Welcome to the next generation of fraud

Clip You’re listening to a frequency podcast network production in association with City News.

Jordan Heath-Rawlings There’s absolutely no shame in falling for a scam or falling victim to fraud, even if it doesn’t feel like it in the moment. In fact, in most cases, if for whatever reason you end up coughing up your credit card info or even just have your card stolen, not speaking up about it costs you a chance to get all your money back. That’s because we have policies in place to deal with credit card fraud. We have four years. The banks take care of it, they pass on the cost, and you end up a little embarrassed, but not broke. The problem comes when these fraudsters move beyond credit cards into newer types of banking. Have you ever sent an Etransfer to somebody who has their account set up to accept it instantly? It’s fast, it’s convenient, and the easiest way to take care of bills or personal cash exchanges without interest only. There’s an issue. The banks do not protect these transactions from fraud the way they do with your credit cards. And that leaves the door open to any scam artist who can convince you you need to send your friend $100 to help them out. Or your mom needs help buying something online. Can you do it for her? Once you send that via e transfer, it’s gone forever. Nobody will get it back for you. And this has begun a whole new epidemic of fraud. I’m Jordan Heath-Rawlings. This is The Big Story. Alex Vronces is the executive director of Apex of Canada, an industry association of technology companies that move money. He blogs about issues impacting the sector at the MOX, which you can find on substack. Hi, Alex.

Alex Vronces Hi. Thank you.

Jordan You’re very welcome. Now, before we get to what’s now happening in the United Kingdom, I wanted to ask you generally, before we start talking about specific kinds, how is Canada at protecting against fraud? Are we good at it? What’s the scale of it in this country?

Alex Vronces I think it depends on what kind of fraud we’re talking about. It’s hard to get a sense of what the scale of it is. I know the Canadian Bankers Association at one point was collecting and publishing this data, but I think they’ve since stopped, at the very least, releasing it. I don’t know if they still collect it. And so if you’re trying to figure out what Canada’s fraud problem is, it’s very hard. I think it’s fair to assume a lot of fraud happens via credit cards. It’s one of the older tricks in the book. If someone can get a hold of your credit card credentials, they can pretend to be you and buy a bunch of things. And then when you log on to your online banking portal and you see what happened, you can raise the issue with your bank. But there are other types of fraud. I’d say emerging types of fraud happening via alternative networks like Interacts Etransfer and Payments Canada’s Realtime Rail, when and if that thing is ever built. Before we get to the emerging kinds of fraud, which we are here to talk about today, I’m really glad that you mentioned credit card fraud because it’s a good comparison for what we’re going to address. So maybe first, can you give us the two minute version of how we mostly solved credit card fraud, at least from the consumer’s point of view? Sure. So it all started decades ago when the United States decided that no consumer would have to bear the cost of credit card fraud. Under today’s laws, American consumers are not liable for more than $50 in the event of credit card fraud. But the payment industry essentially waves that fee and consumers are not on the hook for any of it. What ends up happening when a consumer has been a victim of credit card fraud is that their bank, what the industry calls an issuing bank, makes them whole. But the issuing bank isn’t on the hook either. Under the credit card network rules, the issuing bank is compensated by the merchant’s payment processor and likewise the payment processor is compensated by the merchant. So in the event of credit card fraud, the consumer is protected because the merchant pays the price.

Jordan So here’s where we want to talk about what’s different about the emerging forms of fraud, and maybe just because it’s an example that you cite in your writing, can you tell me about Adam Rickett and the new scam that we’re now seeing in the United Kingdom?

Alex Vronces Sure. So in the United Kingdom, the country’s financial sector was speaking to a journalist at the Financial Times recently and said that the country is experiencing an epidemic of fraud. According to the UK’s banking and finance industry, people lost more than half a billion pounds in 2021 to criminals committing what’s called authorized push payment fraud. What is that? This is when people are tricked into sending their money to fraudsters. So it’s quite different from unauthorized credit card fraud when someone steals your Visa or Mastercard and pretends to be you and racks up a big bill. In the case of what’s happening in the UK, people are actually part of the scheme. So there’s this person by the name of Adam Rickett. He’s an actor known for his appearances in British soap operas. About a month ago, he posted a video to his Instagram and he told his followers that he’d been scammed. It all started with a text message from his bank, or so the text message claimed. A text message was telling him that there was suspicious activity in his bank account, so he ignored it. But then came a phone call and the caller ID matched the phone number of his bank’s fraud department. So he picked up, he was told an elaborate story about what had gone wrong and after a pretty long exchange, he was given the solution. What he was actually doing was giving the fraudster the credentials necessary to push the payment. The fraudster walked him through it. Rickett had initiated the payment himself and the next thing he knew, he was out tens of thousands of dollars. This has become a bigger and bigger issue in the UK because the UK has something kind of special that Canada is going to get. And that’s a way to do account to account money transfers in real time, allowing people to withdraw the funds and disappear without a trace before people even discover they’ve been the victim of fraud.

Jordan So we’ve covered fraudsters before on the show and how they try to convince people to send money. What’s so different about this kind of fraud? Right?

