Orillia's Debbie Sammit is leading the charge in organizing a class-action lawsuit against BMO Canada.
In September 2022, Sammit noticed $3,000 had been e-transferred out of her account without her authorization. After going public with her story, 30 people contacted her to say they had the same experience.
An Office of the Privacy Commissioner of Canada investigation from 2021 found BMO Canada's online banking software had "significant weaknesses" in its technical safeguards between June 2017 and January 2018, allowing potential attackers to breach about 113,000 bank accounts.
"A lot of other banks are doing things like a two-step authentication code to improve their security," Sammit said. "Even after that breach, the Bank of Montreal has done nothing to improve their security."
Sammit and the 30 others who have experienced alleged fraud from their BMO accounts have hired a lawyer with the intent of launching a class-action lawsuit against the bank.
But the Ombudsman for Banking Services and Investments, who investigated Sammit's original claim, says BMO did nothing wrong.
"We considered your complaint very carefully," reads its ruling. "While we are sympathetic to your circumstances, we are not recommending BMO compensate you because the transaction was completed using your banking information (and) the account agreement says consumers must protect their banking information."
The ombudsman said its investigation determined someone signed on to Sammit's online banking using her debit card number and online banking password to complete the e-transfer.
Further, the ombudsman said the bank sent a one-time verification code to the email address on file and the "code was successfully entered the first time." In addition, a scan of Sammit's "device showed no evidence of malware or viruses."
Sammit, however, claims she never received the verification code. Nor did the others who have had similar issues, she says.
"They say an (online banking password) was sent to our email addresses. I (and they) never received one," she said, adding she checked through her emails, including the spam and trash folders.
"I kept asking them for proof that they had sent the (code) to me, but they ignored my multiple requests," Sammit said.
It's frustrating, she says.
"The OPP is saying because BMO deems it's not their fault, they (OPP) have completed their investigation," Sammit said.
Meanwhile, she added, "BMO says if I have any further issues, go to the OPP. So, I'm sent from one organization to another, in circles, with no results."
That frustration is what led to the idea to file a class-action lawsuit.
"We are trying to tackle it legally together to get our own money back," says Sammit, who alleges some members of the group have lost more than she has.
"Someone in the group had somebody go into their line of credit and switch it over to their chequing account before taking it. So, now they are paying interest on money that somebody stole from them."
Others in the group have lost upward of $18,000 to theft, she claims.
"One person’s e-transfer limit was only $3,000," Sammit said. "The limit was raised and then they took out $5,000 three times over. The bank told them that they had upped the limit without their authorization."
Sammit says "there is something really strange going on" that is costing people their money. While she is holding BMO responsible for her missing money, she still isn't sure who took it.
"It's just strange that all of these people in the last year or two have suffered from this," she said.
She is hopeful she will get her money back through the lawsuit.
"The biggest thing, though, is spreading awareness," she said. "I don't want this to happen to anybody else."
BMO Canada media relations director Jeff Roman called Sammit's predicament "an unfortunate situation" but said, due to "customer confidentiality," he could not disclose specific information about it.
"We encourage customers to be diligent in protecting their online and mobile credentials and keep their secret code and card number confidential," Roman said in an email response.
"Customers should sign up for BMO Alerts to monitor their account for suspicious transaction activity, and frequently change their password or PIN. Customers should not share their banking information and password with friends or family members.
"Customers should always choose strong and unique passwords that cannot be easily guessed by someone else, use a different password for each online account, never use birthdays, anniversaries, children’s names, for example.
"If customers think they are becoming victim of a scam or notice strange activity on their account, they should report it to their bank immediately. We always encourage customers to contact the police so we can support their investigation and their attempt to recover the funds."
He noted BMO offers online resources that focus on how customers can protect themselves.
Anyone wanting to connect with Sammit regarding this matter can email her at [email protected].
— With files from Dave Dawson
