When Rick Hall discovered most of his life savings had been drained from his bank account, he suspected he had been hacked.
The first clue came when his password didn’t work. Then, once he regained access, he saw that on Feb. 17 a total of $28,710 had been transferred to an unknown credit card account.
“There was $249 left in the bank account,” Hall said. “It’s quite shocking when you have bills to pay.”
The 66-year-old Halifax, N.S., man said the theft amounted to more than his partner makes in a year working at McDonald’s.
Cybersecurity expert Claudiu Popa said it’s a classic case of identity fraud.
“We call these account takeovers,” he said.
Popa, who is the CEO of Datarisk Canada and the founder of KnowledgeFlow, a cyber safety foundation, said account takeovers have a dual purpose.
“One is to steal the funds that are in the bank account,” he said. “And the second is to steal more information because information is valuable. Information is also a currency.”
About a month after Hall reported the missing money, he said an investigator with his bank Simplii Financial determined he had been the victim of fraud. On April 2, he was reimbursed the full amount. During the entire investigation period in March, he was unable to withdraw his pension payments because the account was frozen.
“We have resolved this matter for our client, and recognize the length of the process in this case caused added inconvenience, which we will review as we work to support our clients in situations like this one,” said Benjamin Wylie, spokesperson for Simplii, in a statement.
Cellphone number transfer highlights potential security risks
According to data from the Canadian Anti-Fraud Centre, identity fraud had the highest number of reports among all types of fraud in 2024 with 9,487 victims across the country. Among those cases, 106 were in Nova Scotia.
The anti-fraud centre said it doesn’t track how much money people lose in identity fraud cases because it’s usually too complicated.
“In a lot of cases, the financial institution or the affected business may absorb the losses,” said Jeff Horncastle, client and communications outreach officer.
“It’s hard to know exactly who is absorbing losses, who’s responsible.”
Hall said he reported his case to Halifax Regional Police but the file was closed after his money was returned.
He said what frustrates him more is that he hasn’t received specific details from the bank about how someone gained control of his bank account. CBC’s questions to Simplii about how Hall’s account was accessed also went unanswered.
“They’re trying to say it was my computer,” said Hall. “I have all of the antiviruses, I have malware, all that on there, and my computer is clean.”
3 tips to keep yourself safe online
But Popa said those forms of online protection aren’t enough.
“No one releases a new virus to the internet without actually testing that it can bypass antivirus,” he said. “So chances are, if all you depend on is antivirus, you have no guarantee that your computer is clean.”
Popa said there is a form of malware called a keylogger that installs itself secretly when someone clicks a malicious email link or opens an infected file.
“A keylogger or a data stealer is something that watches your keyboard and, and as soon as you type in your password and your username, it emails it to its owner, to the cyber criminals, and they can use it to try to get into the account,” he said.
According to Popa, another vulnerability is simply having a weak password or using the same one for multiple accounts.
Hall insists his password was original and contained no personal details. But now he’s scared to continue banking online.
“It just happens so often and nobody can keep on top of it. And the people that are doing it, they have better technology at stealing than we have at preventing,” he said.
In the statement from Simplii, Wylie said the bank works actively to keep clients informed about safe banking practices and types of fraud they should be on the lookout for.
“Protecting clients against fraud is a top priority for our team which includes engaging and educating our clients on the role they play in recognizing scams and protecting themselves against them — keeping personal or banking information safe and secure, and being wary of emails, text messages or calls requesting personal information,” he said.
Horncastle with the anti-fraud centre says there’s “no magic way” to make certain that banking information is safe.
“The best we can do is remain proactive, verify your credit report, keep an eye on your bank accounts or your credit card statements,” he said.
