.png)
%20(1).png)
A recent article published by CBC news highlighted a concerning scam that involved the Bank of Montreal (BMO). The scam managed to exploit vulnerabilities associated with the two-factor authentication (2FA) system of the bank. This advisory aims to provide an overview of the issue, its implications, and recommendations.
The scam primarily targeted customers with lines of credit. Perpetrators pose as bank employees and use a combination of phishing techniques and flaws in the 2FA process to gain unauthorized access to customers’ accounts, subsequently making unauthorized transactions.
While 2FA is an essential security feature, it is not infallible. Richter Guardian clients should be proactive in understanding its limitations and continuously seek ways to enhance their security posture.
Contact us at anytime you are unsure. If you receive a call from someone purporting to be your bank and you are unsure, call us to help you determine the legitimacy of their communication.
Table 1 – Levels of two-factor authentication that may be available to protect your bank account.
Request a private consultation to find out whether Richter Guardian is a good fit for you.
A two-factor authentication scam happens when a criminal tries to trick someone into sharing a one-time code, approving a login request, or giving access to an account.
Both add an extra layer of security beyond your password, so that even if someone learns your password, they still can't get into your account.
Two-factor authentication (2FA) asks for exactly two proofs of identity: usually your password plus one more step, like a code sent to your phone.
Multi-factor authentication (MFA) asks for two or more. So 2FA is really just one type of MFA.
In practice, the difference matters less than the habit itself: turning on this extra step wherever it's offered is one of the simplest, most effective ways to protect your accounts. If you're not sure how to set it up, the Cyber Defence Desk can walk you through it.
In a bank impersonation scam, the attacker pretends to be from a trusted financial institution. They may use urgency, fear, or partial personal information to convince someone to share codes, credentials, or account details.
Authenticator apps are generally safer than SMS because they do not rely on text messages, which can be exposed through SIM swapping, phone compromise, or social engineering.
Do not click links, share codes, or reply with personal information. Contact the bank through its official website, app, or phone number, and ask for guidance before taking action.
Scammers may bypass two-factor authentication by tricking someone into approving a request or sharing a code. That is why it is important to verify messages and avoid acting under pressure.
High-net-worth individuals can reduce scam risk by using unique passwords, enabling multi-factor authentication, limiting public information, reviewing social media exposure, and getting guidance before responding to suspicious messages.
Richter Guardian gives you enterprise-level cybersecurity tailored for individuals, families, and executives.
One of the best ways to add extra security to your accounts is through Multi-Factor Authentication (MFA) – this means you need more than just a user ID and password to log in. We strongly recommend using MFA for your important accounts.
However, not all MFA methods are equally secure. Authenticator apps are a safer option than SMS authentication methods because they generate security codes directly on your device. SMS authentication codes, on the other hand, can be intercepted by hackers.
MFA adds an extra step to logging in. Instead of just entering a user ID and password, you must also provide another piece of information, like a code from an app or a text message. This extra step makes it much harder for hackers to break into your account, even if they steal your password.
An authenticator app is a mobile app that generates security codes for logging in. These codes are called Time-Based One-Time Passwords (TOTP) and change every 30 to 60 seconds.
When you set up an authenticator app for an account, you scan a QR code or enter a secret key. This links the authenticator app to your account and allows it to generate matching codes.
To log in, you enter your username, password, and the current code displayed on your authenticator app. If the code matches the one your account server expects, you get access.
Some popular authenticator applications include:
SMS authentication is when a security code is sent to your phone via text message. You enter this code along with your user ID and password to log in. These codes are One-Time Passwords (OTP) which are generated for one-time use. OTPs can last for a specified amount of time – users will need to generate a new OTP if they exceed the time limit.
Sometimes, websites may also send security codes via email instead of SMS, but the process is the same.
Authenticator apps provide better security than SMS codes for several reasons:
Here are two common ways cybercriminals can steal SMS codes:
Request a private consultation to find out whether Richter Guardian is a good fit for you.
PetSmart, a pet retail giant in the United States, is alerting certain customers about password resets resulting from an ongoing credential stuffing attack attempting to breach existing accounts. The company released a statement on March 6 to let customers know about the credential stuffing attack.
