It was billed as the largest-ever Presto card fraud bust. But a year later, it’s unclear whether the lone suspect will ever face trial — and whether Metrolinx is even capable of fighting s
By the middle of last summer, Metrolinx special constables believed they'd made a major breakthrough.
After a months-long investigation by transit agency officers, on July 30, 2020, a North York resident in his late 30s was arrested and charged in connection with what the organization would later tell media was the largest case of alleged Presto fare card fraud it had ever handled.
In a statement to the Star months after the arrest, Metrolinx described the alleged scheme as organized" and deplorable," and praised its investigators for breaking it up.
The man was charged with fraud over $5,000. The allegations against him have not been proven in court.
Two sources with knowledge of Metrolinx's handling of Presto fraud cases told the Star the agency's investigators believed the man was just one participant in a sophisticated and lucrative scam that involved hundreds of Presto cards loaded with thousands of dollars of illicit funds.
But a year after his arrest, the case against him appears to have gone nowhere, and it's uncertain whether the only person arrested in Metrolinx's largest-ever Presto fraud investigation will face trial.
The circumstances around the case have not previously been reported. They raise questions about the ability of Metrolinx, its Presto division and law enforcement to work together to investigate, prosecute and deter Presto fare card scams. Those scams victimize riders and transportation agencies, and have the potential to cost taxpayers millions.
One of the sources, who spoke on the condition of anonymity because they weren't authorized to talk publicly about Metrolinx cases, said people involved in sophisticated fare card scams have figured out how to essentially print money on the back of the provincial taxpayer."
Metrolinx does nothing" about fraud, said the other source, who also spoke on the condition of anonymity. That's what makes them vulnerable."
Metrolinx chief payments officer Barclay Hancock strongly denied those claims. In a statement, he said the agency protects our customers and transit agency clients," and has robust systems in place to monitor, detect and take action against fraudulent activity."
The provincial agency says it has implemented industry best practices around prevention and is continuously improving our fraud defences."
But Metrolinx also makes clear that while it has a duty to detect and prevent fraud, convictions and punishments are outside of the responsibility" of the transit agency.
Toronto police, to which Metrolinx referred the fraud case after the arrest last summer, declined to answer questions about its status.
After being advised by the Ministry of the Attorney General that court staff have no record of the man's charges, the Star is not naming him.
His lawyer said his client declined to comment on the unproven allegations, other than to say that he was actively engaged in his defence and was diligent about trying to have this matter brought before the court."
Presto is a division of Metrolinx, the Ontario Crown corporation that operates GO Transit and oversees transit planning in the Greater Toronto and Hamilton Area. The fare card system launched in 2009 and is now used by 11 agencies across the region and in Ottawa, including OC Transpo, MiWay, GO and its biggest client, the TTC.
According to Metrolinx, before the pandemic Presto handled 440 million transactions a year worth nearly $3 billion. By the end of 2019 more than 2.3 million cards were in active use.
Like any fare collection system, Presto is vulnerable to abuse, and illegitimate sales of fare cards are easy to find online. Metrolinx says it's constantly monitoring online marketplaces and submits formal requests directing platforms to remove the ads. The agency also advises riders to buy cards only from authorized vendors.
Presto scams can take different forms and victimize different parties. A simple version is adults using child fare cards to ride the TTC for free. In February 2020, a report from the TTC indicated the agency may have been losing more than $23 million annually as a result of child card misuse.
More than a year after the report, a TTC spokesperson said the agency and Metrolinx co-operate to fight fraud as best they can, and the two organizations are working to develop policies around fare evasion."
A more sophisticated type of fraud involves criminals using stolen credit card information, which can be obtained through hacks or data leaks, to load money onto Presto cards, and then selling them to transit users at cut rates.
Credit card holders are usually reimbursed for fraudulent charges once they're discovered. According to Metrolinx, either the transit agency or the cardholder's bank is responsible for covering losses from Presto frauds that use stolen credit cards, depending on the circumstances.
Tony Anscombe, a cybersecurity expert with the internet security firm ESET, said products like Presto are attractive to cybercriminals because they're an efficient way to convert stolen credit card data into cash.
In effect the Presto card is being used to launder the (credit card) fraud," Anscombe explained. Buying physical goods is much harder to push back into cash, but certainly you can do it through a service, such as transit cards."
Although Metrolinx is funded by Ontario taxpayers, the agency declined repeated requests from the Star to reveal how much money it loses to Presto scams. We will not disclose specifics that would quantify potential rewards for fraudsters," spokesperson Anne Marie Aikins said.
According to the sources who spoke to the Star, Metrolinx investigators believed at least a dozen people took part in the alleged scam that led to the arrest last July. They believed the scheme involved cards loaded with stolen credit card information that had been bought from the dark web. One Presto card could be sold multiple times, with each seller down the chain raising the price to make a profit.
Investigators believed the man they arrested was above others in the chain of sellers but was not the leader. He worked at a Shoppers Drug Mart, the chain that has an exclusive deal with Metrolinx to sell Presto cards, but investigators didn't conclude whether his job played a direct role in the alleged scam.
Shoppers' parent company, Loblaw, didn't respond to requests for comment.
Metrolinx investigators believed the scheme had been in operation since at least early 2018, and had netted hundreds of thousands of dollars for those involved.
