Business clients of the National Bank who have seen their bank accounts and their lines of credit emptied by computer fraudsters risk closure: they now no longer have the means to pay their suppliers and employees. The bank, for its part, only offers partial compensation for the lost sums in the best case.
The Beauceron manufacturer of mechanical machines and robotic equipment MAR-Optimisation is one of a few dozen clients who, according to what the National Bank admitted last week, were the target of a phishing campaign in around mid-September.
The SME saw its current account stolen by $225,000 between September 14 and 15. This sum represents all of the money she kept aside, in addition to the line of credit attached to the account, and which normally allows her to pay her employees and suppliers.
Its account now dry, the company admits to gambling its future. “It’s a question of survival at this stage,” explains the CEO of MAR-Optimisation, Stéphane Lessard. “The bank granted me an additional margin of $10,000. My account has been locked for over two weeks. We have to buy components if we want to continue manufacturing our equipment and I don’t have the money to pay. Either I pay for the equipment or I pay my employees’ salaries. The ventilator begins to run out of air. »
Interior designers Annie Lareault and Valérie Hébert-Bureau are in a bit of the same situation. On September 13, fraudsters obtained access to their company’s two accounts at the National Bank. They transferred the money from both accounts at once. The amount lost by the two businesswomen is $17,000. “That’s all the money we had in the business. We haven’t been able to pay ourselves a salary this month. We shouldn’t close, but we have to borrow for our current expenses, and we have lots of late payments,” laments Annie Lareault.
The two designers from the South Shore of Montreal are not at the end of their troubles: their bank advisor no longer responds to them. The National Bank informed them of its refusal to compensate them for a problem for which it blamed them. However, the institution did not provide them with any document supporting this decision.
Stéphane Lessard has also lost all contact with his regular banking advisor. The National Bank, however, offered to cover half of his losses, or $120,000, in addition to granting him a loan of $40,000. The Beauceron entrepreneur has not yet decided whether he will accept this offer.
Questioned several times by The duty, the National Bank reiterated the importance for its clients to “take the necessary measures” to protect themselves from computer fraud. “Otherwise, a customer may be held responsible for transactions on their account, for example if they disclose their codes, passwords or identifiers. »
Whose fault is it ?
Mr. Lessard is the only one among the National Bank clients contacted by The duty to whom the Montreal bank offered some sort of settlement. In other cases, its clients mainly have the impression that the institution is trying more to blame them for this computer fraud than to help them.
“My partner had to go and be sworn in in person at the bank, but the information went to the wrong department, and there, our account is locked and our file has been under study for a month,” says Annie Lareault .
THE modus operandi of the fraudsters is the same in each case: they had access to accounts, most of which were protected by a two-factor authentication system, which is the level of security recommended by the bank. The contact details of several recipients were added to the victims’ account, then several transfers were made in a very short period of time.
The account owners say they did not receive any connection alerts or any of the alerts for creating a new recipient or new transfer that they normally receive when they carry out this type of operation themselves.
However, even if they followed the security requirements of their banking institution to the letter, customers can be judged responsible for the breach. Experts in banking law consulted by The duty indicate that there is no law that defines the responsibility of institutions and their clients in this type of situation. Each case is considered separately by the bank, which can then negotiate settlements on a case-by-case basis.
However, computer fraud is costly to the Canadian economy, and it is a problem that the financial industry has been struggling with for years. It caused losses of $531 million in Canada in 2022, calculates the Canadian Anti-Fraud Center, the authority on the subject. And only a fraction of that amount ends up being found. For example, the Anti-Fraud Center says it helped recover a measly $2.9 million in 2022, after recovering $3.4 million in 2021.