In another incident, a lawyer set up banking access with assistance from a legitimate bank support team. Later that day, when the lawyer tried to access the account, the lawyer could not log in. The lawyer then received a call from someone claiming to be from the bank, who said the account had been locked because of too many attempted logins. At the caller’s direction, the lawyer entered verification codes several times. The lawyer did not see completed transactions in the account history, yet the account balance was decreasing. The bank recovered the funds, but the firm’s trust account was placed on hold. 

In a third incident, a lawyer received a call from someone claiming to be from the bank. The caller asserted that the lawyer’s account had been compromised and urgently needed to be reset. The caller referred to legitimate account transactions and provided the lawyer’s PIN number. At the caller’s direction, the lawyer provided a two-factor authentication token code. The lawyer then visited the bank branch in person, where staff confirmed the call was a scam. The bank placed restrictions on the account, but not before multiple transactions had already been processed and funds stolen. 

Protect your firm and your clients 

The Canadian Anti-Fraud Centre provides the following guidance about warning signs and tips to protect yourself from frauds like these:   

• Do not assume that phone numbers appearing on your call display are accurate. Fraudsters can use “call-spoofing” to manipulate the phone number appearing on call display either by call or text message. Fraudsters can display legitimate phone numbers for law enforcement agencies, financial institutions, government agencies, or service providers. 
• If you receive a call from someone claiming to be from your financial institution, advise the caller that you will call them back. End the call and dial the number on the back of your bank card from a different phone if possible or wait 10 minutes before making the outgoing call. 
• Similarly, if you receive an incoming call claiming to be from a credit bureau, advise the caller that you will call them back. Visit the credit bureau’s website and contact the official phone number provided. 
• Do not share codes received via text message or email with anyone. In most cases, these are multi-factor authentication codes that will give fraudsters access to your account. 
• Never provide remote access to your computer. 

When dealing with financial institutions, Canadian Anti-Fraud Centre further suggests that you keep these items in mind: 

• Fraudsters often provide the first four to six numbers of your debit or credit card—this is not proof of credibility. These numbers are used to identify the card issuer and are known as the Bank Identifier Number (BIN). Most debit and credit card numbers issued by specific financial institutions begin with the same four to six numbers. 
• If your personal information has been compromised in the past through a breach or a phishing message, the information can be used as a tool to make the communication appear legitimate. 
• Legitimate financial institutions, merchants, and law enforcement will never: 
  • threaten you over the phone;  
  • request that you transfer funds to an external account for security reasons; or 
  • request you to turn over your bank card nor attend your residence to pick up your bank card.