BMO Phishing: A Multi-Million Dollar Threat to Canada's Largest Bank
Bank of Montreal (BMO) is one of Canada's Big Six banks, serving 12 million customers across retail, business, and investment segments. BMO's size and brand recognition make it a high-value phishing target. Every day, thousands of fake BMO emails, texts, and calls are sent to unsuspecting customers, with success rates that reward the scammer's effort. BMO phishing scams cost Canadians millions annually through credential theft, account takeover, and fraudulent transfers.
Unlike isolated phishing attempts, organized fraud rings operate systematic BMO phishing campaigns, testing new domain names, email templates, and social engineering scripts continuously. They analyze which messages get the highest click-through rates and refine them. The most successful scammers combine email phishing with follow-up phone calls (vishing), creating a multi-stage attack that's difficult to resist even for security-aware customers.
How BMO Phishing Attacks Work
BMO phishing scammers operate across multiple channels simultaneously: email, SMS, phone calls, and fake websites. The initial contact creates urgency or alarm (account locked, fraud detected, update required). The victim is directed to a fake website or prompted to provide information over the phone. Once credentials are captured, the scammer accesses the victim's account and either steals money directly or sets up the account for future exploitation.
Fake BMO IntelliConnect and BMO Online Banking Login Phishing
Scammers send emails claiming to be from BMO IntelliConnect (BMO's business banking platform) or BMO Online Banking, stating that your account requires urgent verification due to a security update, suspicious login attempt, or system maintenance. The email displays BMO's logo, uses professional formatting, and includes a prominent button or link labeled "Verify Account," "Update Security Information," or "Confirm Your Identity." Clicking the link takes you to a website that looks nearly identical to the real BMO site—same blue branding, same layout, same field names. You enter your username and password. You may be prompted for your security question answer or account PIN. The scammer now has full access to your account and can view balances, transaction history, and initiate transfers.
These phishing emails often contain subtle giveaways: generic greetings ("Dear BMO Customer"), urgent threats (your account will be closed in 24 hours), suspicious links (the actual URL behind the button doesn't go to bmo.com), or slightly misspelled language. Real BMO emails address you by name, use @bmo.com sender addresses, never ask for passwords via email, and provide links only to official BMO domains.
Fake BMO Credit Card "Transaction Declined" Text Scams
One of the most effective BMO phishing tactics is the SMS text message mimicking BMO's legitimate fraud alerts. The scammer sends a text that reads: "BMO ALERT: Your card was declined at [STORE]. If unauthorized, click here to verify." The link leads to a fake login page. When you enter your card details—card number, expiration date, CVV, and billing postal code—the scammer can immediately use this information to make fraudulent charges or sell it to other criminals. Alternatively, the scammer may send: "Your BMO account is locked. Click to unlock: [fake link]." These messages are effective because they mimic BMO's actual fraud detection alerts, which customers receive regularly and trust.
BMO Nesbitt Burns Investment Account Phishing
BMO Nesbitt Burns is BMO's investment and wealth management division, serving customers with investment portfolios, RRSPs, TFSAs, and other holdings. Scammers target these accounts with sophisticated phishing emails claiming there's a problem with a recent transaction, a dividend payment has been delayed, a margin call requires immediate attention, or a withdrawal is pending verification. These messages are crafted to appear urgent and technical. The fake links direct to credential capture pages. Once accessed, a scammer can liquidate investments without authorization, change beneficiary information, or apply for loans secured against the account. These attacks often result in substantial losses because the accounts contain significant assets.
The BMO Fraud Call OTP Relay Pattern
This attack combines phone calls with OTP capture. A scammer calls claiming to be from BMO's fraud department, stating that unauthorized transactions have been detected on your account. To "verify your identity and protect your account," they ask you to log into BMO Online Banking right now. You do so on your own phone or computer. The scammer then asks you to perform a transaction—perhaps checking your account balance or attempting a test transfer—which triggers an OTP to be sent to you via SMS or email. The scammer then asks you to read this OTP aloud so they can "confirm it matches their system." Once they have the OTP, they use it to log into your account on their device and immediately transfer funds or open new lines of credit. This attack is particularly dangerous because you've authenticated yourself and authorized the OTP generation, creating confusion if you later report fraud.
Fake BMO Business Banking Emails Targeting Small Business Owners
Scammers specifically target small business owners with BMO business banking phishing emails claiming to require urgent verification of business banking credentials, T4 information updates, payroll system verification, or GST/HST compliance checks. These messages often reference specific business details found through LinkedIn or public records to establish false credibility. The fake links direct to credential pages. Once a scammer accesses a business account, the impact is multiplied: they can access business funds, payroll accounts, and business credit accounts. Small business owners are often more trusting and less security-aware than larger organizations, making them attractive targets.
How Real BMO Contacts You
Understanding how BMO actually communicates is critical for defending against phishing. Real BMO emails always come from @bmo.com or official BMO subdomains. Real BMO will never ask for your full password via email, phone, or text. Real BMO will never ask you to read an OTP or security code to anyone, including BMO staff. Real BMO will never ask you to log into your account during an inbound call they initiate—they provide account information to you, not the other way around. If BMO needs to verify information, they'll ask you to call their official number or log into BMO Online Banking yourself, never through a link they provide. Real BMO messages are personalized with your name, account type, and specific details about your account. Generic messages are red flags.
