A major security loophole let an Etobicoke man buy a $3,200 tool using a wrong PIN for his TD Visa
A Toronto Star report says Etobicoke auto shop owner Mark Sach-Anderson’s TD Visa authorized purchases even after entering incorrect PINs, including a $3,200 tool and later tests at a Shoppers Drug Mart and his business. Visa says PIN and signature settings are set by the issuing bank. TD says signature after three wrong PIN attempts is standard protocol and the card was not compromised. FCAC says banks must investigate reported unauthorized transactions.
How this was made
The 30-second read
Why it matters
If regulators determine the fallback undermines consumer expectations or is misconfigured, TD could face remediation costs, compliance actions, and reputational damage. If it is confirmed as standard protocol, impact may remain mostly reputational and limited to customer complaint handling.
Market read
Traders should treat this as a potential compliance and investigation catalyst for TD, but not as confirmed fraud or a confirmed security breach.
What to watch
The article does not provide evidence of compromise, card cloning, or fraud beyond reported unauthorized charges; it also lacks confirmation of how widespread the behavior is across TD’s entire card base and terminals.
Background
The article centers on a TD Business Travel Visa replacement card that appears to authorize transactions even after incorrect PIN entries, then falls back to signature after three wrong attempts.
Ticker impact
Article describes TD Visa card authorizing purchases after repeated wrong PIN entries, with TD citing standard chip-and-signature fallback after three failed attempts.
Near-term impact likely limited unless regulators or audits confirm broader systemic flaws; watch for FCAC/ombudsman developments and any remediation announcements.
The piece is a single reported case with TD’s stated rationale and no confirmed breach. However, it explicitly flags a possible widespread issue and cites regulatory obligations to investigate reported unauthorized transactions.
Market effects
Highlights potential operational/security risk in Canadian chip-and-PIN implementations and the signature fallback design used by issuers.
Could increase scrutiny of Canadian card issuers and payment authentication practices under FCAC oversight.
Moderate, as PIN-to-signature fallback mechanics are common internationally, but the article is Canada-specific and not confirmed as systemic.
Counterpoint
TD’s explanation suggests the system is functioning as designed, with chip-and-signature as an accepted alternative when PIN fails, so the “loophole” may be expected behavior rather than a vulnerability.
Key entities
- companyTD
Issuer of the Visa card described as authorizing transactions after repeated wrong PIN entries, per TD’s stated standard protocol.
- regulatorFinancial Consumer Agency of Canada (FCAC)
Regulator cited as requiring banks to investigate reported unauthorized transactions and to consider technical factors before blaming consumers.
- companyVisa Canada
States card security settings are set by the issuing bank, not the Visa network.
