Serial frauds at the National Bank | The law does not provide for any liability for banks

No law protects Canadian consumers against wire transfer fraud, like those that have poisoned the lives of dozens of National Bank commercial customers since last month. In the United Kingdom, the body responsible for bank payments has decided to require banks to reimburse the embezzled sums.

“There is no law in Canada that regulates this,” laments banking lawyer Marc Lemieux. There is also no law to protect victims of online fraud. »

Only “account agreements,” which consumers enter into to obtain banking services, share responsibilities between the customer and the financial institution when such fraud occurs. “These are not contracts that people are even aware of,” says Marc Lemieux.

These agreements list the consumer’s computer security obligations.

“You are solely responsible for any losses you may suffer when using a communication channel if you are negligent in protecting your username, password and any method of authentication,” provides that of banking services to businesses in the National Bank.

The contract also specifies that “transactions carried out remotely using in particular your identifier […] are deemed to be your responsibility.

In short, if banks believe that the customer did not do what was necessary to protect access to his account, they do not consider themselves responsible for the losses suffered.

Irreconcilable versions

The problem is at the heart of the controversy, in the case of the wave of frauds which affected the commercial clients of the National Bank. All the victims that The Press and other media outlets contacted deny violating security rules and cannot identify any time they may have been phished.

For its part, the financial institution nevertheless affirms that its security system has not suffered any failure. “This is the result of people who were victims of phishing,” André Boucher, head of information security, assured Monday. A position that the Bank maintained on Wednesday.

At Option consommateurs, lawyer Alexandre Plourde deplores the vagueness that reigns in Canada when it comes to reimbursement for bank fraud.

“In contracts, banks can impose a lot of security obligations on their customers and consumers: protect their PINs, their passwords, use secure networks, not leave their device unattended,” he lists. -he.

His colleague Marc Lemieux believes that the Canadian banking system must be better prepared for the growing scourge of wire transfer fraud. “I think the law should require banks to improve their authentication and detection systems,” he says.

Some National Bank commercial account holders have seen bursts of transactions appear in their accounts at late hours.

The United Kingdom innovates

Marc Lemieux gives the example of the United Kingdom. There, the authority which regulates electronic banking transactions, Payment Systems Regulator (PSR), must even impose from 2024 the compulsory reimbursement of victims within five working days. A world first.

The burden will be shared half and half between the bank of the defrauded, which issued the funds, and that of the fraudster, which received them.

“We expect that the industry will immediately begin to organize itself for these new requirements,” explained PSR in a document presenting this upcoming shift, last June.

The aim is in particular to “increase consumer protection so that most victims of wire transfer fraud are quickly reimbursed and to increase confidence in the British payment system”, writes PSR.

The protection must apply to any person who is the victim of such fraud, but of course provides for exceptions in cases where the consumer himself was complicit in the fraud, or if he was grossly negligent. .

In Singapore and Australia, the authorities are leaning towards a system sharing costs between the bank and the consumer.

In the United Kingdom as elsewhere, critics of PSR’s approach fear that its policy of full reimbursement by banks will cause a surge in fraud cases, eliminating any incentive for caution.

Here, Payments Canada assumes responsibility for coordinating rapid electronic payment services. Contacted by The Pressthe organization considers that it is not up to it to comment on such a solution.

“Payments Canada does not govern interactions between financial institutions and their customers; however, we continue to advocate for payment security innovation within the payments ecosystem to provide Canadians with convenient, secure and efficient payment options,” writes Director of Communications Victoria McMullen , without answering our questions.

The Canadian Bankers Association did not respond to our request for comment.

Nearly $40,000 embezzled from a personal account

Bank embezzlement does not only affect commercial customers. In the wake of articles on fraud by companies doing business with the National Bank, a client of services for individuals contacted The Press regarding a theft of nearly $40,000 of which he was the victim in early September.

“It’s an account with a line of credit,” explains Michel Galipeau, from Gatineau. On September 12, I wanted to verify a transaction. I was supposed to have $10,000; I was $30,000 negative! »

The Bank assures, however, that the fraud has nothing to do with those which affected its commercial clients.

Two payments of $19,902 each went to an Ottawa money transfer company. “I immediately contacted bank security and they froze my account,” says the retiree.

After the call from The Press about it on Wednesday, Michel Galipeau quickly received a call from the first vice-president Geneviève Turbide-Potvin in person. Five weeks after reporting the fraud, she told him he would be fully refunded.

“She told me that the fact that you contacted them rushed things, but that it was a matter of time, because the Bank had just traced the two payments,” he said.

The first payment took place on September 7, then a second of the same amount was able to leave the account without the Bank blocking the transaction four days later.

The frauds took place before the wave of embezzlements suffered by dozens of commercial clients of the National Bank began, starting on September 14.

His case has nothing to do with those of the commercial clients who have hit the headlines in recent days, however, assures the first vice-president of communications at Nationale, Debby Cordeiro. “There is fraud with all types of customers, and this is the case in all banks. »