August 14, 2020 – Since spring, scammers have been using Canadian’s personal data to defraud the emergency programs such as the Canada Emergency Response Benefit (CERB) set up by the government to quickly provide money to people who lost their jobs during the COVID-19 pandemic. The CERB is a multi-billion dollar payments program that provides Canadian residents a taxable benefit of up to $2,000 per month. The Canadian federal government launched the temporary income-support program on April 6 for people who have stopped working or have reduced income due to the COVID-19 pandemic. Unfortunately, the program comes with an elevated risk of fraud. By June the CAFC received 713 reports of identity fraud involving CERB. Quebec, Ontario, and British Columbia are the top three provinces with the most reports.
Numerous people reported that their identities have been stolen and used to cash in on one of the pandemic relief programs such as a woman from Kitchener. She received an email from the Canada Revenue Agency (CRA) saying her direct deposit information had been changed. Moreover, the message said that her CERB application has been approved for July and August and that the funds would be directed in two to three days. However, she did not initiate the change of her banking information, nor did she apply for the CERB benefit.
This is one of many similar stories of people having their identity stolen and used to defraud the pandemic programs: Fraudsters open bank accounts in their victim’s name, hack into their CRA account and submit CERB applications, after they changed the direct deposit information on the CRA account to the bank account they have opened in the victim’s name.
Check your online CRA account
There are cases of fraudulent CERB applications using stolen identities all over Canada. A Port Coquitlam woman received an alert three days after somebody hacked her CRA account. The alert said that her email address had been removed from the account. When she checked her account, she discovered that a fraudster had filed an application for two CERB payments and changed her direct deposit information to a TD account in Toronto. A Maple Ridge man learned about the criminal use of his data when a brand new Tangerine bank card with his name on it arrived in the mail, although he has no account with the bank.
To avoid nasty surprises, experts recommend Canadians to check their online CRA account regularly to ensure all information is accurate and they have secure passwords. People with online CRA accounts are also advised to sign up for email notifications from the CRA. That way, they get informed when their address or banking information for direct deposit is changed. The police advise people who access their CRA accounts and see that their information has been changed or who cannot access their accounts anymore because the passwords have been changed to contact the CRA immediately at 1-800-959-8281 or online.
Identity fraud is frustrating
A more recent and rather well-known victim is the mayor of View Royal, David Screech. The Times Colonist reported that his personal information has been compromised and used by someone in Ontario to apply for two months of pandemic financial relief.
The View Royal mayor expressed his agitation regarding the incident and that he is concerned about what else the fraudsters could do with his personal information such as his social insurance number.
‘I feel violated. I feel like somebody could be doing more with the information they have of mine,’ said a CERB identity fraud victim from P.E.I. to CBC News. ‘My next step now I guess is going to be checking on my credit score,’ she added.
Experts recommend that victims of fraud should collect all information relating to the fraudulent incident such as documents and emails. Then, they are advised to contact the CRA, their financial institution(s), and to contact the police to report the incident. Unfortunately, in many cases, the responsibility lies with the victim to prove that their personal information has been used by a fraudster.
All the reporting can be frustrating. Especially, when there is no one to report the incident to. When an Edmonton man tried to report that his information has been used fraudulently to claim two months of CERB payments on a Monday night, the Bell Media employee could not reach the CRA because they have no phone line dedicated to fraud and no service after work hours (Eastern Time).
Mail theft, data breaches, and phishing schemes
The View Royal mayor also described that he was disappointed that no-one could explain how the criminals managed to get into his CRA account. The CRA only says that scammers can get taxpayers’ data through mail theft, data breaches, and phishing schemes. That basically means, victims will probably not know that they are at risk until their stolen information has been fraudulently used.
To protect yourself from phishing schemes, the Better Business Bureau recommends not to click on links or download attachments from unknown or unsolicited emails. People are advised to check for the embedded hyperlink in the suspicious email by hovering the mouse over the link to verify the address. Recipients of unsolicited emails should have a closer look at the sender’s email address. Sometimes the fraudster will add an extra dash, dot, or letter to the email address of the person or company they are trying to impersonate. Apart from that, people can only stay vigilant, empty their mailboxes regularly, and change their login credentials from time to time.
The CRA said that they are trying to identify and prevent high risk or suspicious applications. But more importantly for the victims, the CRA clarified that, people who are confirmed cases of identity fraud won’t be held responsible for any money paid out to scammers.
Balance out fraud prevention and a quick process for legitimate applicants
Nevertheless, even if the CRA is investigating and took measures to avoid further damage to the CRA accounts of identity fraud victims, people are still affected by the fraud. The agency froze a Toronto music manager’s CRA account because they launched an investigation into an employment insurance (EI) claim fraudulently made in her name. She lost her job due to the pandemic and is currently obtaining CERB. But because of the fraudulent EI claim, she already missed one payment on which she depends at the moment.
Now, she has to live with the payment delay resulting from the identity fraud, not knowing when she will get her next CERB cheque. But also people who are not victims of identity theft reportedly experienced payment delays.
Since the concerns about fraudulent applications to the pandemic relief programs have grown, the federal government implemented controls such as the need to validate certain applications before they are processed, resulting in payment delays for some applicants. One of the reported red flags that entail validation by the CRA is the change of the direct deposit information shortly before applying for a pandemic relief program.
In June, the CRA told a House of Commons committee it had already detected several potentially fraudulent applications, including from people believed to be involved in organized crime. The CRA designed the CERB application processes to be attestation-based to guarantee a quick process for legitimate applicants for government aid meant for people who need it most. Unfortunately, this approach comes with an elevated risk of fraud and waiting until tax time next year to conduct reviews as announced a few months ago, would likely be too late to recoup any funds lost to organized crime.
How to protect yourself from identity theft
The Canadian Anti-Fraud Centre (CAFC) assumes that between March 6 of this year and end of July Canadians lost $5.55 million to scams linked to COVID-19. The reported cases are only the tip of the iceberg. Throughout the pandemic, hundreds of Canadians have had their identity stolen and used to apply for government benefits. The federal government said that by June the CAFC received 713 reports of identity fraud involving CERB. Quebec, Ontario, and British Columbia are the top three provinces with the most reports.
Even before the pandemic, identity fraud was a problem on which Canadians lost about $21.2 million in 2018, according to the Chartered Professional Accountants of Canada. To protect people from identity theft, the CRA advises to never provide personal information through the internet or by email, not to click on links in any email and to keep credentials and PINs as well as the social insurance number secret. For more information see the CRA’s website.
