'They have access to your entire identity': TD Bank insider blows whistle on work being moved to India | CBC News (2024)

Alyson Mosher knows a lot of private information about the TD Bank customers whose fraud claims she handles —and now, she says, that information is going to offshore workers without most people's knowledge.

"They see your birth date, your social insurance number, whether you have a chequing account, a savings account, a line of credit, a mortgage, investments, Visa cards, anything," Mosher says.

"They have access to your entire identity."

• Been wronged? Contact Erica and the Go Public team

Mosher and her colleagues used to investigate fraud claims — cases where customers' Visa or debit cards were compromised, or used without the owner's knowledge.

She contacted Go Public after becoming increasingly concerned about the amount of work TD has started sending overseas, instead of having it done by employees in the bank's Markham, Ont., fraud claims department.

Over the past two years, Mosher says work has been transferred to people working in Hyderabad and Chennai, India. Go Public has confirmed those contract workers are employed by the outsourcing giant Tata Consultancy Services.

"TD advertises a lot about 'trust'," says Mosher. "Customers are giving the bank a lot of personal information, trusting that it is in the right hands."

Complaint filed with privacy commissioner

Mosher is so concerned about the amount of customer information being shared offshore, she's filed a formal complaint with the Office of the Privacy Commissioner of Canada, alleging that TD is not being upfront with its customers.

In her complaint, she describes how fraud investigations are processed in India, but if a call to a customer is required, the claim goes back to Canada for a representative to handle.

I believe this is being done to hide from the customer what processes and information is being sent offshore to India.- AlysonMosher, TD fraud claim agent

"The customer is led to believe that I am the person working the claim and that I am the person receiving all of their documents and information," writes Mosher. "Not an agent in India.

"I think if they were being upfront and honest, then they would have these agents from offshore on the phone. To try and hide that seems like they're trying to camouflage that they're sending your information to India."

Mosher has no idea how many jobs have been created in India, but says a colleague sent to India to set up operations told her there were about 120 people doing fraud claims for TD.

TD's response

A spokesperson for TD Bank declined Go Public's request for an interview, but responded to questions in several emails.

Spokesperson Mohammed Nakhooda denies that TD is trying to keep customers from learning their information is being handled offshore. He says Canadian workers do the customer contact because they are "trained customer service representatives" adding that TD makes "limited use of (offshore) vendors to complement work done by TD employees" and that none of the offshore jobs is permanent.

He would not say how many fraud claims jobs have been created offshore, or why the bank didn't hire Canadians for those jobs, but said no one in Canada has lost their job because of the outsourcing.

But Mosher says that people who have left the department have either not been replaced, or been replaced by temporary contract workers.

TD employs almost 60,000 people in Canada, but Nakhooda did not explain why the bank has moved work to India.

As for telling customers their information can been accessed by offshore workers, Nakhooda said that is spelled out in a clause on the bank's cardholder terms of agreement and on its website, noting that information may be shared with other parties worldwide.

'Nobody reads cardholder agreement'

A leading privacy expert says it's "not acceptable" to expect customers of a bank —or any company —to read the fine print in the lengthy terms and conditions that often accompany products.

"Nobody reads the cardholder agreement," says Ann Cavoukian, who served three terms as the information and privacy commissioner of Ontario, and now heads up Ryerson University's Privacy by Design Centre of Excellence.

"I think transparency is very important in this day and age," says Cavoukian. "People want to know who can see their private information. That needs to be spelled out loud and clear, especially when there seems to be cyberattacks on a daily basis."

Last month saw one of the largest data breaches in history. Equifax, one of the world's largest credit reporting agencies, got hacked, exposing the personal information of 143 million Americans and 100,000 Canadians.

Any time there's a breach relating to your personal data, people should be notified.- Ann Cavoukian, privacy expert

In Canada, there's no way to know how many breaches there are, because unlike most U.S. states and European countries, no mandatory requirement exists for companies to report them —it's voluntary.

According to the Office of the Privacy Commissioner of Canada, there were 100 voluntary breach reports between April 1, 2016, and March 31 of this year. One-quarter of those breaches occurred in the financial sector.

Personal data 'exposed'

Data security expert Marc-Roger Gagnésays any time a company moves work offshore, it creates an opportunity for cyberattackers.

"It gives them another point of entry, aside from the server in Toronto," says Gagné. "Your data is exposed at another end, instead of just one centralized area —Toronto. That is an exposure that wouldn't be there if the information was controlled and processed within Canada."

TD Bank says its security teams "work diligently to protect data against unauthorized access and have implemented comprehensive measures to protect ... customers' information."

CLC president outraged

The president of the Canadian Labour Congress says he's outraged that TD Bank is creating jobs in India instead of Canada.

"I think most Canadians would find this simply unacceptable," says Hassan Yussuff, pointing out that TD recently posted record profits. "There's no justification for this behaviour, other than to increase those profits."

While TD's Nakhooda told Go Public that no one in Canada has lost their job, Yussuff says that's "disingenuous."

"If you're taking work from Canadian workers and moving it to another jurisdiction outside the country, there is job loss," he says.

"I think it's fair for the federal government to say, 'We're going to bring in tighter regulations to ensure the banks are not going to offshore services that should be performed by Canadians in this country."

Many banks hiring offshore

TD Bank is not alone in its move to hire contract workers offshore. Go Public contacted Canada's other four big banks — Scotiabank and RBC confirmed they use offshore workers. BMO and CIBC would not answer questions about outsourcing.

• 'Very depressing': CIBC staff losing jobs to workers in India, expected to help with training

• RBC replaces Canadian staff with foreign workers

• Outsourcing bank jobs is common practice, say employees

The Canadian Bankers Associationtold Go Public that banks outsource work to other countries to enable them to provide service efficiency for the best value and that the cost savings allow banks "to invest in areas that deliver greater value for the bank and its customers."

Reluctant whistleblower

Mosher says she wrote to TD's WhistleblowerHotline and only went public afterher concerns weren't addressed.

"We teach children that they should always stand up for what they believe in, but asadults we don't always follow that," she says. "If we all sit there ... nothing will ever change in this world."