Original reporting by the Toronto Star, published August 17, 2026.
Mark Sach-Anderson, who owns Wrenchspinner Auto Service and Sales in Etobicoke, discovered something most cardholders would find hard to believe. He entered the wrong PIN on his TD Business Travel Visa three times in a row, and the purchase went through anyway.
He tested it again. A 3,200 dollar tool purchase. Then a one dollar transaction at his own shop, recorded on video. Same result. After three failed PIN attempts, the terminal stopped asking for the PIN and approved the transaction on a signature instead.
TD’s response was that chip and signature is an accepted industry practice in Canada and may be used as an alternative authentication method when chip and PIN is unsuccessful. Visa Canada said card security settings are established by the issuing bank, not the network.
Whatever you make of those answers, the story illustrates something every business owner should take seriously. There is a difference between a security control you assume is working and one you have actually verified.
The Gap Between Assumed and Verified
Sach-Anderson had reported fraudulent charges on the card back in late March. Like most people, he assumed the PIN was the thing standing between a stolen card and a completed purchase. Three wrong entries should mean a declined transaction and a locked card. That assumption was reasonable. It was also wrong.
The uncomfortable part is not the specific fallback rule. It is that nobody would ever have known unless a business owner happened to fat finger his PIN, get suspicious, and then deliberately test it on camera.
Now apply that same question to your own operation. Which of your protections have you actually tested, and which do you simply believe in?
The Assumptions Businesses Make About Document Disposal
In our line of work we see the same pattern constantly. Organizations believe their confidential information is protected, and the belief rests on something that does not hold up when examined.
Some common ones worth checking.
The recycling bin is fine because it goes to a recycling plant. It goes there eventually. Between your back door and that plant, it sits at a curb, in a truck and at a transfer station, readable by anyone who reaches in.
The office shredder handles it. Small strip cut office shredders produce long ribbons that can be reassembled, and they jam often enough that staff quietly start putting things in the bin instead.
We deleted the files. Deleting a file removes the pointer, not the data. The same is true of reformatting a drive.
The old records are locked in the back. Ask how many keys exist and who has held one over the past ten years. Most organizations cannot answer.
We only keep what we need. Almost nobody does. A walk through the storage room usually turns up files a decade past any requirement to keep them.
Each of these is an assumption that feels like a control. None of them survives being tested, which is exactly the situation the PIN story describes.
Financial Documents Are a Fraud Vector
There is a second thread in this story worth pulling. The trouble began with fraudulent charges on a business card, and card fraud frequently begins with paper.
Credit card statements, merchant receipts, void cheques, banking correspondence, loan documents, payroll records and tax filings all contain the raw material for financial fraud. They contain account numbers, business addresses, signatures and transaction histories. They are also exactly the kind of paper businesses generate constantly and dispose of casually.
A discarded statement in an unsecured bin is a starting point for someone building a fraudulent profile. Cross referenced with information from other sources, it can be enough to open accounts, redirect statements or authorize charges.
Shredding financial paperwork the moment it passes its retention period removes that starting point.
Testing Your Own Controls
Walk the disposal path. Follow a confidential document from an employee’s desk to wherever it ends up. Note every point where an outsider could reach it.
Ask what happens when the process is inconvenient. The office shredder jams on a Friday afternoon and someone has a stack of files to clear. What do they actually do? Systems fail at their friction points.
Check your storage. Physically open the boxes in the back room. Most owners are surprised by what is still there.
Confirm your vendor’s process. Ask how material is transported, when it is destroyed and what documentation you receive. A provider that gives certificates of destruction is one you can verify rather than one you have to trust.
Include digital media. Retired drives, backup tapes and photocopiers should be destroyed, not wiped and resold.
Write it down. A retention and destruction policy that lives in one person’s head is not a policy.
Verified Destruction, Responsibly Handled
At Norfolk Shredding, we build our service around verification rather than assurance. Confidential material goes into locked collection consoles, stays in a documented chain of custody, and is destroyed with a certificate confirming what was destroyed and when.
All the documents, once shredded, are then sent for hydro pulping, whereby the ink is removed and the fibers are prepared for recycling into new paper products. Thus, the information on your documents is actually destroyed twice. The information is permanently gone while the material itself becomes new paper products. Protecting your business and protecting the environment are part of the same job.
The Bottom Line
A business owner in Etobicoke found out his PIN was not doing what he thought it was doing, and he only found out because he checked.
Most confidential information is not lost to sophisticated attacks. It is lost through a process everyone assumed was working. The organizations that avoid that outcome are the ones willing to look closely at their own habits and replace the assumptions with something they can actually verify.
Protect Your Business With Norfolk Shredding
Norfolk Shredding provides secure, certified document destruction for businesses, medical practices, law firms, financial offices and residential clients across Ontario. We offer scheduled shredding, one time purges, hard drive and electronic media destruction, locked collection consoles, and a certificate of destruction with every service, with all shredded paper recycled.
Call us today at 1-855-561-1716 for a free consultation and find out exactly how your confidential material is handled from pickup to destruction.
Reference
“This Etobicoke business owner typed the wrong PIN three times. Video shows TD Visa still OK’d the purchase.” Toronto Star, August 17, 2026. Read the original article
