Two customers say the Bank of Montreal violated their privacy and trust by allowing sensitive financial information to get into the wrong hands, then failing to address their complaints.
"I was shaking and I was angry and I had tears in my eyes," said Loretta Albayate of Gibsons, B.C. "And I said, ‘What’s going on? Why does my ex-husband have all my banking information??"
Albayate said she was shocked when her ex-husband called to say the bank had sent her monthly account statements to his home. She later learned a BMO employee at her branch changed her mailing address to his – without her knowledge or consent.
"He had everything," Albayate said. "He made it clear he went through my information because he wanted to know what I was up to and what I was doing."
Carol Hryniuk of Lloydminster, Sask., said BMO breached her privacy when her elderly mother went in to a branch in Woodstock, Ont., and asked for a copy of her MasterCard statement. The teller mistakenly gave the woman a copy of Hryniuk’s instead.
"Our last names aren’t even the same," Hryniuk said. "How could they give my MasterCard statement out to somebody who isn’t even on my MasterCard?"
'Sinking feeling' over breach
"When it first happened, I had this sinking feeling in my stomach, because I thought: ‘What is my family learning about me that I don’t want them to know or share with them?'" Hryniuk said.
"He threatened to kill me. He threatened to burn my house down … if I didn’t give him two or three thousand dollars," Albayate said. "The Bank of Montreal put me in a position where my life was in danger, and that was wrong."
Submit your story ideas:
- Go Public is an investigative news segment on CBC TV, radio and the web.
- We tell your stories and hold the powers that be accountable.
- We want to hear from people across the country with stories they want to make public.
While they were married, Albayate said, her husband became accustomed to her financial support because she had sponsored him to come to Canada. After she got a divorce she put all accounts in her name only. She believes he persuaded someone at her bank to make the address change.
"To this date I still don’t know for sure how they got his address, and then went and changed my address to his address," Albayate said.
After she refused to lend him money, Albayate said, her ex-husband was caught on a store surveillance tape following her while she was shopping. That was enough for the RCMP to issue a peace bond, ordering him to stay away from her.
"It all happened shortly after he got my banking information," Albayate said. "He didn’t know what [money] I had until the Bank of Montreal told him."
BMO admits address change
In its response to Albayate’s lawsuit, BMO acknowledges her address was changed in its system at her branch. However, it insists her ex-husband breached her privacy — not the bank — by opening the mail he received.
"Acts allegedly committed by [the ex-husband] were not reasonably foreseeable and were beyond BMO’s control … it was not responsible for [his] conduct," the bank’s lawyer wrote in a letter.
"To this date – more than two years later – I never received a reply," she said.
Hryniuk said she also complained at her BMO branch and was told her MasterCard account is somehow "linked" to her mother’s in the computer system. She said the bank told her the accounts would be flagged to prevent further breaches, but no other changes would be made.
"I was told as far as quality improvements there is nothing that they are doing to change it for any other customer that deals with the Bank of Montreal," Hryniuk said.
No comment on cases
BMO didn’t respond to requests from CBC News for an interview. Instead, it sent this short statement: "We take the protection of customer information very seriously. BMO voluntarily self-reports all significant breaches to the Office of the Privacy Commissioner."
The commissioner’s office in Ottawa receives more complaints about the financial sector than any other, the assistant commissioner says, adding a combination of human error and easy access to computerized records is the "perfect storm" for privacy breaches at banks.
Bernier said, for the most part, banks are very concerned about privacy and responsive to complaints. Nevertheless, she said, more training is needed.
"As good as the banks are they can’t afford to be any less than excellent. They have to have safeguards proportionate to the risks of breaches of the information they hold," Bernier said. "Human error is the weakest link. It’s where we see most issues, hence how important training is."
Mandatory reporting possible
Ottawa is considering a bill that would make it mandatory for all federally regulated organizations, such as banks, to report every privacy breach, big or small. That would give officials a better sense of where the weaknesses are, Bernier said.
"We believe that it would increase the number of instances reported to us," she said.
Both Albayate and Hryniuk said BMO should do more to address what happened to them.
"I want to know what processes they have put in place to make sure that it will never happen again," Hryniuk said.
"By speaking out maybe I can help other Canadians – because this is totally unacceptable," Albayate said.