FRAUD SQUAD

The “Bank Investigator” Scam That Drained $1.7M

Wednesday, November 19th, 2025

VIEW ALL FRAUD SQUAD ITEMS

Cyber security risk management solutions from DefenseStorm.

When 89-year-old Victoria (Canada) resident picked up the phone, the caller ID displayed: Canadian Imperial Bank of Commerce (CIBC) Fraud Department. What followed was a months-long deception that ended with nearly $1.7 million in cash, bank drafts, and gold gone.

THE SCAM: The caller ID showed the Canadian Imperial Bank of Commerce (CIBC) Fraud Department. The 89-year-old victim, however, did not anticipate that this single phone call would result in an extended scheme spanning several months, ultimately leading to the loss of nearly $1.7 million through cash, bank drafts, and gold.

The most disturbing part? Multiple in person interactions at two major banks didn’t stop it from happening. This is the anatomy of a modern “bank investigator” scam and how it quickly escalated, leaving the victim with devastating losses, shattered trust, and little recourse, as each step deepened their involvement and isolation before the truth finally emerged.

THE SCHEME: It was June 2024 when the call came just after lunch, while Ray Anholt of Victoria, Canada, sorted the mail. The caller ID said CIBC, and calm voice introduced himself from the bank’s fraud team, the kind of voice trained to steady nerves. “There had been suspicious activity,” he said. Not just a rogue charge or two, but something bigger – a national investigation into money laundering. They needed Ray’s help to keep his life savings “safe.”

Anholt listened to the “investigator” from his bank who spoke with authority. “This had to remain confidential”, the caller warned. If word got out, criminals could disappear with the evidence and Anholt’s money.

The next day, instructions arrived: come into the branch, withdraw cash, hand it to a courier who would secure it offsite until the “investigation” concluded. A letter soon followed on what appeared to be official letterhead, stamped…it was serious. The operation felt larger than him with regulators, bank leaders, even public officials’ names invoked. Each step felt like doing his duty to stop these criminals, protect himself, and others.

Anholt began making the withdrawals through an ATM, and a branch manager flagged the withdrawals and froze his online account. He could still, however, withdraw the money in person. When a CIBC manager at a branch became suspicious of the sudden and repeated withdrawals, a letter was sent to him warning that this followed the pattern of a scam. The manager did not go any further than a warning and when Anholt conveyed the concerns to the “investigator,” he didn’t miss a beat. “Move the funds”, the investigator instructed. Different bank. Safer channels. Anholt complied, transferring his nest egg to Royal Bank of Canada (RBC), then returning every few weeks for bank drafts in large amounts. First $50,000, then $120,000, and then $395,000, each one providing a fresh surge of relief that he was “protecting” what he’d earned. The investigator then requested that Anholt withdraw cash to convert into gold and the gold vanished into the hands of a courier at his door with politeness and punctuality as with any delivery service. At no time during these large withdrawals did any teller or branch manager flag the transactions or ask any questions.

Once Anholt had run out of money, he then received a call from someone posing as Chief Justice of Canada explaining that he now owed a tax debt on the nest egg he had withdrawn in cash. Without any available money to pay off the debt, Anholt called his daughter, Jill, for a loan. She asked why and with reluctance, Ray divulged the details of the events that had transpired over the past 6 months – the calls, the letters, the couriers, the gold. She understood at once: this wasn’t an investigation. It was a heist in slow motion.

By the time the truth was revealed, nearly $1.7 million was gone. Jill contacted the Victoria police, a trap was set for the courier and an arrest was made. Anholt and his daughter were left with lingering confusion as to how these transactions were not flagged or stopped by either CIBC or RBC.

Fraud schemes just like this one have become a rising problem, globally. CBC News reported, “Last year alone, Canadians lost more than $643 million to bank fraud — an increase of nearly 300 per cent since 2020.”

Bank accountability critic, Duff Conacher, doesn’t understand how the scam was perpetuated over a whole 6 months without intervention and reports that there is a current obligation for banks to “report suspicious transactions and transactions over $10,000 to the Financial Transactions and Reports Analysis Centre of Canada (Fintrac), which watches for proceeds of crime, money laundering and other criminal behaviour”.

FRAUD SQUAD EXPLAINS

In this case, the first call which came “from the bank,” was a spoofed number that allows the victim to believe it was a call actually coming from their financial institution. Bank spoofing is a common and destructive scam in which fraudsters impersonate banks to steal money and data. The imposter claiming to be running a confidential money‑laundering investigation and needed the victim’s help to “keep his savings safe,” was a ploy to keep the victim isolated and scared.

Each step leveraged classic social‑engineering pressure: deference to authority, secrecy, fear, and speed. For older accountholders who were raised to trust institutions and comply with official requests, this script is devastatingly effective.

Missed Intervention

There were multiple points where the pattern was visible and stoppable:

  • Branch‑level anomalies: frequent, high‑value withdrawals and bank drafts
  • Cross‑institution movement: funds shifted from one FI to another after concerns were raised
  • Unusual purchase pattern: drafts used to buy gold, followed by courier pickup

In this case, staff asked questions at moments but did not sustain or escalate intervention. Regulatory reporting thresholds and unusual activity reviews should have triggered closer scrutiny and coordinated outreach.

Red Flags

  • “We’re from your bank’s fraud team” calling out of the blue
  • Requests to move money for an “investigation” or to “keep it safe”
  • Urgent secrecy and threats of legal trouble or frozen funds
  • Instructions to buy gold, crypto, or gift cards
  • A courier arranged to pick up cash or valuables

If you hear any version of the above, hang up and call your bank or credit union directly using the number on the back of your card or official website. Never call back the number that called you.

What Financial Institutions Should Do

  • Proactively train branch staff to recognize “investigator” scripts and escalate fast
  • Implement prompts for tellers when patterns appear: repeated large withdrawals, bank‑draft‑for‑gold purchases, cross‑institution fund shifts, secrecy cues
  • Enable kiosk or desk‑side intervention checklists and documented “pause and protect” procedures
  • Tighten multi‑factor triggers for high‑risk transaction types and require secondary contact with a known, trusted number

If This Happens To You or Someone You Love

  • Stop all communication immediately
  • Call your bank or credit union using a trusted number
  • Report the incident to local police and your country’s fraud reporting center [in the US: https://reportfraud.ftc.gov]
  • Preserve evidence: call logs, texts, emails, letters, courier info, receipts

CBC News RBC and CIBC allow 89-year-old to drain life savings, lose $1.7M to scammers https://www.cbc.ca/news/gopublic/bank-investigator-fraud-scam-9.6950754

CBC News RBC and CIBC allow 89-year-old to drain life savings, lose $1.7M to scammers | Go Public https://www.youtube.com/watch?v=_SaNo_jwTO4

DefenseStorm

DefenseStorm experts collaborate to share valuable insights, tips, trends, and resources about cyber risk management. Information sharing is a critical component of cyber risk readiness and considered a best practice to improve cyber risk awareness. As a leader in the industry, we strive to build a community of trust by providing the most current and important information that affects your financial institution.