TD Bank holds customer responsible for $15K loss, won't say how account hacking ruled out

TD cant is holding a Dartmouth, N.S., adult male responsible for(p) for nearly $15,000 transferred come out of his calculate — but it won't explain how it determined his account wasn't hacked.

Shakir Ahamed says he was at work last July, handling payroll for the Canadian Coast Guard in the Maritimes, when he received a text from TD warning that he was approaching the limit on his line of credit.

"I'm panicking," said Ahamed, who says he hadn't touched his line of credit and immediately knew something was wrong. "Kind of like a heart attack."

He drove straight to his local TD branch and learned that a series of unauthorized "accept request" e-transfers had been made over several days, leaving him out nearly $15,000.

"These are clearly fraud transactions," Ahamed said he remembers saying to himself. "We trust the bank. If anything happens, the bank will reimburse me. That was my first thought."

He contacted TD's fraud department and filed a report with Halifax Regional Police. A few weeks later, TD sent Ahamed a text message, saying he was responsible for the loss.

A TD Bank customer says he lost $15K to account hacking. The bank holds him responsible | Go Public

When he appealed, the bank said the transactions were conducted using Ahamed's IP (Internet Protocol) address and that one-time passcodes had been entered.

He says he should have received 10 passcodes but never got any on his phone or by email. He only learned of the transactions, he says, eight days after they began.

Ahamed took his case to the Ombudsman for Banking Services and Investments (OBSI), but it did not recommend compensation, saying his sign-in credentials were used.

Go Public asked TD how it ruled out IP hijacking, malware, account takeover or other forms of cyber compromise before concluding Ahamed was responsible for the transactions.

The bank declined an interview request but said it confirmed that one-time passcodes were sent to Ahamed's phone and that his regular device was used to complete the transactions.

In a written statement, Ashleigh Murphy, senior manager of corporate and public affairs for TD, said the bank understands that "situations involving suspected fraud can be stressful and concerning for clients" and that TD has "multiple layers of security, monitoring and customer education in place."

Cybersecurity expert Claudiu Popa says TD has not demonstrated that Ahamed was negligent.

"No evidence of negligence was provided by the banking institution," said Popa, author of the Canadian Cyberfraud Handbook, a highly regarded corporate reference book on digital fraud. "And I don't know why that is, because if I were the bank, that's the first thing I would show."

Popa said TD appears to be relying on indicators that do not necessarily prove a customer authorized transactions.

"Spoofing devices is actually very easy," he said.

Increasingly, Popa says, financial institutions are denying reimbursement claims while providing little evidence that customers were responsible for what happened.

"They are putting all of the responsibility and the accountability on the victim," he said. "They're simply saying, 'Trust us, there's a problem with this transaction — and it's not us.'"

"I am totally frustrated, totally angry," said Ahamed, a husband and father of two who says the loss amounts to almost one-third of his annual salary. "I expect banks to protect our money."

Ahamed went into debt after money was transferred from his line of credit over three days, in increments of about $1,500 until almost $15,000 was gone.

The money went to established companies — Kraken, a cryptocurrency exchange, and Payper, a payment processing company — using email addresses Ahamed says he did not recognize.

Searching those email addresses online — payper@kraken.com and et@payper.ca — Ahamed found they had been linked in previous news reports by Thorold Today to at least two other fraud cases involving TD customers.

"It was shocking. Very shocking," he said.

In one case last summer, Canadian military veteran Michael Panetta of Welland, Ont., had nearly $10,000 withdrawn from his account. After challenging TD's decision, Panetta was reimbursed, but he was required to sign a non-disclosure agreement and cannot discuss the details.

In another case at around the same time, Kelly Enair of Thorold, Ont., lost $3,000 after money was fraudulently transferred. TD offered Enair half her money back, but she told Thorold Today that she's entitled to full reimbursement.

Popa, the cybersecurity expert, questions why transfers involving recipients previously associated with fraud allegations would not trigger additional scrutiny, particularly when they involve repeated transfers over a short period of time.

Financial institutions, he says, should also be examining whether transactions fit a customer's established banking behaviour.

"Why not contact the customer and say, 'We stopped this. Did you really mean to put your money through to this recipient?'" Popa said.

TD spokesperson Murphy dismissed that idea, saying "customers may send e-transfers to email addresses associated with cryptocurrency or investment platforms."

For Ahamed, the loss is particularly difficult to understand because suspicious activity had already appeared on his account one month earlier.

Someone tried to e-transfer $1,900 from his account, but Ahamed says he immediately headed to a TD branch and reported the transaction.

At the time, he says, a bank teller was able to recover his money and told him additional security measures had been put in place. But one month later, nearly $15,000 was gone.

According to TD, "all of the transactions reviewed were authenticated through two-factor verification." But Ahamed says he never received any messages asking him to authorize the transfers.

Two-step verification can be enabled when a new device or browser is used, but that protection may not be triggered if an existing account has been compromised.

"How am I supposed to know what's happening in my account if I don't receive any notification?" Ahamed asked.

Popa says investigators trying to determine what happened should be looking closely at whether the transactions matched Ahamed's previous behaviour.

"What's the activity that typically takes place on that account?" he asked.

Ahamed’s banking records show mostly small transactions — not repeated $1,500 transfers drawn from his line of credit.

"If you are a banking institution, that should ring some bells and light up a whole bunch of light bulbs," Popa said.

The cybersecurity expert says stronger consumer protection laws are needed to better protect Canadians who fall victim to fraud.

Popa points to the U.K., Singapore and Australia, where reimbursement frameworks place greater responsibility on financial institutions when fraud occurs.

In those jurisdictions, if a financial institution cannot demonstrate gross negligence by the customer, victims can be reimbursed, with costs often shared between the sending and receiving institutions.

"So they are incentivized to have proper anti-fraud controls in place," Popa said.

Go Public asked Finance Minister François-Philippe Champagne why Canada does not have similar protections, despite calls for such legislation from consumer advocates and the banking ombudsman during last year's Bank Act review.

The minister did not directly answer the question.

Instead, he said the federal government has launched consultations on a national anti-fraud strategy to examine international "best practices."

Meanwhile, the Canadian Anti Fraud Centre says Canadians reported a record $704 million in fraud losses last year, up from $638 million in 2024. The agency estimates that actual losses are significantly higher, because only five to 10 per cent of victims ever report the crime.

Ahamed says he has since deleted the TD banking app from his phone and now accesses his account only through his work computer, which has strong security software.

But the financial consequences continue: TD has begun collecting payments on the debt, he says, including more than $100 a month in interest alone.

"I can't explain in words how big this is on me," Ahamed said.

We tell your stories, shed light on wrongdoing and hold the powers that be accountable.

If you have a story in the public interest, or if you're an insider with information, contact gopublic@cbc.ca with your name, contact information and a brief summary. All emails are confidential until you decide to Go Public.

Read more stories by Go Public.

Read about our hosts.

Investigative reporter

---

---