‘Completely devastated:’ How two Ontario women lost $50K by clicking a link texted to them

Two Ontario women reached out to CTV News after their accounts were hacked and lost $22,046 and $28,782.

Two separate Ontario women were scammed out of more than $50,000 combined after clicking on a link that was texted to them.

“I clicked the link and I updated my information. The next thing I knew, my phone stopped working,” Oshawa resident Christie Seymour told CTV News.

• READ MORE: Smishing attempts appear to be on the rise, thanks in part to new tech that allows for bulk attacks

In April 2024, Seymour said she received a text message that she needed to update her credit card information. She said she clicked the link and thought she updated it, until her phone was hacked and scammers stole $28,782.

Seymour says she tried to call her bank, Wealthsimple, for three days so they could block her account, but couldn’t get through.

“I’m completely devastated. That was all the money I had saved and it’s just gone and they aren’t taking any responsibility for the part of the problem,” said Seymour.

Seymour said she received an email from Wealthsimple, which stated: “Your account appears to have been accessed by an individual whom you’ve authorized via a phishing scam.”

Something similar happened to Christina Petruzzelli.

“Just be careful if you get links to your phone, don’t touch anything because it can ruin your life, honestly,” Petruzzelli said.

The Mississauga resident told CTV News she also got a link via text saying she had to click on it to decline a purchase. Concerned she was being scammed, Petruzzelli says she followed the instructions, but fraudsters got into her bank account and took $22,046.

“What the link was, it was either to enter those six numbers so I can approve the purchase or decline it, if it’s not me,” recounted Petruzzelli. “So, I clicked decline and I guess that’s where the scam was. By me clicking decline, they got access to my account.”

Petruzzelli says her bank, the Royal Bank of Canada (RBC), told her that because she had granted the scammers access to her account, she won’t be reimbursed.

“I have people that rely on me and you’re taking everything I had, and I didn’t do it,” Petruzzelli said.

An RBC spokesperson could not provide details on Petruzzelli’s situation, but they did confirm to CTV News that “RBC will never ask you to download a remote access application.”

RBC also wanted to remind customers that their staff will never ask customers to provide the bank with one-time passcodes sent via text, email or voicemail. They add that the bank will never ask a customer to destroy their debit or credit card, then give it to the bank or third-party in order to secure their accounts.

For Seymour’s case, a spokesperson for Wealthsimple told CTV News they were “deeply sorry” to hear what happened.

“Financial loss is incredibly disheartening, especially when it results from a phishing scam by a bad actor,” the statement reads. “We’ve spoken to her directly, and as a gesture of goodwill, we have reimbursed the losses she experienced while trying to contact our team. While our Client Account Agreement outlines that we’re not responsible for losses stemming from unauthorized access like a SIM swap, we recognize that Christie faced irregular challenges when trying to reach our support team last year, which we’ve made right.”

Seymour said she got all of her money back.

“I feel wonderful. All the worry and dread and regret is gone, and I feel great,” said Seymour.

Claudiu Popa, a cybersecurity expert, said everyone should be using dual factor authentication to add another layer of protection and to be cautious of all the links you receive.

“They get more and more targeted, more personalized, and more sophisticated,” said Popa. “Remember three things: they are counting on you to be surprised, there will be urgency and the need to respond.”