The Canadian Anti-Fraud Centre reports Canadians lost $638M in 2024 and we know the true amount is much higher. Unfortunately for unsuspecting individuals SEO poisoning is a common attack vector.
Criminals are constantly trying to find new ways to steal your money. The latest scam? Creating fake websites that will pop up in a Google search in hopes of getting you to enter your personal information.
CTV News spoke to one Ontario senior who lost most of his life savings after searching online to find the best interest rate to invest in GICs.
“I’m devastated. $750,000 is a lot of money,” said 82-year-old Walter Yamka of Oakville.
“I thought I was on the PC Financial website.”
Yamka said it was last October when he had $750,000 worth of GICs mature and decided to search online to find the best interest rate possible.
Fraud is complex and requires action from all stakeholders.
User mitigating controls:
- Always enter your bank’s full URL or save it as a bookmark in your browser.
- Never access your online banking through a search engine or social media platform.
- Use a password manager that restricts credential entry to the correct domain.
- Use phishing resistant MFA factors (ex. Authenticator app instead of SMS).
- Setup alerts on your bank’s app (ex. new bill payment vendor added, new e-transfer recipient added, transaction >$X).
Bank mitigating controls:
- Staff fraud awareness training to detect red flags.
- Customer fraud awareness training.
- Transaction monitoring solution that detects anomalous transactions.
- Multi-factor authentication (MFA) at login.
- Step-up when adding new BP recipients and performing high value transactions.
- Offer phishing resistant MFA/step-up factors (ex. Authenticator app, document + selfie ID verification).
- Behavioural analytics that detects when a login is not the normal user.
Government mitigating controls:
- Require banks to implement a minimum level of security controls for their users.
- Require digital platforms to verify advertisers to protect Canadians.
- Implement a shared liability policy between users and banks.
- Fund dedicated financial crime law enforcement units.