Public Safety Committee on April 8th, 2019

[Terri O'Brien]

Interac has developed and deployed our own token service provider. It's correct in that we are not using any other provider, whether it's Mastercard or otherwise. We have our own token service provider. We deploy our own technology because it is so secure and because we can manage and maintain the security around it.

[The Chair, Liberal, John McKay]

Thank you, Ms. Sahota.

Mr. Paul-Hus, you have the floor for four minutes.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

Thank you, Mr. Chair.

I want to thank everyone for being here. We're sorry about the disruption resulting from the votes in the House.

In the case of Interac, if I make a transfer, the recipient will have 30 days to accept the funds. Where is the money from my bank account stored on a virtual level? How does this work?

[Terri O'Brien]

That's a very good question. I think the question is directed toward our Interac e-Transfer product, which has several different options. Auto-deposit is an immediate, real-time transaction. The one that you described is called our question and answer type of transaction. That's where the recipient would like a security question answered to deposit the e-transfer transaction. In that case, since a person may not be on their email on a daily basis, they are given 30 days to accept the transfer. What happens, however, for the person sending the transaction is that the money is taken from their account. It's a good-funds model, so the funds are available. It's held by the sending financial institution in a suspense account, and then, once the security question is answered, the funds are released. At all times they are secure.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

I gather that, if I do business with the Royal Bank, the money doesn't go to Interac. The money will remain in a Royal Bank account.

There's often a concern. Once the transfer is made, we have no more contact. We wait for the recipient to accept the funds. However, if the person doesn't receive the money, we worry about where the money has ended up. So the issuing bank has it.

I'm trying to understand the technical system. From a virtual standpoint, could another person intercept the transfer? Could a hacker intercept a transfer? What could be done in that type of situation?

[Terri O'Brien]

The answer is no. It's a highly secure, closed-loop, private network. While Interac operates the infrastructure, Interac also has the operating regulations and governance through which the transactions transfer from each financial institution. What we are facilitating is the financial institution that wants to employ the question and answer or Q and A type service. At no time, though, could the transaction be intercepted in transit. It is securely held at one financial institution and then, once released, the payment across the Interac infrastructure is securely facilitated into the receiving institution.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

You're saying that the transfer process is perfectly secure. There's no way to interfere with it.

[Terri O'Brien]

That's correct.

We have a fully secured, closed-loop private network among the almost 300 financial institutions, credit unions and caisses populaires across Canada.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

You spoke a bit about the government. What current legislation should be amended and made more effective for you? Certainly some legislative measures aren't effective and should be improved.

[Terri O'Brien]

That's a wonderful question.

We actively work with the RCMP and law enforcement today on the exchange of some information, although it often requires a production order. We would suggest that certain privacy and other safe harbour legislation could be opened that would allow a much more targeted approach among the trusted channels that we have today, whereby we could effectively focus and manage the cybercrime in a much more targeted way.

We find that our communications today are quite effective, but they are unspecific and constrained in many ways. We think there definitely are legislative options that would allow for more open sharing of that information, which would benefit—

[The Chair, Liberal, John McKay]

Thank you, Mr. Paul-Hus.

With that, I'm going to suspend, and we'll resume as soon as possible for another hour. There will be no motions or anything else.

Again, I thank you for your patience.

[The Chair, Liberal, John McKay]

We are back on. I see quorum.

Mr. Motz, you have never been more popular in your entire life.

We're going to go with four minutes, then four minutes, and then we'll go to five-minute rounds. Mr. Dubé would normally be up next, but I don't see Mr. Dubé, so I'm going to go to Mr. Picard. When Mr. Dubé arrives, we'll go back to Mr. Dubé.

Again, thank you for your patience.

Mr. Picard, you have four minutes.

[Michel Picard, Liberal, Montarville, QC]

Thank you.

Ms. O'Brien, you talked about cybercrime and fraud. What is the nature of the fraud you detected on your system, to which you've reacted in the past?

[Terri O'Brien]

The fraud is constantly changing, and it also moves around based on vulnerabilities at the different financial institutions. The most common fraud that we see is what we call account takeover fraud. In the earlier example, we were speaking about some of the phishing exams, a person's credentials or personal, identifiable information that allows criminals to overtake their bank account. Then they start a systemic practice of draining the funds from that bank account, sometimes to different receiving institutions, and pulling the money out of the financial system.

At Interac, we are in a unique position where we can see that fraud cross institutions across our network into different financial institutions on the receiving end. What we've developed is a fraud detection system that patterns that behaviour and is able to detect it. Then it either blocks the transactions or holds them for further review.

[Michel Picard, Liberal, Montarville, QC]

When you block a transaction, that means that someone somewhere has the information of the cardholder. By having that, they may then have access to their bank account and therefore start digging for more than just the money—personal information that can be used for identity theft and so on. Your action may block a transaction, but part of the damage is done already, and we don't yet have any control over what kind of information has been stolen at this point.

[Terri O'Brien]

Not always. I won't outline all of the behavioural models, but I will say—noting that 99.9% of transactions flow through, and that's just indicative of our volume—that when a transaction actually gets blocked, it is a known fraudulent transaction. There are certain vectors and information we have where certain transactions are known, usually through information sharing that we actively participate in between Interac and the financial institutions, both sending and receiving. Sometimes that happens with the RCMP and law enforcement as well. It's that reciprocal sharing of information that is really critical to allowing us to block known fraudulent transactions. In the cases of the blocks, the customers are not impacted.

[Michel Picard, Liberal, Montarville, QC]

We're still stuck with four-digit PINs, which provide maybe 10,000 combinations. Is that sufficient nowadays?

[Terri O'Brien]

I'd say yes. The chip and PIN, both the chip technology with the EMV-layered security and the PIN that is known only to the user, have been very effective. We've almost eradicated fraud on Interac debit. It's well below one basis point of fraud. As I mentioned earlier, it's just the remaining mag stripe terminals in the U.S.

I think it's also effective because of public education. There has been a lot of public education so that you don't share your PIN. Even in widely streamed media, in television shows, they've talked about how sometimes even spouses don't share PINs with each other. It's been very effective public education to keep your PIN secure and secret.

[Michel Picard, Liberal, Montarville, QC]

You said that you have a private network among banks, but when I buy something at the store, do I make my transaction through a totally private, closed network? If that's not the case, do I have to go on the web or somewhere to make that so I'm totally secure?

[Terri O'Brien]

You are totally secure. The PIN pads you make your transaction on, those are all issued by acquirers and payment processors, and they are part of the closed loop network. Every point in the network is secured.

[Michel Picard, Liberal, Montarville, QC]

How about going—

[The Chair, Liberal, John McKay]

Thank you, Mr. Picard.

[Terri O'Brien]

It doesn't go across an open Internet.

[The Chair, Liberal, John McKay]

I know you were on a roll there.

[Michel Picard, Liberal, Montarville, QC]

No, I know. Thank you.