B.C. woman lost over $500K in bitcoin in 2021 SIM swap fraud scheme, lawsuit alleges

A judge has ordered a B.C. woman who allegedly lost $530,000 worth of bitcoin in a "SIM swap" fraud scheme to resolve her lawsuit out of the courts.

Raelene Vandenbosch began a suit in 2023 against her cellphone company and a mobile kiosk company in Quebec after a scammer posed as a technician to gain the trust of a kiosk clerk, then accessed Rogers' customer records.

Rogers Communications, Match Transact Inc. — the company that owned the mobile kiosk., WOW! mobile boutique — a "John Doe Mobile Clerk" and "John Doe Hacker" are all named as defendants.

A decision filed in June in the Supreme Court of British Columbia says the hacker convinced the kiosk clerk to enable screen sharing with the scammer, giving the hacker access to Rogers' customer database, including Vandenbosch's personal information.

"The hacker performed a SIM swap on the plaintiff's Rogers' account and quickly gained access to her phone number, phone and internet accounts, including the plaintiff's cryptocurrency account," Justice Anita Chan wrote in the decision.

Shortly after the SIM swap, the hacker withdrew bitcoin from two of her cryptocurrency accounts, the decision reads.

"The plaintiff alleges the lost bitcoins were valued at approximately $534,530 at the time of the theft and were valued at approximately $1 million shortly after."

What is a SIM swap?

Roger Gale, educational lead of digital transformation and cybersecurity at the B.C. Institute of Technology (BCIT), said a SIM swap is a type of fraud where a scammer moves a victim's phone number to a new SIM card that is controlled by the fraudster.

"What you're trying to do when you're doing a SIM swap is move the telephone number from that SIM that's in your phone to another SIM that you recode at the kiosk," Gale said.

"If you do a SIM swap, you're not controlling their phone. You've got their phone, so you are them."

SIM swap scams can allow hackers to exploit two-step authentication processes, he said.

It's difficult to recover stolen cryptocurrency or identify a person who is using it, Gale said.

"Once you transfer out the cryptocurrency from the person's wallet, it goes into your wallet and there's only the transaction that is recorded," he said.

"That wallet is not necessarily associated with anything with you. It doesn't necessarily have any association with you except that you use it."

Vandenbosch claimed damages against Rogers under B.C. laws for breach of privacy, breach of contract, negligence and statutory causes of action under the Business Practices and Consumer Protection Act (BPCPA).

Rogers and Match Transact Inc. argued the lawsuit should be stayed in favour of arbitration of all of the plaintiff's claims, except for claims under the BPCPA.

Rogers sought to enforce the arbitration clause included in its wireless services agreement and its terms of service, the decision says.

Justice Chan stayed the lawsuit in favour of arbitration. 

A spokesperson for Rogers did not confirm if and when arbitration would begin between the company and the plaintiff. Match Transact Inc. did not respond to requests for comment at the time of writing.

The plaintiff's lawyers declined to comment.

The Canadian Telecommunications Association (CTA) told CBC News in a written statement that while phone companies have taken steps to mitigate SIM swaps, the association would not disclose specific methods in order to protect the information from hackers.

"Our members take this issue very seriously and, as fraudsters evolve their techniques, they continually strengthen their security measures and verification procedures to protect Canadians," a CTA spokesperson wrote.