A Calgary man is warning others about a fraud that involves forwarded mail after he narrowly avoided being a victim of identity theft.
The man, who was on a three-week vacation in Europe, returned to a stack of mail that revealed an attempt to forward his mail to an undisclosed address.
"I found two mail forwarding confirmations from Canada Post, one in my name and one in the name of a party I didn't recognize, it was a foreign name," Brian told the Calgary Eyeopener.
CBC has agreed to use only Brian's first name.
"So I obviously was suspicious. And I phoned Canada Post and I cancelled it. And I was fortunate because I got home two days before the mail forwarding was supposed to take effect."
Brian said Canada Post would not tell him who had attempted to redirect his mail.
"Canada Post wouldn't tell me that," he said. "Only after I asked repeatedly, they told me it was an address in B.C., but they wouldn't give me that information."
Canada Post advised Brian to contact credit agencies Equifax and TransUnion, which he says he did.
"About a week later, I started getting credit cards in the mail, one in my name and another in the name of the individual, the other individual that was having the mail forwarded from my address," he said. "And when I phoned Visa, I found out that somebody had successfully ordered secondary cards on my credit card. So there were additional credit cards being issued by Visa through a bank in my name and this other name.
Brian immediately called his credit card company, Visa.
"They wouldn't tell me much, either. It was only through my personal due diligence that I found out that it's pretty easy to get another credit card on your account. What you need is your name, your address, your date of birth, and you need a password."
Brian wants to warn others against a very common password practice.
"My verbal password was the one they asked me for when I originally opened up telephone banking, which was maybe 10 years ago. And it was my mother's maiden name, which was what the banks ask for," he said. "Doing some research, we found that a mother's maiden name is a tradable commodity on the dark web."
Brian says your mother's maiden name is an easily compromised password.
He is relieved to have avoided being a victim but alarmed at how easily it could have happened.
"So if you think about it, you go to a hotel. You give them your passport. You give them your credit card. And then you fill out this form with your address. So I'm just speculating here, but I'm guessing it was an inside job at a hotel where they had all of my critical information," he said. "And they knew we were away."
Had Brian not returned home a couple of days before the mail forwarding was to start, all his mail would have begun to be forwarded — including the credit cards that were ordered by phone through Visa.
"So they would have had my credit cards both in my name and in their name," he says.
CBC contacted Canada Post to ask about this mail forwarding fraud.
An email response from Canada Post's media relations department indicates the agency has many checks and balances.
"For all in-person or online Mail Forwarding requests made, Canada Post follows a multi-pronged identity verification process … To avoid undermining our security approach, we don't publicly discuss the specific measures we take."
The email goes on to say that Canada Post works closely with with the Canadian Anti-Fraud Centre, banks and police, and that issues related to fraud go far beyond Canada Post.
"For example, someone who successfully manages to reroute someone's mail to an address has likely fraudulently obtained and used personal information, for an item such as a credit card, prior to the Canada Post Mail Forwarding request being made."
Bottom line, if you've received notification of an address change from Canada Post that you did not request, make contact immediately. From there, the case will go to the Canada Post fraud centre, the Canadian Anti-Fraud Centre and credit bureaus to double check credit reports.
Brain, who narrowly avoided being a victim, is not ready to leave it to the system.
"Obviously, this is something that someone was able to do without too much effort," Brain said. "Quite honestly, when I phoned Canada Post, I got, I think, three or four calls from different departments, you know, from the DPL and from head office and from the fraud department. And the left hand didn't really know what the right hand was doing. I certainly didn't have a lot of confidence after talking to Canada Post that they're on the case around security."
Brian thinks it's worth a warning.
"This was easily done. All they need is a driver's licence, from what I can tell, in order to forward someone's mail," he said. "And if you have somebody's vital information, it's pretty easy to get a fake driver's licence."
CBC contacted the Canadian Anti-Fraud Centre for more information on this type of mail fraud.
"Currently the data we collect in relation to ID Fraud involving mail forwarding is incomplete and difficult to collate," a representative wrote in an email.
An attached summary report indicates that agency received 9,434 complaints of ID theft and 8,836 reports of ID fraud from Canadians in 2018. That's similar to 2017, when the agency received 9,660 and 8,737 reports, respectively. Numbers for 2019 are still being collected, but the report notes that overall, the agency estimates these numbers represent "less than five per cent of the total number of actual victims."
The agency website reminds Canadians not to give out sensitive banking or identity information, including driver's licence number, social insurance number over the phone or the internet, and advises getting a free credit report once a year from Equifax or TransUnion.
More information is available at antifraudcentre.ca or by calling the Canadian Anti-Fraud Centre at 1-888-495-8501.