BMO's Official Fraud Line and Support Numbers
If you suspect fraud or receive a suspicious BMO message, use only official BMO contact information to verify. BMO's fraud line is 1-877-225-5266. This number appears on your BMO statements and the official BMO website. When you call this number, BMO staff can immediately review your account for unauthorized activity, freeze your account if necessary, and initiate a fraud investigation. If you've provided credentials to a phishing site, call this number immediately to change your password and enable additional security measures. Never use a phone number provided by the suspicious message—always look it up independently on the official BMO website or your statements.
How to Report Phishing to BMO
If you receive a suspicious email claiming to be from BMO, report it directly to BMO's security team. Forward the phishing email (without clicking any links in it) to phishing@bmo.com. Include the full message, all headers showing the sender's email address, and any details about how you received it. BMO monitors this address and can take action: blocking the phishing domain, notifying law enforcement, and adding the fraudulent sender to their blocklist. This creates a record that helps BMO protect other customers from the same scammer. If you received a text message phishing attempt, report it to your wireless provider as spam and contact BMO directly through their official channels.
What to Do If Your BMO Account Is Compromised
If you suspect your BMO account has been compromised through phishing or credential theft, act immediately. First, call BMO's fraud line at 1-877-225-5266 to report the fraud, verify any unauthorized transactions, and have your account frozen or secured. Second, change your BMO password to a strong, unique password you've never used before. Enable two-factor authentication if you haven't already. Third, review your account statements for the past 30 days, looking for unauthorized transactions, pending transfers, or changes to beneficiary information. Fourth, if unauthorized transfers have occurred, file a police report and provide BMO with the report number—this may be required for dispute resolution. Fifth, check your credit file by contacting Equifax Canada (1-800-465-7166) or TransUnion Canada (1-855-888-5005) to look for unauthorized credit applications or accounts opened in your name. Consider placing a fraud alert or credit freeze. Sixth, scan your computer for malware using reputable antivirus software. If your device was used to access the phishing site, consider having it professionally cleaned.
Protection and Prevention Strategies
- Never click links in unsolicited BMO emails or texts. Instead, log into BMO Online Banking directly in your web browser (type bmo.com yourself) or call BMO's official fraud line to verify the message is legitimate.
- Enable two-factor authentication on your BMO account. This prevents scammers from accessing your account even if they obtain your password. BMO offers multiple 2FA methods including SMS, email, and authenticator apps.
- Set up transaction alerts. Configure BMO alerts to notify you of large transfers, new payee additions, password changes, or unusual login attempts. This allows rapid detection of fraud.
- Use a unique, strong password for BMO. Never reuse passwords across websites. Use a password manager to generate and store complex passwords securely.
- Verify caller identity before providing any information. If someone calls claiming to be from BMO, hang up immediately and call BMO's official number from your statement or the official website.
- Keep your devices secure. Use current antivirus software, enable automatic updates on all devices, avoid using public Wi-Fi for banking, and regularly clear browser cache and cookies.
- Monitor your BMO accounts regularly. Log in at least weekly to check for unauthorized activity or changes to account settings.
The Bottom Line
BMO phishing is sophisticated and well-organized. Scammers continuously refine their techniques and test new domains and email templates. The most effective defense is consistent skepticism: verify independently rather than trusting the channel by which you were contacted. Real banks expect and respect verification calls. If you receive urgent BMO communications, don't use the contact information provided—look it up yourself. This simple habit can prevent account takeover and fraud.
Other Scams to Watch For
People researching this scam also check these related pages.
TD Bank Scam
Identify TD Bank impersonation scams and phishing attempts.
Check NowCIBC Scam
Recognize fake CIBC messages and account phishing attacks.
Check NowScotiabank Phishing
Identify Scotiabank phishing messages and spoofed emails.
Check NowRoyal Bank Phishing
Detect fake RBC Royal Bank phishing attempts.
Check NowEQ Bank Scam Checker
Verify EQ Bank messages and spot digital banking scams.
Check NowSimplii Financial Scam Checker
Check suspicious Simplii Financial messages for fraud.
Check NowTangerine Scam Checker
Detect fake Tangerine bank messages and phishing scams.
Check NowPC Financial Scam Checker
Identify PC Financial fraud attempts and spoofed messages.
Check NowCan BMO reverse fraudulent transfers?
BMO can sometimes reverse unauthorized transactions if reported within a specific timeframe—typically within two business days for wire transfers and 30 days for other unauthorized transactions. However, if scammers have already transferred funds to another bank or converted them to cryptocurrency, recovery becomes extremely difficult. Report fraud immediately for the best chance of reversal.
Does BMO ever ask for passwords or OTPs via email or phone?
Never. BMO's security protocols ensure that you enter sensitive information only through secure, authenticated channels—never in response to unsolicited emails, texts, or phone calls. BMO staff will never ask for your password, full card number, OTP, or security questions via any unsolicited communication.
What if I entered my credentials on a phishing site?
Call BMO's fraud line immediately at 1-877-225-5266 to change your password and secure your account. Also change your password for any other online accounts that use the same password. Run a malware scan on your device to ensure no malicious software was installed. Monitor your account closely for unauthorized activity over the next 30-60 days.
Can scammers open new BMO accounts with my stolen information?
If a scammer has your full personal information (name, SIN, date of birth, address), they may attempt to open new accounts or apply for credit. This is why monitoring your credit report regularly is essential. Check your credit file free annually through Equifax or TransUnion, and consider credit monitoring services for continuous protection.
Are BMO's subdomains legitimate?
BMO uses @bmo.com and official BMO subdomains (like @noreply.bmo.com or @alerts.bmo.com) for legitimate communications. However, the domain will always end in @bmo.com. Scammers use lookalike domains like @bmo-security.com or @bmo-verify.net to deceive you. Always check the full sender email address, not just the display name, as display names can be spoofed easily.