A few weeks ago, my colleagues Alexandra Posadzki, Mariya Postelnyak and I published a deep dive into the new and highly sophisticated ways in which fraudsters are scamming Canadians out of more than $700-million a year – and that number is likely a gross underestimation.

One open question is who should eat the loss when a customer falls for a scam. Right now, the answer is almost always: entirely the victim.

But should banks also bear some responsibility if they fail to question unusual transactions? And what about telecom companies, when scammers spoof a phone number to falsify caller IDs appearing on people’s phone screens?

For answers, I turned to Option consommateurs, a consumer-rights advocacy based in Quebec that has been pushing for change. Here’s my Q&A (lightly edited for length) with Alexandre Plourde, a lawyer and analyst with the group:

For scams where a victim is tricked into sending money to or sharing banking or credit card information with fraudsters, what are the rules about how liability for the financial loss is shared?

Currently, banks can treat these fraudulent transactions as “authorized” and hold consumers responsible. Banks generally stipulate in their contracts that the consumer must bear the losses for any transaction where they believe the consumer contributed to the transaction or failed to meet their security obligations.

In Quebec, and at the federal level, no specific law currently governs liability for cases of fraud in a consumer’s bank account. In the absence of specific legal provisions, general civil liability rules will apply, on a case-by-case basis, in consumer claims against their bank. Case law has recognized a duty on the part of banks to act diligently to protect the interests of their clients. While they should not interfere in their clients’ affairs, banks have a certain obligation to monitor account activity. For example, if they detect suspicious transactions in the account, they must take reasonable steps to prevent fraud.

It should be noted, however, that the law could change soon in Quebec with the adoption of Bill 72. The bill creates an obligation for financial institutions to reimburse consumers for unauthorized transactions made from their bank accounts, similar to the existing protection for credit cards, while also introducing, in certain circumstances, protection for so-called “authorized” fraudulent transactions.

For organizations other than banks, there are also no specific provisions regarding liability in cases of fraud.

I’ve had credit card companies freeze my transactions and ask for additional verification when my spending seemed unusual, for example, when I was travelling abroad. Yet in 10 years of covering personal finance I have never heard of banks blocking debit or ATM transactions, even when they are wildly out of character. The federal Bank Act limits consumers’ liability for unauthorized credit-card transactions to $50, but there’s no similar legal protection for other transactions made through other modes of payment. Can this be the reason why financial institutions seem more vigilant about credit card payments?

This is possible, but we don’t have the data to prove it.

Most of the impersonation scams reported to us involve transactions made in the consumer’s bank account, not on credit cards. Like you, we sometimes observe cases where highly unusual transactions have occurred in consumers’ debit accounts (or lines of credit) without being blocked by the banks. That said, in some cases, we have seen instances where the bank warned the consumer about the risks of a transaction or made some effort to try to stop the fraud.

Based on our observations, the framework for credit cards seems to facilitate reimbursement for affected consumers.

Even with the $50 liability cap on credit card transactions, can a bank decline to refund a scam victim for a fraudulent transaction if the victim was tricked into sharing their credit card information with criminals? Can the bank argue that it was, not, in fact, an unauthorized transaction?

Yes, they can because the law on credit card targets unauthorized transactions.

The Canadian Code of Practice for Consumer Debit Card Services is a voluntary code of conduct that has been signed by major financial industry groups, such as the Canadian Bankers Association, whose members include all the big banks. It says that “cardholders are not liable for losses resulting from circumstances beyond their control” including “unauthorized use, where the cardholder has unintentionally contributed to such use, provided the cardholder co-operates in any subsequent investigation.” Yet is also says “in the event that the results of an investigation determine that not all the funds will be reimbursed to the cardholder, the PIN issuer is responsible for showing that, on the balance of probabilities, the cardholder contributed to the unauthorized use of the card.” What are consumers to make of this?

Appendix A of this code clarifies the interpretation of Section 5 concerning liability, stating in several places that the consumer is not liable for transactions in which they have been the victim of fraud. For example, it clarifies the scope of the provision you cite by stating: “The cardholder is not liable for losses relating to transactions: [...] where the cardholder has been the victim of fraud, theft, or has been coerced by trickery, force or intimidation, provided that the cardholder reports the incident promptly and co-operates fully in any subsequent investigation.”

In our opinion, a comprehensive reading of the code, including its appendix, shows that consumers cannot be held liable for transactions resulting from trickery.

However, it should be noted that this code only applies to debit card transactions where a PIN was used, and not to online transactions, which are frequently used in fraudulent schemes.

What changes is Option consommateurs advocating for to strengthen protections for consumers in cases of fraudulent transactions that were unwittingly authorized by scam victims?

At the federal level, our main request is to amend the Bank Act to increase banks’ liability for these types of fraud so that consumers can more easily obtain reimbursements, drawing inspiration from the model developed in the United Kingdom.