Every day, dozens of people contact Metro to denounce fraud on their points card, told The press A confidential source in contact daily with the public for Metro. The grocer challenges these figures and claims to have received around 300 cases since the start of the Metro & me program in 2023, just under a case every two days.
“There is clearly an increase in the last months of fraud,” says the source, which requires anonymity, because it fears dismissal. There are lots of [vols de points] At Metro. »»
The company categorically rejects these figures. “Less than 300 cases of points flights have been listed since the creation of the program [Metro & Moi]out of a total of almost 4.8 million active members, ”says Metro by email, adding that it is a percentage of 0.006 % of affected users.
The retailer also points out that data leaks arrived “as a result of identity thefts occurring on external sites which are in no way linked to Metro”.
The press The fraud reported last Thursday, which was the victim Natalie Gauthier, who was robbed for nearly $ 500 in metro award points. Following the publication of the article, eight point cards users reported similar experiences.
Read “two customers have been stolen their points M”
On April 21 in the evening, Marthe Charles saw an unusual transaction of $ 37 on her account appear. On the same day, his email address was hacked. She reports the flight to Metro, who reimburses her in a few weeks.
Since then, she has been using the paper version of the points card, being afraid of a second fraud.
Same scenario for Linda Lalande, which was defrauded for $ 62 last Friday. The resident of Sainte-Rose, in Laval, suddenly seen a transaction on the other side of the Outaouais river, in Ontario.
She was fortunate to be reimbursed in two stages, three movements by Metro, receiving the points lost on Sunday.
“At one point, you lose confidence in the security of your data,” says Linda Lalande.
Possible, but expensive solutions
Cybersecurity expert Jean Loup Le Roux confirms that a large volume of fraud does not necessarily mean a leak in the intern, although it is a possibility.
Other websites can for example make public information public information which are then used by fraudsters. Home -bringing campaigns can also steal from several of loyalty accounting identifiers.
Race result: Companies offering loyalty programs must face the multiple attempts to theft of points card accounts.
However, they often have a “weak technological maturity” which makes them vulnerable to fraud, explains Mr. Roux.
Several tools could allow companies to put sticks in the wheels of fraudsters; Two factors verification, which could be compulsory after a certain amount, would make thefts on points cards considerably more difficult.
“But then you have to protect them, this information!” “Explains the cybersecurity expert. Such security measures therefore require a large IT infrastructure to support them.
Preventive blockages can also be put in place, to prevent certain shady transactions, far from the usual places of purchase or when large volumes of transactions are done at the same time.
All these security measures can cost companies dearly, it does not matter that they put them in place internally or subcontract these operations.
“In the end, it goes back to a strategic vision of the organization: do companies want to invest in there […]does it make sense economically? I don’t have the answer, ”he said on the phone.
Point cards would be an “easy option for fraudsters” because they are not very regulated. “The Financial Markets Authority will not regulate Provigo, […] IGA does not have the ambition to print money, ”illustrates the expert. It is a dead angle of the system, believes Jean Loup Le Roux.
