Public Safety Committee on May 29th, 2019

[Michel Picard, Liberal, Montarville, QC]

When I buy a number of credit...and I put some money in my account for further purchases, my money then ends up in a bank supporting your transaction. Let's say I have $100 of whatever unit, or it might be just dollars, to buy stuff. Do you trace the origin of this transaction and where it comes from, whether credit card, bank account or stuff like that?

[Brian Johnson]

Yes, I'm sorry. I understand your question now, Mr. Picard.

Yes. The origin of the money.... From an anti-money laundering, AML, perspective, we have an anti-money laundering department and a strong division and investment in detecting money-laundering activities. We treat those activities very seriously by tracing the money trail from the point of origin, funding source and the original deposit method, and we support law enforcement efforts in fighting any money-laundering operations or fraud schemes that are detected or reported on the platform.

[Michel Picard, Liberal, Montarville, QC]

You are supporting efforts during the investigation, but when you get the money from any credit card, at your level, I guess you accept the transaction as long as there is enough money at the point of origin. That means that if I have, for example, a prepaid credit card, and I want to put money in my balance, I put in mu credit card, you verify the balance, the money is there, you take it, and there's no more investigation, regardless of the origin. Whether this origin is criminal or not, you cannot verify that.

[Brian Johnson]

We actually do validation of the data source or the money source at its origin, and in certain circumstances, prepaid has limits supplied on how much money we will allow to be deposited and what money can be withdrawn within a period of time or spent within certain websites. Our risk and fraud platforms do have very granular rules that detect certain financial instruments that are used based on the risk level. If there is an AML or a money-laundering method that we've written into our fraud patterns for that use case, like prepaid, as an example, we place limits and certain criteria to restrict losses and to minimize risk in that case.

[Michel Picard, Liberal, Montarville, QC]

Do you have pattern analysis in terms of types of transactions?

[Brian Johnson]

We do. We perform behavioural analysis, and we have some artificial intelligence methods running in our risk platforms that are learning and baselining behaviours and payment patterns across the platform.

[Michel Picard, Liberal, Montarville, QC]

Usually when money is in my balance, I cannot withdraw money as is. I have to buy something. Is that the case, or do I have exceptions where I can withdraw some money from my balance?

[Brian Johnson]

We do provide methods of withdrawing money in certain regions of the world, depending on where the money was sourced, of course. It can be withdrawn through different methods. We have a partnership, as an example, with Walmart that allows for cash withdrawals. With Walgreens and with local retailers, we've opened partnerships that allow for deposit and withdrawal of cash in local currency. Through our integration with the Zoom platform, we also allow for global remittance or transfer across borders of different transactions and withdrawal of money through different methods at retailers as well. The money can also be deposited or withdrawn in cash by certain methods.

[Michel Picard, Liberal, Montarville, QC]

What is the maximum amount of money I can put in my balance in one transaction?

[Brian Johnson]

I believe it depends on the risk rules. That's not my area of expertise, so I don't know the specifics, but there are limits depending on the age of the account, whether your account has been verified with identification and whether we've verified the account holder's history. There are other methods of raising that limit based on knowledge and know-your-customer indicators on trusting the account holder.

[Michel Picard, Liberal, Montarville, QC]

Do you have the obligation to declare to FINTRAC in Canada if there are patterns of transactions or deposits of more than $10,000?

[Brian Johnson]

I'm not certain about that. I'm not in the fraud or AML department, but I know that we do report through FinCEN and other networks in the U.S. that I'm familiar with with respect to certain criteria. I'm not familiar with our reporting through the fraud pattern notification with Canada, though. We can certainly find out.

[Michel Picard, Liberal, Montarville, QC]

If I put money in my own account so I can, myself, withdraw my own money without your knowing whether I'm the same person doing the two transactions.... Let's say I take a prepaid card, or my money is in an account in a bank that is the same, under suspicion, because we do have some banks that are under suspicion.

[Brian Johnson]

Sure.

[Michel Picard, Liberal, Montarville, QC]

I put money in my PayPal account. Two or three days after that, I withdraw my money. The only information you need to know to do this transaction is whether the account has the right log-in and password to get in, and the same thing to get the money out. There's no possibility to verify whether it's the same person. My colleague and I may work on the same account.

[Brian Johnson]

We do verify device telemetry. We look for information about the device, the computer you're using, based on geolocation, on some other fraud detection patterns, to try to verify the authenticity of the user on the account. The account holder, of course, has to have the credentials to perform that payment or that transaction.

[Michel Picard, Liberal, Montarville, QC]

Another area—I don't have much time—is the nature of the attacks where you've been targeted.

What kind of evolution have you seen throughout the years, the level of sophistication of those attacks? What can you say about that?

[Brian Johnson]

Generally speaking, the cyber-attack footprint has become much more complex and advanced. Cybercriminals have become much more of an economy unto themselves, and have layered their tools, their data, their methods of attack in a very sophisticated way, and in a very coordinated way in many cases.

Criminals are creating tools, and both executing and renting access to those tools. Distributed denial-of-service attacks, or DDoS attacks, have become much more significant and advanced over the years. The cyber-landscape in threats and emerging trends in that area have definitely become more complex, and have increased in scale dramatically in recent years.

[Michel Picard, Liberal, Montarville, QC]

Thank you.

[The Vice-Chair, NDP, Matthew Dubé]

Colleagues, as you can see, we have bells. We require unanimous consent to continue. If we choose to do so, we must also decide for how much longer we will continue. I'm looking for guidance, based on the number of questions you may or may not have.

Mr. Graham.

[David Graham, Liberal, Laurentides—Labelle, QC]

I say we go until the bells flash three times, which should give us five minutes to get upstairs.

[The Vice-Chair, NDP, Matthew Dubé]

You're proposing that we go for 20 minutes?

[David Graham, Liberal, Laurentides—Labelle, QC]

Twenty-two more minutes, yes.

[An hon. member]

Is that enough time?

[David Graham, Liberal, Laurentides—Labelle, QC]

It's five minutes to go up two floors in this building.