Alex Vronces So in principle, it’s the same kind of fraud. What’s different is the stakes are about to get higher. Right now, with an interac Etransfer, for example, there are pretty low limits. So if you’re the victim of fraud, your exposure, so to speak, is limited. The other thing is that Interac has risk controls that mean the Etransfer is not always real time. It can take up to 30 minutes to send an E transfer. So it gives the bank an opportunity to do the checks it needs to do to make sure that everything is good. But payments in Canada are changing. For one Interac released a new version of Etransfer called Interact etransfer for business. The payment limits are a lot higher. So a consumer or a Canadian exposure is higher. So instead of being on the hook for, let’s say, $3,000 worth of costs because you’re the victim of fraud, it could be a lot more than that. Now, Payments Canada, which is the country’s payment system operator, is also supposed to release a new real time payment system and the limits are going to be even higher. I think the limits there are supposed to be $100,000. The other thing is these payment systems are supposed to have a real time user experience so that 30 minutes delay is not supposed to happen. So in a way, you can think of the changes happening in Canada’s payments ecosystem as ones that give criminals sort of abetting payments infrastructure. The solution is to make sure that you build in proper consumer protections, just like the credit card network rules do today. But when you look at what the rules under Interact etransfer today and under what Payments Canada is proposing the rules be for the RTR that consumer protection is nowhere in sight.

Jordan What is behind the rush to make these things real time to the point of even not having a window by which you can stop it? Is this to compete with apps like Venmo? I’m just trying to figure out what’s the rush here.

Alex Vronces That’s part of it, for sure. I mean, I don’t know about you, but I’ve been in situations where I’ve wished I’d have been able to send a payment in real time. Not too long ago I was selling an old laptop of mine on Kajuji and somebody wanted to buy it and they came to pick it up and they wanted to pay by etransfer. So we sat in my house for 30 minutes waiting for that E transfer to leave his account come into mind. It wasn’t the end of the world, but there were other things I wanted to do that day. There were other things they wanted to do that day. It would have been better for both parties had that payment been executed in real time. Sure. You can also imagine people who have to pay bills that are time sensitive. Maybe they can’t wait days and days for the payment to clear and settle. Maybe they need to pay it right now to avoid a late charge or something like that. So the Use case for real time payments is real. It exists. But by solving that problem, we’re creating another, which is we’re giving criminals away to steal money more easily from unsuspecting Canadians.

Jordan So let’s say something similar to what happened to Mr. Rickett happens to a Canadian. Once these payment platforms are active, they realize what’s happened a few hours later or whatever, and they call their bank and say I’ve just been screwed and I’ve been defrauded. What does the bank say? What are they required to do?

Alex Vronces So right now, when it comes to account to account transfers, it’s not clear what the bank has to do. If you look at Interac etransfers terms of service, for example, you’ll see that people sending and receiving money assume all the liability and risk arising from Interac transactions. If you go to the different banks terms of service and you read them, it’s something similar. For example, if you look at RBC claims that it’s entitled to send the E transfer to anyone who correctly responds to your E transfer question and answer whether or not you intended to send it to that person in the first place. So on paper, the liability falls on you. That doesn’t mean, however, it falls on you. In practice, you can read stories about cases where the consumer was defrauded and they had to bear the cost. You can read cases where the merchant was defrauded and they had to bear the cost. This kind of arrangement is hardly a solution because people are confused. They don’t know when they will be on the hook, they don’t know when they won’t. As a result, they trust the payment system less.

Jordan Going back to credit card fraud for just a second, credit card fraud, if you were to measure it, is probably a very high number. And I’ve said that they’ve solved the problem of fraud. How can I say that if the number is high?

Alex Vronces Well, they’ve solved it because they’ve made a process to make people whole in an automatic and predictable way. Like I said, if a Canadian under credit card payment is the victim of fraud. They’re made whole almost automatically by their bank. Their bank is made whole almost automatically by the businesses payment processor. And the payment processor is made whole almost automatically by the business who received the fraudulent payment. The business could complain, but the business doesn’t because the business realizes that if you want to give customers a very seamless shopping experience, you need to incur some risk of fraud. And so they just budget for it, they account for it and they eat the cost and it results in a payment system that is easy to use, convenient is a little costly in terms of fraud, but not so costly that merchants aren’t willing to accept the payment method in the first place. In Etransfer and the payment system, Payments Canada is building, we’re not going to get that level of clarity in the liability framework, which means people aren’t going to trust the payment, which means when things start going poorly, expectations will be violated and there will be bad headlines just like we’re seeing in the UK.

Jordan Why wouldn’t the banks want to nip that in the bud? I mean, if it sounds as simple as you’re making it out to be, to put in a framework that makes sure that the victim is made whole, is it just because they don’t want to take on the risks the way the merchants have in terms of credit card fraud?

