A Manitoba man has pledged to continue fighting after thousands of dollars were taken from his account in a suspected fraud, which his credit union says is partially his fault.
Last month before Christmas, Jeremy Carlson received a rapid series of notifications from his banking app that a $20,000 cheque was deposited into his account and added multiple payees.
Before Carlson knew what happened and could change his passwords, $31,850 had been drained from his account.
RUTH BONNEVILLE / FREE PRESS
Jeremy Carlson had $31,850 drained from his Steinbach Credit Union bank account.
“The damage had already been done,” he said Friday.
Carlson reported the fraud to Steinbach Credit Union, where he’s been a member for 12 years, and an investigation was opened.
About a month later, the credit union notified him he would only receive $25,000 of his funds back, per their insurance policy. It claimed his phone and passwords were vulnerable.
“They said, ‘No, we’re not covering it because your phone wasn’t safeguarded,’” Carlson said. “I was like, ‘Well, wait, I don’t recall going over with you how I stored my passwords.’ It was just, ‘Do you store passwords on your phone?’ Yes. Who doesn’t, right?”
The ventilation tradesman considers himself a tech-savvy person and uses a cloud-based app to store his passwords. He says he doesn’t know how his account could have been compromised and SCU hasn’t been helpful in getting to the bottom of it.
Because of the breach, Carlson had to navigate the holidays with little money and was forced to drain his credit cards and borrow money. He says the incident has set him back four months worth of pay.
“It’s not something a one-income family can withstand.”
Despite SCU transferring the $25K into his account, Carlson says he does not accept the credit union’s offer and has been in contact with RCMP and the Credit Union Central of Manitoba ombudsman. He’s also signed up for six years of credit monitoring.
About five weeks before the fraud, SCU informed members its contact centre was breached. For 24 hours starting Nov. 12, incoming calls to SCU were redirected by an unauthorized third party to an outside number. Two months worth of call logs were compromised.
Members were directed to a website to check if their numbers were involved in the breach, which SCU said could leave them at a higher risk of fraud.
Carlson was among the members impacted and suspects that’s the source of the hack.
“Why would I call the bank and not share pertinent information if I’m calling for a question on something, right? The first thing they ask is your name, and then your verbal password so they can get into your account, right?” he said.
A spokesperson from SCU said the credit union couldn’t comment on Carlson’s case due to privacy but works with members to “do all that we can to support them” when fraud occurs.
“SCU makes every effort to recover as much of the loss as we can — unfortunately, this isn’t always possible. In those cases, we look at whether recovery through our fraud insurance may be possible,” an emailed statement read.
The spokesperson said an investigation into the Nov. 12 breach determined banking systems were not impacted by the hack.
Hernan Popper, the founder of Popp3r Cybersecurity Consulting Inc., said it should be the bank’s responsibility to ensure client information is protected and they should be reimbursing Carlson for the full amount.
“Even if the client has a weak password, the banking organization should have measures in place in order to prevent these kind of things,” Popper said.
Fraudsters can gain access to accounts through various avenues, but reusing passwords is the most common way. The cyber-expert encouraged people to use unique passwords for each account they have, be it for banks or social media, to keep their information and accounts secure.
Popper said if he were Carlson, he would fight to hold SCU accountable.
“Saying that the password was weak, for me, is showing that whatever system this credit union is using to authenticate the users is severely lacking,” he said.
Carlson says he will continue to fight — even if it means protesting outside a branch.
“I’m going to use my free speech and stand out there with a sign and maybe it will bring some people out of the woodwork and let them know that they don’t have to accept what the banks tell them and they can fight for what’s theirs,” he said.
nicole.buffie@freepress.mb.ca
Nicole Buffie
Multimedia producer
Nicole Buffie is a multimedia producer who reports for the Free Press city desk. Born and bred in Winnipeg, Nicole graduated from Red River College’s Creative Communications program in 2020 and worked as a reporter throughout Manitoba before joining the Free Press newsroom in 2023. Read more about Nicole.
Every piece of reporting Nicole produces is reviewed by an editing team before it is posted online or published in print — part of the Free Press‘s tradition, since 1872, of producing reliable independent journalism. Read more about Free Press’s history and mandate, and learn how our newsroom operates.
Our newsroom depends on a growing audience of readers to power our journalism. If you are not a paid reader, please consider becoming a subscriber.
Our newsroom depends on its audience of readers to power our journalism. Thank you for your support.