Adam Freed didn’t suspect the caller at first.
The 50-year-old father of two was working from his Ottawa home on Sept. 18 when his phone screen lit up. The incoming call was from TD Canada Trust, according to his phone, and the number matched the one printed on his debit card.
On the other end of the line, a bank employee warned Freed that a suspicious Bitcoin purchase had taken place using his account. Freed had never bought Bitcoin in his life.
Alarmed by the thought that someone was trying to steal from him and his family, he answered a series of what seemed like routine security questions. He was also instructed to change his password through what the employee said was a “secured TD text system.”
Then came a strange request by the caller: cut the card in half and seal it in an envelope. A courier would come by the house to collect it and bring it to the bank for a “forensic investigation” of the chip.
Fifteen minutes later, a man who appeared to be in his 30s with thinning hair arrived at his doorstep, got the card, then vanished in a silver Honda Civic.
It wasn’t until the next day that Freed realized the supposed employee was, in fact, a scammer. Just like that, $10,000 was missing from his bank account, and TD Bank wouldn’t reimburse him.
“Our findings indicate that the individual responsible had access to financial information you are responsible for protecting,” TD wrote in an email to Freed following its investigation.
The email said that Freed is expected to safeguard his card, account information and credentials used for electronic banking under the product agreement.
The loss was a tough financial hit for Freed and his wife, Michelle Gauthier. Their son has GRIN2B-related disorder, an ultra-rare condition that causes lifelong cognitive and physical disabilities.
“It made me feel awful. It made me feel unprotected, vulnerable,” said Freed. “The whole approach was very professional and very, very convincing.”
Over the past five years, the amount Canadians have lost to bank fraud has soared. The type of scam Freed fell victim to, the so-called “bank investigator scam,” saw the largest increase in the number of victims followed by phishing scams in 2024, according to the Canadian Anti-Fraud Centre (CAFC).
In 2024, the most recent full year for which data is available, the CAFC reported that fraudsters stole $643 million from victims. That figure is nearly 300 per cent higher than the amount stolen in 2020, according to the agency, and represents just a small portion of the actual amount thieves have made off with, as most cases go unreported.
Recognizing the pervasiveness of fraud, the federal government has taken new steps to fight it by announcing a new anti-fraud strategy in Budget 2025. The initiative will introduce a new Financial Crimes Agency as well as amendments to the Bank Act, the legislation governing federally-regulated financial institutions.
But the budget didn’t address a key question at the heart of consumer protection against fraud: should financial institutions bear greater responsibility for the ballooning bill left by scammers?
Consumers pay the price
As it stands, the Bank Act leaves consumers liable for most types of banking scams.
The only exceptions are scams involving unauthorized credit card transactions, where consumers have a maximum liability of $50, unless they have demonstrated “gross negligence.”
For debit card transactions, consumers are not responsible for losses in circumstances beyond their control. That includes, for example, someone using their card when they had already reported it as lost or stolen, according to the Government of Canada website.
But there are many types of scams where banks are not required to cover losses at all — and consumers can be shocked to discover their bank won’t help them when thousands, or even hundreds of thousands of dollars, have disappeared from their accounts.
“I think most Canadians agree that banks should bear more accountability than they currently do,” said cybersecurity and safety expert Claudiu Popa.
“If they shift the full burden of fraud losses onto vulnerable customers, there’s a lot less incentive for the financial system to improve its own safeguards,” he said, adding that the banks have the size and resources to detect and prevent fraud.
Popa said most banks insist they warn customers not to trust suspicious links or callers posing as bank employees, but consumers shouldn’t be expected to be experts in every type of scam.
In response to questions from the Star, TD Bank spokesperson Ashleigh Murphy said the bank is sorry to hear about Gauthier and Freed’s situation while acknowledging that being a victim of fraud is distressing.
Murphy could not provide particular details on their case due to privacy, but said generally that bank employees will never ask customers to disclose their passwords or PIN numbers over the phone.
She said that scammers often use call spoofing technology to have the call display show the name of the financial institution as well as its phone number to make people believe their request is authentic.
“If you get a call from someone claiming to be with TD’s fraud department and you feel uncomfortable for any reason, hang up and call the phone number on the back of your debit or credit card — it’s best to use a different phone line, if you can.”
A shared responsibility model
David Shipley, the CEO of New Brunswick cybersecurity firm Beauceron Security, argues that if the banks are forced to take full responsibility for losses due to scams, they will likely pass the costs onto customers through higher interest rates on credit cards or service charges.
