Online banking fraud leaves Winnipeg woman on hook for $174K debt

A Winnipeg woman is warning others about what can go wrong in online banking after a credit union is holding her responsible for a debt of more than $174,000 from fraudulent transactions.Linda Klassen and her husband, Rudy, used their home computer for online banking, but in May 2024, someone hacked into the laptop, taking control of the computer and the Klassens’ email account, she says.Fraudulent transactions were made through their accounts at Access Credit Union and Steinbach Credit Union. Another fraud attempt involving an investment account affiliated with a bank didn’t go through, Klassen said. One or more unknown fraudsters put the fraudulent transactions through between May 16 and May 27, 2024.”It’s life-altering, really … when you think that your financial management is very secure, and you follow all the rules, and you’ve done everything as you were instructed to do,” Klassen, 78, said in an interview.”You feel violated and vulnerable. And it would be comparable to somebody breaking into your home and taking what belongs to you,” said Klassen, whose husband was undergoing cancer treatment at the time and has since died.WATCH | Woman faces ‘devastating’ online banking fraud:Fraudsters hack into home computer used for online banking A Winnipeg woman is warning people about the risks of online banking after fraudsters hacked into her laptop computer in May 2024 and left her with a debt of more than $174,000.The fraudulent transactions happened first at Access Credit Union, where two $50,000 bogus cheques were deposited remotely into the Klassens’ account by a fraudster. The money was then transferred to fraudulent payees.Klassen says Access covered that loss and didn’t hold the couple responsible for the money. Four fraudulent cheques, totalling $292,000, were deposited into the Klassens’ Steinbach Credit Union account through their online banking platform from May 22-24, 2024.The fraudster then used the money for a series of fraudulent online bill payments to unapproved recipients, creating a large overdraft in the account.When the fraudulent cheques were initially deposited, there was a balance of only $6.86 in the Steinbach chequing account, because the Klassens weren’t using it for their regular ongoing banking activity.Klassen is suing Steinbach Credit Union after the financial institution did not fully reimburse her for fraudulent transactions in her chequing account in May 2024. (Justin Fraser/CBC)The credit union was able to recover more than $117,000 of the funds, which included $25,000 from an insurance claim and over $92,000 through its efforts to trace and recover the money.But the Klassens’ account was left more than $174,000 in the red.Klassen eventually filed a lawsuit against Steinbach Credit Union in July 2025, seeking three times the outstanding amount plus other damages.The lawsuit has not been tested in court. Steinbach Credit Union filed a statement of defence in August, denying liability for the loss and asking that Klassen’s lawsuit be dismissed.It says the loss “could have been prevented entirely if the [Klassens] had taken reasonable precautionary and remedial steps as soon as the fraud with the other credit union was identified,” referring to the situation a few days earlier with their Access Credit Union account.The fraud at Access appeared to be orchestrated by “the same fraudster, utilizing the exact same methodology,” according to the statement of defence.An electronic services agreement for online banking requires clients to notify Steinbach Credit Union immediately if their password or other login credentials have “become known to someone else,” it says.However, Steinbach Credit Union says it wasn’t informed by the Klassens until July 2024 of the “prior fraud loss with another credit union arising out of a compromise of the plaintiffs’ laptop.”Without knowledge of that fraud, the credit union “had no obligation to monitor transactions” in Klassen’s account, according to the credit union’s defence statement.Never learned how hack happenedKlassen said she never learned how the fraudsters hacked into the accounts. The credit unions previously indicated they were also unable to determine how it happened, she said.She and her husband didn’t notify Steinbach Credit Union right away about the fraud at the Access account because they thought their Steinbach account “was safe and secure” at the time, Klassen said.Her lawsuit says she and her husband were never asked by Steinbach Credit Union whether there had been any recent fraudulent activities in their accounts at other financial institutions, and that their passwords for their Access and Steinbach accounts were different.Steinbach Credit Union says anyone who suspects their account or devices have been compromised should report it immediately to their financial institution. (Travis Golby/CBC)After receiving text messages from an unknown number on the evening of May 24, 2024 — a Friday — Rudy Klassen contacted Steinbach Credit Union the next morning and reported the fraudulent transactions, the lawsuit says.At Steinbach Credit Union, Linda Klassen “signed a statutory declaration to the effect that they did not divulge, among other things, their user IDs or passwords to another person,” the lawsuit says. The Klassens also reported the frauds to police. Winnipeg Police Service public information officer Const. Claude Chancy told CBC the case is being investigated by the financial crimes unit, but no suspects have been identified.’Financially devastating’ for victims: credit unionSteinbach Credit Union marketing and communications director Stephanie West told CBC the credit union can’t comment on the specifics of the case, due to the ongoing legal proceedings and privacy reasons.The credit union understands fraud “can be financially devastating for the victim,” and has “the deepest sympathy for the Klassen family and their situation,” West said in an email.Steinbach Credit Union conducts “a thorough investigation” and “makes every effort to recover as much of the loss as we can” when fraud occurs, she said.”Unfortunately, this isn’t always possible.”University of Manitoba computer science professor Celine Latulipe says banks and credit unions should freeze accounts when they detect fraudulent activity. (Travis Golby/CBC)West said SCU does use insurance when there are claims, but that has a maximum coverage amount. Anyone who suspects their account or devices have been compromised should report it immediately to their financial institution, the credit union said.A survey by Statistics Canada found that as of 2022, the most recent year for which data is available, 78 per cent of Canadians did online banking.According to the Canadian Anti-Fraud Centre, 1,414 Canadians had their bank accounts compromised in 2023. That dropped to 1,118 in 2024.The anti-fraud centre says the most common vulnerabilities leading to those cases are:Reusing passwords across all accounts. If one site is breached, criminals try the same login on banking apps.Weak or easy to guess passwords.Ignoring or not using two-factor or multi-factor authorization.Clicking on phishing links.A research project started at the University of Manitoba is studying how older adults can improve their online banking skills. Computer science professor Celine Latulipe, who is overseeing the BankBox project, says she thinks online banking is generally safe, despite situations like the Klassens’.WATCH | U of M research project focuses on seniors and online banking:U of Manitoba project gives seniors safe space to practise online bankingAs seniors are targeted by online fraud, a research project called BankBox, led by University of Manitoba computer science professor Celine Latulipe, is studying how older adults can improve their online banking skills. Concerning Steinbach Credit Union, “I think that they should have reimbursed the Klassens,” she said, because the credit union should have had algorithms to detect fraudulent activity in the account “and stop it before it even happens.””Freezing the accounts when there’s suspected fraudulent activity is something that banks and credit unions should be doing,” Latulipe said.”A lot of them are, but clearly, Steinbach Credit Union did not.”