As a precaution, PetSmart reset the passwords for any accounts logged in during the credential stuffing attack. Additionally, they reassured customers that there was no evidence of compromise to petsmart.com or any of their systems during the incident.
A credential stuffing attack is a type of cyber-attack in which threat actors use previously acquired usernames and passwords, typically obtained from data breaches, to gain unauthorized access to user accounts on various online platforms.
Threat actors usually automate the process of trying these login credentials across multiple websites and services. Threat actors are cognizant of the fact that people commonly reuse passwords across various accounts, making them even more inclined to exploit this widespread behavior.
Although cyber breaches may be unavoidable, you can still prevent breached details from being used on other websites or services by taking the following precautions:
Request a private consultation to find out whether Richter Guardian is a good fit for you.
A Calgary investor is suing TD Waterhouse Canada Inc. after fraudsters allegedly broke into his TD Direct Investing accounts while he vacationed in Hawaii.
According to The Globe and Mail, the intruders sold his holdings and poured more than $5 million into a thinly traded Hong Kong stock.
When it collapsed, he lost roughly $4.5 million in retirement savings.
TD says he either made the trades himself or failed to secure his account. Nothing has been proven in court, but the case shows how fast wealth can vanish once login credentials fall into the wrong hands.
This isn't an isolated incident.
TD Bank has faced other serious regulatory scrutiny in recent years, and securities fraud attorneys continue to field claims from investors who say controls failed them.
Banks guard their own core systems closely, but the real weak points are often somewhere else: the client's personal devices, account passwords, and email accounts, all sitting outside the bank's oversight and controls.
It's worth pausing on the timing here: the alleged fraud happened while the investor was away in Hawaii. That's not a coincidence worth overlooking.
Vacations pull people out of their normal routines on purpose, and that's exactly what makes them good for rest, and terrible for security.
At home, most people have habits without even thinking about them: checking accounts over morning coffee, noticing a strange email between meetings, recognizing when something on a statement looks off.
Travel disrupts every one of those habits at once:
- You're on hotel or airport Wi-Fi, which is rarely as secure as your home network.
- You're checking email and banking apps quickly, often on borrowed time between activities, so a suspicious login alert can get skimmed past instead of read carefully.
- Time zone changes mean notifications may arrive at 3 am and get dismissed unread.
Many people intentionally "unplug" from their finances while traveling, treating vacation as a break from monitoring entirely.
Fraudsters understand this pattern well. Account takeovers cluster around known absences: holidays, long trips and/or business travel.
A window of even a few days without anyone watching an account closely is often all it takes to sell off holdings and move funds into a single volatile position, which is exactly what allegedly happened in this case.
None of this means people shouldn't travel or unplug — they should. It means the monitoring can't rely on the account owner remembering to check in from a beach in Hawaii.
Basic habits, especially before and during travel, meaningfully reduce your own risk:
- Turn on multi-factor authentication for every brokerage, banking, and email account.
- Use a unique, strong password for each financial account — never reuse them.
- Avoid logging into financial accounts on public or hotel Wi-Fi while traveling.
- Set up account alerts for trades, withdrawals, and login attempts before you leave.
- Designate someone you trust to glance at statements while you're away.
- Review account activity closely in the days right after returning.
- Ask your brokerage about limiting or freezing margin trading if you rarely use it.
Even careful people get targeted, especially the moment they step away from their routine.
This is a gap Richter Guardian is built to close.
Corporate and bank-side security stops at the workplace door — it doesn't watch the personal phone, laptop, or email account a fraudster actually needs.
Richter Guardian's monitoring and prevention service watches continuously, including while clients travel, for compromised credentials and suspicious activity. If something looks wrong, clients aren't left to figure it out alone.
Our incident response team, the Cyber Defence Desk, is reachable via phone, email, video or a mobile app to explain what's happening and guide next steps.
Vacations should mean rest, not vigilance. For high-net-worth individuals and families with complex accounts and multiple devices, someone still needs to be watching while you're not. Protection shouldn't stop where your routine does.
Request a private consultation to find out whether Richter Guardian is a good fit for you.