This report documents our findings for the following issue raised by the customer:
The customer’s complaint is that the service provider notifies or fails to notify the customer of a substantial change to an agreement or terms which the customer considers to be a breach of an existing agreement.
Please note that in their complaint, the customer also submitted issues that fall outside of the scope of our mandate. As a result, our investigation findings are based solely on the numbered issue listed above.
Summary of Findings
After analyzing the information and evidence from both parties we determined that the service provider reasonably performed its obligations towards the customer and found no fault in its handling of the issues brought forth.
Analysis Details
Issue 1: The customer’s complaint is that the service provider notifies or fails to notify the customer of a substantial change to an agreement or terms which the customer considers to be a breach of an existing agreement.
The customer’s complaint is that someone contacted the service provider, impersonating the customer on February 2/3, 2025. The customer’s complaint is that the service provider issued an ESIM to the person contacting the service provider as the customer which allowed the person to make changes to the customer’s account, leading to fraudulent activity. The customer’s complaint is that the service provider did not properly use voice recognition services and account verification protocol, leading to the changes to the customer’s account.
We note that while the CCTS can address the customer’s claim that the service provider did not follow their account verification process properly, the CCTS does not have the ability to address complaints relating to fraud, as outlined in the CCTS Procedural Code.
We note that the service provider confirmed that the customer did have voice ID set up on their account at the time of the account changes on February 2, 2025.
We reviewed the service provider’s internal policy for account verification to confirm that the service provider is to use voice ID when applicable. In cases where the voice ID does not produce a match or isn’t available, the service provider can then authenticate the monthly user through their internal system. To do so, the service provider must obtain the customer’s full name and require the customer to provide their postal code and date of birth. In cases where the customer is unable to identify the postal code and date of birth, the provider is to ask one additional question which provides identifying details about the customer’s service account including the email address on file or the account number among other verification question options.
We reviewed the chat transcript from February 2, 2025, to confirm that on this date, the service provider was contacted by someone who was able to provide the following information to the service provider:
The customer’s full name.
The customer’s account number.
The customer’s email address.
We note that as a result of the account verification, the service provider engaged in changes to the customer’s SIM card at this time, at the customer’s request.
We note that the information provided to the service provider is sufficient for account access, as outlined in the service provider’s policy.
We note that in review of the customer’s account notes, the customer informed the customer on February 3, 2025, that they did not authorize any changes to their account and the service provider reversed the changes.
As a result, we find that the service provider respected their obligations in following account verification processes prior to making changes to the customer’s services.