“The danger if the bank becomes solely responsible, or even up to a threshold, is that people can feel like it’s not a risk. I can do whatever I want, and that can actually make the situation worse,” he said.
Shipley said that Canada should instead try to achieve a shared responsibility model between the banks and customers. Banks should be required to strengthen security, such as having mandatory multi-factor authentication in place, and give customers more control over their accounts, such as the ability to disable e-transfers and cap outgoing transfer amounts, he said.
Banks should also be more transparent about how much money is lost due to fraud and how many cases result in refunds, since not all fraud is reported to the RCMP, Shipley added.
“We need to destigmatize it,” he said. “Because the irony is, criminals talk about this stuff way more transparently to each other and brag about it to the world than we do as a society in trying to defend ourselves.”
Popa said he also hopes the Bank Act amendments will require banks to communicate with each other about fraud patterns and emerging scam types, and make the data available to the public.
‘They barely did any investigation’
The scammer maxed out the $5,000 limit on Freed’s line of credit two days in a row, triggering an alert on his TD mobile app when the thief tried to withdraw more on the second day.
Freed reported the incident to the TD fraud department and filed a police report right away, but he said he never heard back from Ottawa police. In October, the bank informed him that the investigation was complete and denied his request for reimbursement.
Ottawa police said in a statement that it does not confirm or deny investigations to maintain victims’ privacy and safety.
Gauthier, Freed’s wife, said TD “barely did any investigation” and didn’t ask about the courier who came to their door. She was disappointed that the bank refused to share responsibility.
“They’re making that appeal process very difficult and time-consuming,” Gauthier said. “We have a severely disabled son. We’re barely keeping our heads above water just to raise him, plus the other daughter, and working full-time.”
Murphy, the TD spokesperson, said the bank takes reports of fraud seriously and conducts a thorough review based on the information available.
“Each case is carefully assessed against our internal fraud procedures and security protocols, which include reviewing transactions, digital traces, and any evidence shared by the customer.”
While the appeal process can feel lengthy, “it’s an important safeguard that ensures fairness and accountability through the review,” she added.
“TD provides education, tools, and proactive alerts to help protect customers, however individual vigilance remains an essential part of staying safe.”
Government fights fraud
In a few countries around the world, regulators have taken steps to hold banks, not victims, accountable for fraud losses.
Popa pointed to a world-first regulation introduced in the U.K. in 2024 that requires banks to refund up to £85,000 ($156,000) in fraudulent losses within five days of a victim being tricked into sending money to scammers, even if they technically authorized the transfer.
Last December, Singapore implemented a shared responsibility framework that applies to phishing scams. Banks and telecom companies are liable to reimburse customers if they fail to meet their anti-fraud obligations.
In an industry consultation last year, the Canadian government looked into introducing a maximum liability threshold for unauthorized transactions where funds are obtained through means beyond credit cards. That would include wire transfers or electronic funds transfers, for example.
In Budget 2025, the government’s intended changes to the Bank Act include requiring banks to have “policies and procedures” to address fraud, as well as allowing consumers to change maximum transaction amounts.
The banks will also be required to collect data on fraud and report it annually to the Financial Consumer Agency of Canada, a regulatory body overseeing the banks’ compliance with the law and the codes of conduct they subscribe to.
But the Liberals fell short of mentioning the introduction of a maximum liability threshold in their budget this year.
A Department of Finance official clarified that the “policies and procedures” will have to do with preventing suspicious transactions, staff training and determining when to remediate consumers. The official said that the government will table the amendments in the upcoming Budget Implementation Act.
The government will then develop the regulations to bring the new requirements into force and further specify the fraud protection rules for the banks, the official added.
The Canadian Bankers Association (CBA) said “banks are committed to fighting fraud and have policies and procedures in place to combat fraud and support customers,” according to an emailed statement to the Star.
“Combating fraud and scams requires collaboration across sectors,” the CBA said. It added that, in September, the banking sector led the creation of the Canadian Anti-Scam Coalition, a coordinated effort among financial, telecom and tech companies to fight scams.
The CBA said it is looking forward to receiving further clarity on the government’s proposed measures.
Without regulatory changes, victims will continue to be exposed to potential fraud.
Gauthier said she often receives calls from the bank about her insurance or her mortgage, but now she just wishes she would not get contacted by the bank over the phone anymore, because it’s hard to tell which ones might be scams.
“They should be responsible for being ahead of all these fraudulent people,” Gauthier said. “Instead, they’re just putting all of the responsibility and liability on their clients.”
