Information & Ethics Committee on May 29th, 2014

[Ed Rosenberg]

Let me take that.

Again, I think what Philip was articulating is that we look at fraud very differently. Both of those, be it a fictitious person or a real person, will manifest itself in identity fraud, if you want, or fraud on our shores. However, we would view them as significant risks.

Synthetic ID is a big concern for us. One of the challenges we have is to ensure that when we authenticate a client and validate the transactional activity that they're doing, we have some mechanism we can actually reconcile to, for example, to say that this is Mr. Andrews and these are Mr. Andrews' transactions, and therefore we will allow, conduct, the transactions for him.

It's difficult for us. Synthetic ID is a big concern because we have no control over the establishment of the ID, the production of that ID, but we deal with the manifestation when it's presented to us to conduct those transactions.

They're both very big topics for us. To quantify them would require a deeper dive into our respective systems to pull out the number.

[Scott Andrews, Liberal, Avalon, NL]

That leads into my next question because, Mr. Fisher, you mentioned free credit monitoring. We had the credit agencies here. I think they're the front line, and they'll say, “No, we're kind of the front line, but the banks are the front line.” Who is the front line on raising the red flag?

On the free credit monitoring that you mentioned, Mr. Fisher, I just want to dive a little bit into the role of the credit agencies and the relationship with the banking industry.

[Philip Fisher]

For the free credit bureau monitoring, we have a relationship with the credit bureau. Our clients can go onto our site and they can sign up for this service. Then when the credit bureau gets an inquiry on the client's account, what happens is they pass the information back to us, and then we ultimately send it on to the client to investigate.

We'll tell the client which merchant was inquiring on their credit bureau file, what type of hit it was, and when it was done. There is even contact information available for the merchant who was doing the inquiry.

In this particular case, we would be fronting for the credit bureau.

[Jay Stark]

We've actually established a relationship with the credit bureaus, and particularly with Equifax, where we screen all the credits using both analytics and negative databases. So I think it's a joint effort among the credit bureaus and the banks.

[Scott Andrews, Liberal, Avalon, NL]

One other thing you mentioned was about cheque fraud, Mr. Stark. Can you elaborate a little bit on cheque fraud with identity fraud? Are they separate?

[Jay Stark]

I think to Mr. Rosenberg's point, we need to spend a little bit more time and go through the whole cycle.

We see some manifestation of identity theft in the cheque space. Somebody might take over an account—an account takeover. What I worry about more is where the funds are going, so where the frauds are going. We follow those frauds and we mark those frauds. We see a number of instances where people will come in with false identities to set up corporations, for instance, and be beneficial owners, or they'll be directors. Those ones are a little bit more problematic because they will now be laundering funds.

We spend a lot of time looking at that. We also spend time looking at the account takeovers of somebody's particular account.

Cheque fraud is pretty prevalent, whether it has a piece of identity theft or not, or whether it's just a straight-out fraud. We call it a first party fraud.

[The Chair, NDP, Pat Martin]

Thanks you very much, Scott. I'm afraid that wraps up your time pretty much.

I think we have adequate time to get to our votes, but first there is one point of clarification I'd like from your testimony, Ms. Frook.

There is a growing sense that the public has a right to know if their personal information has been compromised. There is talk about a duty of notification in legislation that's pending. In your testimony you said that it is your policy to notify the individual, and not the Privacy Commissioner and not the credit bureau, if their identity has been compromised or if there is fraud taking place in their account.

Our understanding is that it's not the case. My credit card can be compromised and you'll fix it and make me whole, but I will never know about it.

Is it the policy of your bank that you tell every victim of identity theft that their personal information has been compromised?

[Jennifer Frook]

In the specific case that you mention in terms of a credit card fraud, when we at Scotiabank are made aware of a number of our customers who have been the victim of a compromise, we do reach out to our customers. We explain that we believe their credit card has been compromised and that we are going to take proactive measures to protect them from having fraud on their accounts.

[The Chair, NDP, Pat Martin]

What about on an individual basis? You said when it's a group. Obviously, if it was a big issue, as when CIBC had all their trouble, the public knew about it, but what about as an individual?

[Jennifer Frook]

Even in individual cases, again speaking specifically to your comments about debit and credit fraud, we at Scotia would never reach out and just cut off your access to credit. We would attempt to notify you. We very much like some of the technology we have available where we can reach out to you with electronic means. You don't have to wait for that telephone message at home; we can alert you immediately.

[The Chair, NDP, Pat Martin]

That doesn't quite answer the question—

[Jennifer Frook]

I'm sorry. I apologize—

[The Chair, NDP, Pat Martin]

What I'm trying to get at is, is it the view of the five major chartered banks that you would support the duty of notification that's being contemplated in the legislation that's going to be coming down the pike? This means you would have to inform the victim that their personal identity has been compromised. Is it your practice currently? Would you support it being codified and mandated in legislation?

[Paul Milkman]

It is TD's practice today to notify all individuals who have been compromised, or we suspect have been compromised. For all material or larger systemic things, we would also notify regulators, the Privacy Commissioner, etc., but on an individual basis, to answer your specific question, it is our policy to do that today.

[Jennifer Frook]

Scotiabank would echo that.

[The Chair, NDP, Pat Martin]

I think we're pretty well out of time, folks. We're going to suspend the meeting. If there's interest, perhaps there are others who would like to respond to the same question. It is a top of mind issue with a lot of Canadians, and it's something we're going to be wrestling with, with legislation.

Mr. Rosenberg.

[Ed Rosenberg]

I believe we generally are supportive of the model and the legislation that's before the House. That's the first statement.

On the second one, the individual basis, most of our systems aren't geared to identify fraud at the individual level. I think Mr. Fisher articulated that we rely upon our customers to review their own transactions. In fact, they become the first line of defence for us. Then it becomes a one-on-one relationship with the customers, and through that dialogue, if they are a victim of identity theft, there are steps that we lead them through to protect them, and it's the bank's obligation to do that.

[The Chair, NDP, Pat Martin]

Mr. Stark.

[Jay Stark]

I would echo TD's comment.

We notify the individuals, and we would notify the Privacy Commissioner if there was a relevant or significant breach. We do have a joint committee of compliance and fraud, and a number of other parties that would actually look at that and make sure that the appropriate parameters have been put forward to ensure that the Privacy Commissioner is told.

[The Chair, NDP, Pat Martin]

Mr. Fisher.

[Philip Fisher]

CIBC shares the same views as the other witnesses.

[The Chair, NDP, Pat Martin]

Okay, that's very helpful.

Thank you very much, folks. We're going to suspend the meeting. We'll thank our witnesses and excuse them. We will reconvene here right after the vote for roughly a 10-minute planning meeting, in camera.

[Proceedings continue in camera]