TD customers in several provinces hit with fraudulent DoorDash debit charges

When Karen Lee got hit with $157 in DoorDash charges to her TD debit card in late December, she knew immediately she was a victim of fraud.

"I don't have a DoorDash account and I never heard of them," said Lee, who lives in French Creek, a small community on Vancouver Island. "I feel violated."

DoorDash, a food delivery servicethat hasgrown in popularity during the COVID-19 pandemic, doesn't serve Lee's region. Even so, Lee said when she went to her local TD Canada Trust branchto deal with the issue, she met other customers who said they were victims ofthe same fraud.

"[A customer]said, 'Well, that's what I'm here for.' And then the lady behind him said the same thing."

It's unclear who isbehind the scam, which isn't confined to one region. CBC News interviewed six TDcustomers from three different provinces who said they were victims of unauthorized DoorDash debit card charges.Each person said they don't have a DoorDash account and have never used the service.

Followingthe publication of this story, dozens morepeople contactedCBCNews to say that they, too, had been targeted by the scam.

A common complaint among those who said they were victims was that they experiencedlong waits often around a month or longer to get their money back.

Lee said she got reimbursed on Tuesday amonth after she reported the fraud.

"It's too long," she said."I'm a pensioner. You know, you're having a limited income."

Pamela Kinsman of Guelph, Ont., said she's still waiting for her refund after discovering two fraudulent debit card transactions totalling $195 charged to the TD account she shares with her husband. She said she reported the issue to the bank on Jan. 9.

"It was very upsetting and unnerving," Kinsman saidin an interview."I guess they do have to do a long investigation, but I think they should trust ... the customers."

Debit cards no longer just for ATMs

Over the years, banks have enhanced their debit cards so customers can use them not only to withdraw cash at an ATM, but alsoto make online purchases, much like a credit card.

That featuremakes debit cards similarly vulnerable to cyber fraud, saidToronto-based cybersecurity expertRitesh Kotak.

He said fraudsters can sometimes infiltrate a person's debit cardthrough nefarious methodssuch as mail theft, phishing emails or even a simple phone scam.

"We've seen people just calling up and saying, 'Hey, can you verify your information or verify your account?' And sometimes we end up giving up the information."

Another problem is that, unlike with credit cards, debit card transactions withdraw money from your bank account.That means if you geta fraudulent charge, you're out of pocket until the matter is resolved.

"That's the tragedy here is that you are out your money, your hard-earned money," said Kotak. "The bank is going to investigate the fraud. However, if anyone's ever called a bank, you can be on hold for a long time. Itcould take 10 days, it could take longer for that money to come back."

TD and DoorDash respond

TD told CBCNews that it investigatedthe fraudulent charges and that the issue has been resolved.

"Over an isolated period, a small percentage of TD Debit cardholders experienced fraudulent activityincurring unauthorized charges from a single merchant," TD spokesperson Samantha Grant said in an email. TD has more than 13.5 million customers across Canada.

DoorDash said it's workingclosely with TD "to help support and facilitate reimbursements."

Grant blamed any delays the affected customers have experienced on "COVID-19 and related lockdown measures [which] have resulted in higher call volumes and longer than normal wait times."

"We apologize for any inconvenience and are working hard to support customers, including bringing in additional resources," she said.

WATCH|TD customers surprised byDoorDashcharges:

TD customers hit with fraudulent DoorDash charges

4 years ago

Duration 2:12

TD Bank customers are being warned to check their statements after people in several provinces reported DoorDash charges on their accounts even though they hadnt used the food delivery service.

Neither TD nor DoorDash offered an explanation as to how thefraud happened, but TD did suggest the pandemic and the shift to online shopping has had an impact on such scams.

"As we've seen customers migrate to online channels, we've seen fraudsters do the same," said Grant.

This isn't the first time TD has dealt with this type of scam. In 2019, CBC News reported that dozens of TD debit card users said they got hit with fraudulent charges from Spotify, a music streaming service.

At the time, the banksaid"a very limited" number of cardholders were affected.

TD said this weekit has security measures in place to help protect customers, andas fraudsters develop new tactics, the bank adjusts its safeguards accordingly.

How can customers protect themselves?

Typically, bank customers caught up in a debit card scam will be reimbursed if it's determined someone fraudulently used their account.

Kotak said one way to guard against fraudulent charges is to ask your bank to block your debit card's online purchasing feature by setting the card's limit for online transactions to zero.

Lee did just that after discovering her two DoorDash charges. "It's just for withdrawals and deposits. I don't use [a] debit card for purchases anyway," she said.

Kotaksayswhen people receive debit cards, they should be able to choose whetherthey want the online purchase option turned on.

"If I want that feature, let me call into the bank," he said. "Don't auto-enrol people."