Blog › News

News

The Bank Scam Starts With Your Data

The call looks like it comes from your bank. The number on the screen is the bank's number. The caller knows your name. The caller knows where you bank. Then the caller tells you your card has been compromised, and that a courier is coming to collect it as evidence. None of it is the bank. All of it is built on your personal information.

Source: CBC Marketplace, "Same scam. 2 countries. Why Canadians don't get their money back", by David Common and Nelisha Vellani, published October 23, 2026. Watch the Marketplace episode.

CBC Marketplace investigated this scam in October 2026, in a report by David Common and Nelisha Vellani called "Same scam. 2 countries. Why Canadians don't get their money back." What they found should change how you answer the phone.

The call

The scam runs on fear and speed. A caller claims to be from your bank's fraud department. The call appears to come from the bank's real number, because phone numbers can be faked, a trick called spoofing. The caller says someone tried to use your card in another city. Your case, you are told, has been transferred to the police. A courier will collect your card as evidence.

A real bank does not work this way. Neither do real police. Marketplace noted that police services across Canada have issued public warnings saying they would never send a courier to collect a debit or credit card.

Two victims. Two outcomes.

Asif Mohammed lives in Toronto. This spring he got a call that appeared to come from Tangerine, his bank. The caller said she was from the fraud investigations department, and that someone had tried to use his debit card at a Best Buy in Edmonton. A courier came to his worksite and took the card. He says he never gave out his PIN. Within minutes, $1,200 was gone from the account. The total loss was $7,200.

After months of pleading, Mohammed and his wife reached a settlement with Tangerine. It does not cover their entire loss.

Samantha Bradshaw lives in England's East Midlands. Last fall she got a near-identical call that lasted four hours. A courier collected her cards, and scammers used them to make purchases. She lost £11,000, nearly $21,000 Canadian. The scammers knew where she lived. Her bank repaid the full amount within days.

Same scam. Same mistake, if you want to call it that. Completely different ending.

The difference is the law

In Britain, banks are required by law to make most scam victims whole. When money is lost to a scam like this one, the banks involved are each responsible for half the reimbursement, except in cases of extreme negligence. Bradshaw's bank called her within days to say the loss was covered.

Canadian banks have no such legal obligation. That is why Mohammed spent months pleading for a partial settlement.

Marketplace put the question to Canada's finance minister, François-Philippe Champagne. He pointed to prevention efforts, including a planned Financial Crimes Agency, and to officers working with police. He stopped short of committing to making banks liable for scam losses.

There is a second effect worth noticing. When British banks pay for scam losses, they invest in stopping scams. Marketplace visited Santander, which now flags suspicious transactions and contacts customers in real time, trying to break the spell before money moves. When the victim pays, nobody else has that reason.

It starts with data

Marketplace confronted one of the scammers. Masked, and using the name Cameron, he told them he makes up to £5,000 from each victim, about $9,400 Canadian.

Listen to what the scam needs in order to work. It needs your name. It needs your phone number. It needs to know where you bank. In Bradshaw's case, the scammers knew her home address. A cold call from a stranger is easy to doubt. A call from someone who already knows your details sounds like the fraud department.

That raw material circulates. A breach is when data a company stored gets exposed or stolen: names, emails, phone numbers, addresses. A data broker is a company that collects your personal information and sells it or lists it where anyone can find it. Put the two together and a scammer can buy or find a convincing script before he ever dials.

That is the part of this story that belongs to us, and it is the part you can act on.

What actually protects you

1. Hang up and call back yourself. If a call claims your card is compromised, end it. Then dial the number on the back of your card. You choose the number, so you know who answers.
2. No courier is coming for your card. Not from a bank. Not from the police. If someone offers to collect your card, it is a scam, every time.
3. Never hand over a card or a PIN. Mohammed says he never shared his PIN, and the money still left. The card alone was enough. Keep both.
4. Check whether your email has been in a breach. It takes a minute and it is free: run the scan. If your address shows up in breaches, change the passwords that matter and turn on two-factor authentication where you can.
5. Shrink what is listed about you. Your name, home address, and phone number sit in data broker and people-search listings right now. Removing those listings does not make the calls impossible. It makes them less informed, and less convincing.

Report it, then cut off the calls

If a scam call reaches you, report it. A report does not get money back by itself. It does something else: it helps investigators link cases together and spot the pattern early, which is how these operations get shut down.

Canada: report fraud to the Canadian Anti-Fraud Centre. Report online at antifraudcentre-centreantifraude.ca (the online form runs through reportcyberandfraud.canada.ca) or by phone at 1-888-495-8501, Monday to Friday, 10 am to 4:45 pm Eastern. The Centre keeps the national record of fraud reports and shares it with law enforcement. Your local police are the ones who investigate.

United States: report fraud to the FTC. File at reportfraud.ftc.gov. The FTC shares reports with more than 2,000 law enforcement partners, and it says plainly that it cannot resolve individual reports. For a scam that ran online, the FBI's Internet Crime Complaint Center takes reports at ic3.gov.

Then reduce the noise. Both countries run a Do Not Call list, and registration is free.

Canada: the National Do Not Call List. Register your home, mobile, fax, or VoIP number at lnnte-dncl.gc.ca or by phone at 1-866-580-DNCL (3625). Legitimate telemarketers have 31 days from registration to stop calling you.

United States: the National Do Not Call Registry. Register at donotcall.gov.

Now the honest part. These lists bind legitimate telemarketers. Criminal scammers ignore them, because ignoring the law is the business model. Registration cuts the background noise, which makes a fake bank call easier to spot for what it is. It lowers your exposure. It does not make you safe, and anyone who tells you otherwise is selling something.

All four routes live on one page, with the family checklist that stops the call before it starts: Report fraud and stop the calls.

The honest limit

Removing your listings reduces what a scammer can know about you. It does not make anyone scam-proof. Ghost Delete does not protect bank accounts, cannot stop a spoofed call, and cannot recover money lost to a scam. The hang-up-and-call-back habit protects your bank account. Removal protects the information the call is built on. You need the first. The second makes the first easier.

What Ghost Delete does

Ghost Delete removes your personal information from data brokers. Coverage is 30 to 50 Tier 1 brokers in the United States and Canada, and every confirmed removal is backed by proof captured by the platform. Start with the free breach scan to see where your email has already surfaced.

Your name, your number, and your address are the opening lines of the scam call. Take them out of circulation.

Be a Ghost.