Walmart ships fraudulent order to hacker's address then leaves customer to recoup cost

The alarm bells went off for Bill Tomlinson after he got an odd text message — in French — on Feb. 2 from Walmart Canada. The Pelham, Ont., man doesn't speak French and hadn't ordered anything. 

"I thought, what the heck is that? ... oh, something's gone wrong," Tomlinson told Go Public.

He logged into his Walmart.ca account and discovered fraudsters were using it and his credit card on file to place orders and ship them to Montreal.

There were four orders, all on that same day. Two were for dumbbells at $500 apiece, the other two for Apple TVs worth about $250 each.

Walmart had cancelled the first three orders on its own, but Tomlinson noticed the last one for an Apple TV had just been shipped. He called Walmart right away to let the company know, expecting the retail giant would refund the order.

Instead, two days later, Tomlinson says Walmart told him the product had been delivered to Montreal and that he was on his own to try to get the money back.

"They basically washed their hands of it," Tomlinson said. 

"They said, there's nothing more we can do for you. This product was ordered on the account, it was paid for by your credit card, it was delivered by us. We did everything that we were supposed to do."

He says Walmart told him he would have to "deal with his bank" to see if it would reverse the charge.

Independent financial fraud expert Vanessa Iafolla says she gets several calls a week from people looking for advice on how to recoup their losses after being defrauded online.

"Any company that is going to offer online retail services and make it available for clients or customers to set up accounts is responsible for protecting the security of that account," Iafolla said.

"I think Walmart really is dropping the ball on this."

When Tomlinson first called Walmart, he was told the company's fraud detection system had caught the first three orders but not the fourth, and that it needed to look into things before taking action.

Tomlinson does not understand the delay, since all the fraudulent orders were placed on the same day for the same products, and the company already knew the first three were a problem.