According to the sources, the alleged scam should have been easily detectable by Metrolinx's Presto division. The fare cards involved were registered on Presto's website, and many were linked to the same phoney addresses and phone numbers. Cardholders' last names were listed as Presto."
The sources claimed that despite the obviously suspicious registration activity, Presto didn't alert Metrolinx's investigative unit or the police. Instead, the fare card division reacted by hotlisting," or cancelling, the many fare cards it believed had been compromised. The people involved in the alleged fraud simply kept track of which cards had been cancelled and replaced them, the sources alleged.
The sources said Metrolinx officers would never have launched their investigation, but they stumbled onto the alleged scheme by accident in early 2020.
There's no sharing of information (by Presto) with the police or even the GO Transit constables. It's a farce," said one of the sources.
Statistics that Metrolinx provided indicate only a fraction of suspected frauds trigger police investigations. In the past two fiscal years, Metrolinx hotlisted 19,000 Presto cards it suspected had been compromised. By comparison, in the past three years, it referred 19 suspected frauds to law enforcement. Only two of those referrals resulted in charges.
Aikins, the Metrolinx spokesperson, denied that Presto doesn't do enough to go after suspected scammers. We are proactive about deterring and monitoring fraud" and recover funds wherever possible," she said.
She described hotlisting cards as a key part of Metrolinx's deterrence efforts, and said the practice stops the circulation of illicit cards while allowing Presto to recoup the remaining balance on the compromised fare card.
Aikins said Presto continues to improve security. In the past two years it instituted an address verification system for online sales, and in the past year it introduced a card verification value, which requires online buyers to input the three-digit security code found on the back of their credit card.
By the end of 2021, Metrolinx plans to adopt a new payment system called 3D Secure 2.0, which Aikins said will allow Presto to better authenticate online sales and reduce fraud liability.
Fraud cases are notoriously hard to prosecute, and Anscombe, the private security expert, said Metrolinx faces an uphill battle fighting it. Data breaches that allow criminals to illegally obtain credit card information have become common, and card companies or cardholders are often best placed to detect suspicious activity. A vendor like Presto is kind of stuck in the middle," he said.
But he suggested Metrolinx hasn't always had the strongest defences in place. Requiring a cardholder's three-digit security code is a routine measure widely used by online merchants, and he said he was shocked" Presto had only recently adopted it.
The case against the man charged last July appears to have stalled after Metrolinx investigators handed it over to Toronto police.
While the transit agency's officers have the power to investigate and arrest, local police services are responsible for filing the required paperwork and shepherding Metrolinx criminal cases through the courts.
In last summer's alleged Presto fraud case, it appears Toronto police never submitted a vital document, known as an information." The man's lawyer told the Star that by the time of the first scheduled court date last October no information about the allegations had been filed, and from what I can see, no further steps were taken."
The lawyer said his client was contacted by police again in May, and was co-operative. But his attorney argues that by then enough time had elapsed without any progress that under the Criminal Code, the fraud charge must be considered dismissed.
The lawyer said his client made every conceivable effort to get his day in court. And someone else screwed it up."
It's unclear whether the man could still be re-charged and face trial. A spokesperson for the attorney general said last week court staff could find no record of the case.
Toronto police spokesperson Jenniferjit Sidhu did not answer questions about what happened to the case, including whether the force decided not to pursue it. She didn't answer directly when asked whether the force considers combating Presto fraud a priority, or comment on whether its policies about working with Metrolinx officers ensure effective prosecutions.
Asked for information about how many people the force has charged in connection with Presto frauds in the past three years, Sidhu said the figures weren't readily available, and directed the Star to file a freedom of information request.
Bill Grodzinski, who was director of security and chief special constable at Metrolinx for eight years until his retirement in January, said in an interview the relationship between the agency's transit safety division and the 14 police services whose jurisdictions Metrolinx operates in can be informal, and produce different results depending on the officers involved and police caseloads at the time.
Not every one of those (cases) that we bring to the police gets prosecuted," Grodzinski said. They're busy people, and you're just more work to them sometimes."
There have also been disagreements within Metrolinx about how aggressive it should be in fighting Presto fraud.
News outlets have shown how easy it is to track down alleged scammers by filming their reporters buying illicit child cards advertised online. According to multiple sources, in recent years some members of Metrolinx's transit safety division advocated doing something similar and performing controlled buys," in which undercover officers would arrange to purchase illicit Presto cards and then arrest the seller.
But Grodzinski said he shut down that idea, which he characterized as coming from a group of ambitious officers who thought the agency's transit constables should function more like police. Grodzinski, a former OPP officer, said card-buying stings were risky and best left to regular police.
Grodzinski said he took the position that Metrolinx's transit safety division wasn't responsible for rooting out Presto fraud on behalf of the entire organization. The department has just 85 special constables, whose resources are stretched dealing with assaults, thefts, suicides and other incidents across a GO bus and rail network that spans more than 11,000 square kilometres.
We're a transit agency; we're not a police organization," he said.
In his near-decade leading the division, he said his stance was Presto owns Presto, and they own everything about it. So they own the risk."
Ben Spurr is a Toronto-based reporter covering transportation for the Star. Reach him by email at bspurr@thestar.ca or follow him on Twitter: @BenSpurr