Steinbach Credit Union member warns others after scammer steals $10K

A Winnipeg single mother whose bank account was drained of nearly $10,000 says Steinbach Credit Union needs to warn its members about what she believes is a broader security problem.

The woman, who is not being named to protect her identity, said a scammer gained access to her account earlier this week after calling SCU’s contact centre, claiming to be her and successfully completing the credit union’s authentication process.

She said she knows of at least six others who have experienced similar incidents in which callers impersonate SCU account holders and pass the authentication checks.

The woman discovered something was wrong when her minor son asked why money had been transferred out of an account they jointly hold.

Having made no such transfer, she attempted to log into her online banking account and learned her credentials no longer worked.

She immediately called SCU.

“I heard a little hitch in the voice on the other end,” the woman said. “They told me that there was a bill payment for almost $10,000 that had been made out of my account. I was like, ‘come again?’”

“Someone needs to know about this, because it’s crazy.”

She was transferred to SCU’s fraud department, where she was told an investigation would have to take place and it could be four to six weeks before the money was returned.

“I need to preface this with it’s not so much that it happened, because s—- happens, criminals are smart,” she said. “It was the way that the credit union was dealing with it that was abhorrent. Someone needs to know about this, because it’s crazy.

“I’m a single mother. I asked them, ‘How am I supposed to feed my kids tomorrow?’”

She said she later spoke with a manager who told her the credit union would do its “best to get the money back.”

“I was like, ‘What do you mean you’re going to try?” the woman said.

The woman said she threatened to take her story to the media and seek legal counsel if the money was not returned within 24 hours.

“Magically, the next day, I have this statutory declaration that I had to go fill out and I got my money back,” she said.

In a subsequent email viewed by the Free Press, an SCU assistant manager of compliance told the woman a review found the credit union’s contact centre had received a request from a caller claiming to be her. The caller was able to complete the authentication process, according to the email.

The email also acknowledged such an incident could shake a “member’s confidence” in the institution and their “sense of security.”

The woman said he concerns extend beyond herself.

“I also told them that they have a problem and they’re not telling anyone. Shame on you. These credit unions purport themselves to be for the people, by the people. I said if I was newcomer, if I was a recent immigrant, and if I was a young, single mom and I didn’t know how to play your game, I’d have no money right now.”

“This is a larger issue,” the woman said.

Earlier in the week, the Free Press received another tip that an SCU member had been scammed out of $15,000 through a compromised account and that the money was sent out via a bill payment.

The tipster said that four others they know had experienced a similar situation, with about $300,000 being lost. Similar details of the customer service process were cited, including that it could take weeks or months for an investigation to take place and their money returned.

The Free Press has been unable to verify the tip.

“If I was a young, single mom and I didn’t know how to play your game, I’d have no money right now.”

The woman, meanwhile, said she is now moving her money out of SCU because of the breach and how her case was handled.

The Free Press reached out to SCU for comment Wednesday but did not hear back until Friday afternoon.

“SCU takes the security of member information and accounts very seriously,” a statement from the credit union said. “At this time, we are not aware of any broader compromise of SCU systems. To protect the privacy and confidentiality of our members, we do not discuss the details of individual investigations or member accounts.”

The credit union also said it continually monitors for fraud activity and regularly reviews controls and processes to help protect members.

“When concerns are identified, we take immediate steps to protect members, secure affected accounts, and support impacted individuals,” the statement said.

SCU did not answer followup questions on how scammers were able to fool contact centre staff, or what tangible steps are being taken to prevent similar incidents from happening again.

scott.billeck@freepress.mb.ca