Alex Vronces It seems like a pretty simple solution. I mean, I can’t say exactly why banks don’t want that kind of a solution, but I can’t say that in general, companies want discretion and flexibility and wiggle room. They want to be able to make their own decisions. They don’t want to be forced to do anything. So when we’re having these conversations in Ottawa about whether there should be stronger consumer protection in interaction rules or Payments Canada’s rules, it’s not hard for me to imagine why a bank might say no, you know what, I want flexibility. We should also remember that in the case of credit cards, there was a lot of bad press about credit cards at the time and it forced the government to react and react strongly and basically say, look, customers are not going to bear the cost of this. I don’t think it was voluntary in the case of credit card networks either, but it took leadership from the government to solve the problem. Have we heard anything from the government one way or another about actually putting in some guardrails on this system? Have they actually definitively said no or is it something that they’re ignoring? Thus far they haven’t definitively said no. I wouldn’t say they’re ignoring it either. In the case of interact, they’re likely aware of the problem, but perhaps it’s not at the magnitude yet that it would have to be for them to react. I’m speculating, but I think it’s a fair speculation in the case of Payments Canada, it’s not time for the Minister to review those rules and either approve or reject them. So the time will come where they will need to look at what the industry has put before them. And the Minister, Freeland in this case, will have to decide, has the industry gone far enough to protect Canadians or has it not?

Jordan In the meantime, as these platforms roll out, what would you tell Canadians to be on the lookout for in order to not be one of the people that makes headlines when this starts to really roll up?

Alex Vronces I think there are probably some easy things that people can do, some low hanging fruit. It’s not unlike the stuff that banks already tell you. Your bank is not going to text you and tell you about a suspicious transaction and give you a link that you need to click, right? And so when you get messages like that, you should probably call your bank separately and ask about whether something like that is actually happening. But there are cases where, for reasons beyond the control of consumers and merchants, they will be the victim of fraud. And I don’t think having to look at all the different payment methods, read all the different terms and conditions that come with each, figuring out where they’re most liable, where they’re most not. I don’t think this is a fair burden to put on customers, on Canadians who are just busy living their lives. I think it’s really a problem for the industry to solve and then if the industry can’t solve it, it’s really a time for the government to step in and be the advocate for Canadian consumers and businesses that right now it doesn’t exist in Ottawa.

Jordan If this happened to you when these new systems roll out, I assume it wouldn’t, because you’re probably pretty good at detecting these kinds of things. But if it did, what would you do to try to make yourself hope? Would you make a stink with the media and raise exactly the questions we’ve raised here? Is that basically what people are going to be reduced to if there’s no guidelines when this does roll out?

Alex Vronces I mean, just thinking about my personality, probably not. I’d probably be embarrassed. I’d be afraid to tell everyone that I was duped in this way, depending on the cost of the damages, like if my whole savings account was cleared out, I’d probably be too traumatized to do anything. I’d probably call my bank. I probably wouldn’t get the sort of empathy and recourse I expect and I’d probably give up. There’s a reason why the government has recently passed financial consumer protection regulations under the Bank Act. I think there’s a bit of a recognition that Canadians don’t always have the power they need to get recourse from their bank. I don’t think I’m any different. Is there any other party, and this will be my last question, but is there any other party other than the governing liberals, who has actually promised to do something about this. I mean, look, I know it’s kind of a rhetorical question, but consumer protection seems like a good thing for any party to run on. Yeah, no one has. And I think it’s because it’s a complicated problem. It’s a tough one. Payments is esoteric to many people who hear about it. It’s very easy to get into a room with a bunch of payments experts at banks who’ve been working for the bank in that field for decades and essentially be told that what you’re proposing is not possible. It’s not in your mandate, it’s not going to work, it’s going to break the financial system. Right. But to them, I would just say, how did credit card networks do it? If they’ve done it once, we can surely do it again.

Jordan Alex, thank you so much for this. It’s really illuminating.

Alex Vronces No problem. Thank you for having me.

Alex Vronces Alex Vronces, executive director of PayTech of Canada. You can read more from him at the MOX substack.com. That was the big story. True story. Somebody in my family almost fell victim to this exact type of fraud. Here’s how it works. You get an email from an address that you trust and respect. It’s spoofed, of course, but it comes from a family member who says, I can’t get this online purchase to work. Can you? Younger person who understands things about buying stuff on the Internet, can you just pay this for me and I will pay you back when I see you at the next family dinner or reunion. We were this close to having that transaction go through until the person in question realized there is no way this person would spend this much for this item. So knowing the person really well prevented fraud in this case. But I was stunned. These are smart people. I could easily see myself falling for a similar scam, and I like to think that I’m quite savvy about these things. All that is to say, that’s one reason we wanted to do this episode, because I think a lot of times we imagine ourselves to be a lot more savvy than we are, especially when dealing with the cutting edge of online scams. You can find the bigstory at thebigstorypodcast CA. You can always talk to us on Twitter at TheBig store FPN. We will not send you money from our account, just a tote bag when you fill out our survey and win a prize. You can also email us hello at The Big Story podcast CA or call us and leave a voicemail 416-935-5935. You can get this podcast anywhere you please, at least the places that actually serve up podcasts. And you can listen on a smart speaker by asking your smart speaker to play The Big Story podcast. I’m Jordan Heath-Rawlings. Thanks for listening. We’ll talk tomorrow.