CRTC asking GoDaddy for personal info in CRA text scam

The CRTC has served a web hosting provider with an order to produce a series of documents identifying the perpetrators who posed as the nation’s tax agency in a phishing scam last fall. The regulator had fielded complaints about text messages, received in September and October 2018, claiming the recipients would obtain a monetary refund from the Canada Revenue Agency through a hyperlink in the text, which routed the complainants to a fake page where bank credentials were collected. The active investigation is part of a compliance inquiry with Canada’s Anti-Spam Legislation (CASL) and was confidential until the CRTC’s request for information was filed in Federal Court in mid-August. It has so-far revealed that the phishing pages were registered with domain registrar and web hosting platform GoDaddy.com LLC, with the registrant’s province listed as Quebec. CASL allows the CRTC to file such a demand with the court to ensure that the request is enforced by the judiciary, if necessary. The commission had asked for billing and account information since the earliest of either September 1, 2018 or when the domain was registered, to November 1, 2018. That includes names, addresses, emails, phone numbers, payment information such as history and method of payment, IP addresses associated with the domains, accounts or users and any other domains registered to GoDaddy by the account holder. According to the CRTC, the text messages read either, “Interac: C.R.A tax return sent you funds visit: www.c-dept.com” or “Canada Revenue Agency (CRA) sent you money. See www.canada-go-rev.com.” The CRA and payments facilitator Interac already warn users on their websites about phishing scams. The deadline for GoDaddy -- which is not the subject of the investigation but merely a third-party -- to comply with the request was August 30. GoDaddy’s international public relations team head did not return a request in time for publishing about whether or not it has complied. CRTC spokeswoman Patricia Valladao said the commission cannot comment on active investigations when asked if Arizona-based GoDaddy complied with the request, but said parties that are asked to hand over information are “often Canadian but can also be foreign companies providing services to Canadians.” These types of requests for information are not unusual, Valladao said. Under CASL, which came into force in 2014, the CRTC has the authority to request information emerging from complaints to verify compliance with the law. Since 2014, enforcement efforts under CASL have yielded $1.75 million in penalties. Email is the number one source of spam, while text message spam “continues to rise,” the CRTC said in its latest highlights page for the period between Oct. 1, 2018 and March 31, 2019. Between April 2018 and March 2019, there have been 75 notices to produce information. The regulator is responsible for the investigation and enforcement of a few pertinent sections of CASL in the GoDaddy case, including the sending of electronic messages without the recipient's prior consent, the inability to withdraw consent, and the unauthorized installation of computer programs. But the investigation comes on the heels of the regulator’s first penalties issued against an individual under CASL -- a $100,000 administrative monetary penalty (AMP) against the former CEO of a coupon marketing company in April. The maximum AMP for an individual under CASL is $1 million, while a business can be liable for damages of up-to $10 million. Last year, the regulator issued the first fine -- $250,000 -- under the legislation against two companies that installed malware through online ads. GoDaddy has the right to ask the CRTC to review the case if it finds that the disclosure request is unreasonable and/or reveals privileged information. Otherwise, if the company fails to comply, it would be found to have committed an offence under the act. GoDaddy is a member of the Washington-D.C.-based Internet Infrastructure Coalition, which last year came out against a proposal for the CRTC to implement a regime that would compel internet service providers to block from view websites that contain pirated material. In their submission to the CRTC -- which was reviewing the proposal before ruling it out of its jurisdiction -- the coalition said the proposal would “shutter legitimate businesses,” harm Canada’s internet economy and “stifle innovation.” Last month, following mass shootings in Texas and Ohio, cloud host provider Cloudflare removed the website 8Chan from its platform because it was allegedly the home for several perpetrators of mass shootings around the world. — With reporting by Ahmad Hathout at ahathout@thewirereport.ca and editing by Anja Karadeglija at akarad@thewirereport.ca

CRTC asking GoDaddy for personal info in CRA text scam

News | September 5, 2019

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

CRTC asking GoDaddy for personal info in CRA text scam

News | September 5, 2019

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Freedom Mobile no longer pursuing full MVNO status

Federal arbitrator releases paid time political broadcast schedule

TV broadcasters denounce streamers’ appeals of CRTC’s broadcasting contribution decision

CRTC considering expanded mandate for Broadcasting Participation Fund

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us