Jordon Judge was enjoying a coffee in Vancouver last October when his phone rang. The caller ID displayed Scotiabank, but it was a fraudster using a technique called phone call "spoofing." The impersonator claimed to be alerting Judge about two suspicious charges on his Scotiabank Visa card. Judge denied approving those charges, and the caller assured him they would be blocked. However, just two days later, Judge discovered two unauthorized charges on his credit card statement, totaling nearly $20,000. "Those were not my charges," Judge told Go Public. "So it was definitely astonishment."

This incident marked the start of a lengthy and frustrating battle for Judge. Despite his claims of fraud, Scotiabank insisted he was responsible for the charges. Credit card fraud is on the rise, with the Canadian Anti-Fraud Centre noting an increase in identity fraud cases involving compromised credit cards over the past three years.

A cybersecurity expert, Claudiu Popa, stated that there was no evidence to support the bank's claim against Judge. He emphasized that financial institutions should conduct thorough investigations before holding customers liable. "All that the bank has done is accuse [Judge] of either negligence or malice," Popa said.

Under federal law, a customer's maximum liability for unauthorized credit card transactions is typically capped at $50, unless the bank can prove gross negligence. Judge's ordeal began when the fraudster asked for personal information, including his birth date and mother's maiden name. Although Judge shared this information, he refused to provide a one-time passcode that the fraudster requested, adhering to a warning he received not to share it.

Despite this, Judge later found a charge of $17,900 to Anglia Ruskin University in the U.K. and another for $1,800 to an individual named Paula S. Taylor. "I wasn't worried at the time because I knew those weren't my charges," Judge recalled.

After filing a compensation request with Scotiabank, Judge received a letter stating that the bank had reviewed all relevant documentation and concluded he was responsible for the charges. However, the letter did not specify what evidence was considered. Judge expressed his frustration, saying, "When people sign up for credit cards, they're under the assumption that if they get scammed, they're not liable for the purchases made on their credit card. Apparently that's not the case."

Scotiabank's Escalated Customer Concerns Office later reiterated that Judge was responsible, citing the use of a one-time passcode as evidence. However, Judge's appeals were met with similar responses, stating that evidence "suggests" he disclosed the passcode.

Geoff White, executive director of the Public Interest Advocacy Centre, criticized the lack of transparency from Scotiabank. "Evidence that may 'suggest' something isn't evidence of a fact," he stated. White argued that the burden of proof should not fall on customers to demonstrate their innocence.

Popa reviewed Scotiabank's communications and noted that the bank failed to provide evidence of a basic investigation, such as activity logs showing when the one-time passcode was received and used. He pointed out that one-time passcodes sent via SMS or email are vulnerable to various compromises, making them less secure than authenticator apps.

The Canadian Anti-Fraud Centre recommends using authenticator apps for added security, as they generate time-sensitive codes that are not susceptible to interception. Meanwhile, the Quebec-based advocacy group Option consommateurs has urged the federal government to enhance protections for banking customers in fraud cases.

After Go Public contacted Anglia Ruskin University regarding the charge, the university conducted its own investigation and reimbursed Judge. A spokesperson stated that Scotiabank had not reached out to them about the charge. Following media inquiries, Scotiabank eventually credited Judge's account for the outstanding $1,800 and the accrued interest. However, Judge noted that no one from the bank explained the change in their stance.

Initially, Scotiabank had offered Judge $200 as a goodwill gesture, but he declined, insisting on a resolution without having to drop any further claims. Although he has now been compensated, Judge's struggle lasted nearly eight months, leaving him without answers about why the bank initially held him responsible for the fraud.

Popa expressed concern for others in similar situations who may lack the means to pressure their financial institutions for transparency and justice.