It starts with what sounds like a promising telephone call: For a one-time fee, you can lower the interest rate on your credit card.
But the person is not on the other side of the line with a bank or credit card company: They are a fraudulent, looking to get money in common frustration.
And what they're really after is your identity.
It is called a low interest or rate reduction scam, where a caller offers you a limited time to reduce your rate for a service charge from anywhere from $ 500 to $ 5,000.
To take advantage, you will be asked to check your personal information – just as you would with any financial institution: Name, date of birth and address. And if you receive that one-time fee, the agent also needs to check your credit card number, expiration date and security code.
Although the Canada Counter Fraud Center has received around 300 complaints about such scams in 2016 and 2017, an investigation by Marketplace suggests that the scope of the problem is much more.
Through a leak of one illegal call center in Pakistan, Marketplace has received a comprehensive list of records for almost 3,000 Canadians who have suffered this scam.
It included a wealth of sensitive personal information, including credit card numbers, social insurance numbers, addresses, wedding names, employer names and annual income. In some cases even banking codes and recent account balances have been listed.
There's a valuable personal information that can be – and is often – bought and sold for as little as $ 1 in the sheltered underground for identities stolen.
It was interesting & # 39;
Winnipeg's resident, Grace Johnston, recalled such a call about three years ago and admits some information – only its name and address – during the verification process as it is called.
"It sounded very legitimate. It sounded so that he trusted," he said. "That was enough to … start this ball rolling me."
The agent wanted $ 500 to lower its interest rate, and eventually refused it.
Not soon, he received a letter from Royal Bank, asking her to raise her new credit card. He had not applied for one.
"They had all my information: My birthday, my address, my telephone number, my mother's wedding name," said Johnston. "It was contrary to my privacy. It was incredible because you had all this information there."
His personal information – including his new credit card number – also ends the list of Canadian identities he received Marketplace.
Johnston has no idea of the way in which the scammers have so much additional information. He thought she had defended herself by changing her credit card and registering for credit notices and fraud warnings with Equifax.
"My credit card is available there and I continue to come back to my love," he said, stating that the scammers are still calling at work. "It's only overwhelming to know that it's available in this way and it can affect so many different aspects of my life."
Listen to scam in action by losing sound to Market from one call center:
The leak to Marketplace it may provide one idea: In addition to the 3,000 names, Marketplace In addition, up to 200 telephone recordings of fraud played out on American victims. In some calls, phone agents have sold a rate reduction. In others, it sounds like trying to access bank accounts by phone by highlighting the victims.
"Canada was the most favorable market ever for low interest scams," said Muhammad Yousfi, a former call center operator turning whistleblower in Pakistan that now prevents fraud.
"Most people who actually fall for this already … are owed to knit … so they're looking for a way out," he says.
The personal information obtained through the telephone scam is essential to commit all other types of fraud, says Youfsi, setting "continuous circle".
"It could be used to go on and apply for new credit cards. We have gone as far as refinancing … a person mortgage," said Yousfi, who claimed he had made thousands of dollars a month while working at the centers call.
"We can definitely redefinate their lives by getting that information," he said. "You can continue to use this information, resume this information online to other call centers, to hackers, to criminal syndicators – the whole nine yards. "
Marketplace He wanted to find out how widely the information stolen could be distributed.
With Johnston's consent, Marketplace He informed Terbium Labs, a Baltimore based cybersecurity company specializing in monitoring platforms for data stolen, including the dark web.
The dark web is an integral part of the internet that is hard for everyday users to access. Not visible on common search engines such as Google, that element of anonymity has made the dark web an online hafan for the sale of illegal material.
The lab found what was believed in Johnston's credit card information – along with hundreds of other Canadians – for sale for around $ 30 on a website that specializes in the sale of stolen credit cards.
The post, from the end of 2018, has erased since then.
"The fact that it does not already mean that someone has already bought it, it means that it could be at risk of even more compromise," said Emily Wilson, vice president of Terbium research Labs.
Once someone's personal information is available there, Wilson said that he was likely to be available to use it for decades.
Marketplace has encountered a number of dark web markets that sold everything from personal information brought to narcotics. The websites have been installed just like any traditional online shopping site, such as Amazon or eBay.
Searching for "Canada" on one of the largest underground markets, Dream Market, has brought up dozens of pages of identities stolen, offering everything from Quebec profiles to Canadian bank logs.
One advertisement offered more than 1,000 full profiles, which included names, addresses, credit card numbers, birth dates, social insurance numbers and driver licenses. Although buying one profile costs $ 100, if you were buying a lot, the price would be reduced to $ 20 each.
Another showed a sample profile of Quebec, including a full name, address, date of birth and someone's social insurance number. It was for sale for around $ 10.
The sellers, very similar to an Amazon seller, had profiles with star ratings to impose their credibility. Some sellers had thousands of sales.
Marketplace have reached many best sellers of these markets and other known cardio sites, which deal exclusively with information on a credit card stolen. Some responded to the condition that their user names are not mentioned.
Seller multipliers said Marketplace Their main way of getting personal information was through leaks, scams and hacks. One seller said they could do up to $ 10,000 per month.
Another seller provided a picture of the mailboxes that were full of debit cards from the Canadian bank after many accounts. Even the same seller provided the full credit history of the Quebec resident.
Part of your reason for doing this? It is anonymous.
As one seller said: "You're selling Canadian profiles, you do not make a prison, or not a lot."
Identity bearing is a big business
According to the Canadian Counter Fraud Center, Canadians said that almost $ 20 million was lost to identity fraud in 2018. But the federal agency warns that that figure could be much higher because of a lack of reporting .
The United States Department of Justice, in contrast, 36 people said last year in one transnational criminal operation, which accounted for more than $ 530 million in cyber season losses, which included the sale of stolen identities.
"Personal information is a currency," said Claudiu Popa, author Canadian Cyberfraud Handbook and a cybersecurity expert who advises government and companies.
"We live in the information age, but we also contain information – so each of those aspects adds real money to the wrong people."
And once someone's information is available there, Popa says that there is little that can be done to disappear.
"I believe that it is the sad reality of many Canadians … who find out that some of the breaches of data that he suffered in the past may not be ruled out," he said. "And in fact it could affect our lives for years to come."
If you're worried that your identity has been compromised, Popa recommends changing as many identities as possible as possible: credit cards, bank accounts, passwords, answers to security questions – even e-mail addresses.
And it's worth considering registration for credit and fraud monitoring notices, though not perfect, he says.
"All we can do is get a plan – and get a plan to respond as quickly as possible".