access her account so easily.

"In all my 40 years banking at BMO, and using the same bank account, I have never once used a global money transfer," she explained.

"I didn't even know you could do global money transfers, so I was just staring at it in shock really."

Scam victims form WhatsApp group

Feder is not alone. She tells CTV News there is a WhatsApp group with roughly 20 others who have recently fallen prey to fraudulent activity resulting in the loss of thousands of dollars. All of them are BMO customers.

"It was just created two months ago and it's growing and people have various stories of fraud that occurred through their bank in different ways as well and they're all with BMO," she said.

Laurie Johnson's 81 year-old mother is one of those victims. She is her mother's power of attorney and has taken on the ever-frustrating task of trying to recoup $15,000 that was stolen on Oct. 13, 2023.

Johnson says her mother's experience is essentially a carbon copy of what happened to Feder.

Her mother received a one-time passcode from someone claiming to be a bank employee.

When she received the code and provided it to the scammer, the fraudster gained access to her account, and sent $15,000 overseas. One difference between Feder's situation and Johnson's, in this case, the money was sent to Bangladesh.

"She has never, and I have never, done a global money transfer," Johnson said.

"Would they not flag that and make a phone call or just stop it and try to find out if that was in fact made by the client? It just seems like it's too easy for that to happen," she said.

"It's extremely frustrating. She has been a customer with the Bank of Montreal for 60 years and I have been as well. You would think with all of the profits they report, that they would be able to help out their customers."

Then there's the story of Christine and Kevin Avey of Norwich, Ont., who were also taken for $15,000.

Christine Avey says her husband Kevin clicked on the BMO online banking website, which he had bookmarked on his web browser. When he was on the site, he was asked to confirm his identity by submitting a one-time passcode. He followed that step, but Avey says he was still unable to log in.

He retried a few more times before giving up and going to bed to deal with it in the morning.

When he logged in the next day, $15,000 had been taken from an account the couple had never withdrawn any money from. The money was sent out of the country.

"I had never ever done an e-transfer, let alone a global transfer. I had only made deposits into this account and this large amount of a transaction was allowed to go through without even notifying us or just not allowing the transaction to be completed. This transaction is so unusual to my banking habits," said Christine Avey in an email sent to CTV News.

"We had never given anyone our password at all and they still blamed us. BMO explained that if we did not give it to anyone then we did not take reasonable care in protecting our password.

"This seems to be the standard line BMO give to their customers instead of the BMO implementing stronger security measures or perhaps a smaller limit allowed on a global transfers."

After bringing up the issue with their local branch manager, the Aveys were sent $7,500 to help ease some of their loss. However, this is a rarity. The branch manager told them this was done as an act of 'good faith', but it is not the bank's policy.

Customers left with more questions

Debbie Sammit of Orillia, Ont., says she has spent over a year fighting to get her money back after scammers stole $3,000 from her BMO account.

What's unique in Sammit's case is that she claims to never have received any one-time passcodes and never used any public Wi-Fi, which has left her wondering how someone was able to lift money from her account.

She was hoping to get answers from BMO when she reported the incident and was told a fraud investigation was launched, but she is still left with no information on how her account was accessed.

The agreements signed by customers when opening up a common bank account state that the owner of the account must keep all account information and codes confidential.

BMO has told the impacted customers that they will not receive any kind of refund, claiming the account holders failed to safeguard their personal information and the bank is not responsible for the their loss.