PC Optimum member hit by theft a 3rd time after Loblaws says password problem fixed

After getting hit by points theft multiple times, some PC Optimum members are questioning a fix Loblaws says it has made to improve the security of its rewards program.

"I do not believe they have fixed anything," said Shawn Nicholson in Halifax. On Wednesday, a thief infiltrated his PC Optimum online account for the thirdtime in less than a month, this time stealing 150,000 pointsworth $150.

"I'm beyond the point of frustration," he said.

CBC News previously interviewed Nicholsonon April 9,after he was hit by points theft a second time, despite reporting his case and beefing up hispassword.

At the time, Loblaws said it was working to fix aglitch in the program's system that allowed a thief to stay in a member's online account, even after the initial theft was discovered andpassword reset. By April 13, Loblaws said it had resolvedthe problem.

However, five days later on April 18, Nicholson's thief struck a third time, spending most of his points at the same location as before a Loblaws-ownedMaxi store near Montreal.

"I have zero confidence in the security of my account," he said.

Is it fixed?

CBCNews contacted Loblaws about Nicholson's third theft. The retailer saidthat the underlying problem with the password resets has been "locked down," but that addressing all the thefts will take time.

"The issue has been identified and resolved, but involves a manual process at our end, once we've been in contact with the customer," said spokesperson Catherine Thomas in an email.

Nicholson saysLoblawsdid contacthim last week and returned his 140,000 points from the first two thefts.

"I thought everything was resolved and fine," he said.

But following the third theft,Nicholsonsays he'll only feel safe once PC Optimum deletes his account and sets him up with a new one.

Since Loblaws launched its new PC Optimum rewards program on Feb. 1, CBC News has heard from more than 50 members complaining of points theft and sometimes long waits to get their issues addressed.

The retailer said the PC Optimum program is secure, members' information is safe and that stolen points will be restored.

But following repeat thefts, some members question if Loblaws is doing enough.

"The system is far too vulnerable," said PC Optimum member Joel Du Broy in Ottawa.

Police on the case

According to his account records, on April 12someone spent a whopping 1.6 million of Du Broy's points worth $1,600 mainly at Loblaws-owned Pharmaprix stores in Montreal.

"I was really upset," he said. "It's a bit hard to sleep at night when you have that amount of money missing."

On April 13 the day Loblawsconfirmedit had resolvedits password reset problem Du Broy says he reported the theft, and aPC Optimum agent told him to change his password. He says he did, along with changing the email address associated with his account.

The next day, however, another 350,000 pointswent missing from his account, spentat one of the same Pharmaprix stores.

Du Broy says he actually saw the points disappear from his account in real time while discussing the initial theft with PC Optimum.

"I was on the phone with customer service as I was being looted," he said. "My jaw just dropped."

In order to prevent future points thefts, he believes Loblaws should implement tougher security measures such as a two-step verification process when members spend more than $100 worth of points in a store, and when someone new joins a member's account.

PC Optimum offers the joining feature for members whowant to pool their points, such as families.

"That's non-negotiable," said Du Broy who noticed that a stranger had linked their own PC Optimum card to his account at the time his points went missing.

"If somebody wants to add a household card to my account, I certainly better approve it."

For at least a week now, PC Optimum's "pool your points as a household" feature has been temporarily disabled.

Loblaws did not say whether this move is connected to the rash of thefts.

After CBC News contacted Loblaws, Du Broy got his stolen points back. He hasset up a new PC Optimum account, convinced that's the only way he can protect himself from future theft.