WEXFORD, Ont. — November 9, 2026 — Forty-one thousand points. That was the balance Maren Kowalski had saved across two years of weekly shops at FreshMart — enough, the app said, for nearly three hundred dollars of groceries. On Saturday morning, she opened the app to redeem them for the week’s shop. The balance read zero.

Kowalski had not spent a point. She had not logged in from a new phone, or shared her password, or clicked a link in a text. What she had done, three days earlier, was download what she believed was a new version of the FreshMart Rewards app. A flyer in her mailbox — printed in the store’s colours, carrying the store’s leaf logo — promised double points for the holiday season and a QR code “to get the new app.” The code led to a copy. It looked like FreshMart, it asked for her loyalty number and password, and it thanked her for updating.

The points did not vanish. They were spent — just not by her.

Within hours of her signing in, the copycat app used her account to redeem the balance for gift cards, which were then resold. Kowalski found out only when she reached the till. The cashier scanned her card, the screen showed zero points, and the week’s shop came out of her own pocket. “I did everything they tell you to do,” Kowalski said. “I used the store’s flyer. I scanned the code on the paper they sent to my house. I never typed my password into a strange website. The app even had the store’s name on it.”

FreshMart says it never mailed the flyer, never released a new version of its app, and never asks shoppers to download anything from a QR code. The store’s real app, its manager Devon Pierce said, updates only through the phone’s official app store. The flyer, the code, and the copycat app all came from someone else — someone who had only to print paper and stand beside the real thing.

A loyalty account is a wallet with a friendlier name — and this one had no lock on the door.

Loyalty points are an easy target precisely because shoppers do not treat them like money. The balance grows slowly, in small amounts, and most people check it only at the till. A stolen balance is often discovered days after it is gone, when the gift cards bought with it have already been spent. And a loyalty account asks for almost nothing to open: a name, an email, and a password many people reuse from somewhere else.

“The points felt free, so I treated them like they didn’t matter,” said Ruth Sandoval, a fictional consumer-protection advisor who works with retailers on loyalty fraud. “But forty-one thousand points is three hundred dollars. The thieves know that. They also know most people will notice a missing three hundred dollars from a bank account in a day — and a missing points balance only when they happen to look.”

In this fictional case, the copycat app stayed live for eleven days before it was taken down. FreshMart says it has since restored the points of shoppers who reported the fraud, added a warning to its receipts, and is asking customers to download its app only from the official app store — never from a code on a flyer, a poster, or a text message. The store has not said how many accounts were hit, or how many points were taken.

The fictional shoppers say they have since changed how they treat their loyalty accounts. Balances are checked weekly, like a bank balance. Passwords are unique to each store. And no app is ever installed from a code printed on paper that arrived in the mail.

The defence is not a better app. It is treating points like money — because that is what they are.

That advice applies well beyond one store’s loyalty program. Across Canada, grocery chains, pharmacies, coffee shops, and airlines all run points programs that hold real value behind a simple login — and a copycat needs only a flyer and a QR code to stand beside the real thing. The defence is not a cleverer flyer. It is a habit of getting the app only from the official store, and of treating any code on a piece of paper as untrusted until the store confirms it.

For shoppers, the checklist is short: download loyalty apps only from your phone’s official app store, never from a QR code on a flyer or a link in a text; give each loyalty account its own password; and check your points balance the way you check your bank balance — often enough to notice when it moves. For retailers, it is equally simple: never put a QR code on a flyer that installs an app, publish the real app link everywhere, and take copycat apps down the same day they appear.

The fictional shoppers say the copycat app has been taken down, and the real FreshMart Rewards app is unchanged.

The points were never spent by their owners. The money was never the thieves’. And the difference — one download, from the official store instead of a code on a flyer — was all it took.

Watching the perimeter — and what slips past it.

ODTN News note: ODTN.News is a fictional news platform set within the Operation: Defend the North universe. All names, organizations, quotes, and events in this article are entirely fictitious. Any resemblance to real people, companies, or incidents is purely coincidental. The cybersecurity challenges it represents are very real.

WINNIPEG, Man. — November 5, 2026 — The deals were early, the discounts were deep, and the sale page looked exactly right. When shoppers in a fictional Winnipeg neighbourhood clicked through to a much-loved local home-goods shop’s “early Black Friday access” event, they typed in their card details to claim a door-crasher price — and the order never existed. The shop had not been hacked. Someone else had built a copy of its sale and got there first.

The problem was not in the shop’s own website. It was in the link most shoppers found first: a sponsored post shared in neighbourhood groups and forwarded by email, promising early access to the store’s biggest sale of the year. The page it led to carried the shop’s name, its winter catalogue, and a familiar-looking checkout. It asked for a name, an email address, a delivery address, and a payment card to reserve the deal before it sold out. None of that information ever reached the shop.

The sale had not sold out. It had never been the shop’s sale at all.

According to the fictional shoppers’ association at the centre of the story, the pattern emerged only when several shoppers compared notes the next morning. They had all bought through the same forwarded link, but none of them appeared on the shop’s real order list, and none of them had received a confirmation from the shop’s own address. One shopper had even called the number on the fake page to ask about delivery times, and been reassured by a polite voice that her order was on its way.

“We tell people to shop early and shop local, and that is exactly what they did,” said Maren Kowalski, the fictional association’s coordinator. “Nobody expects to have to inspect a sale page the way you would inspect a front door. But someone built a copy of our shop’s Black Friday event, put it where neighbours share deals, and collected their details as they walked in.”

Fake early-access sales are a quiet, growing target for payment fraud.

Retail and cybersecurity advisors say seasonal sales are attractive precisely because they are urgent, trusted, and shared in a hurry. A Black Friday deal does not need to be breached in the dramatic sense — an attacker only needs to copy a shop’s name and catalogue onto a convincing page, and wait for a forwarded link to do the rest. Shoppers, meanwhile, trust a deal shared by a neighbour far more readily than one from a stranger, especially when the page looks official and the stock is supposedly limited.

“The page did exactly what it was designed to do. It took an order,” said one payments-fraud advisor familiar with copycat sale cases. “The attacker did not need to break into the shop’s systems. They only needed to stand between shoppers and the real sale, and let honest bargain-hunting do the rest.”

In this fictional case, the damage was not a single dramatic theft. Individual shoppers handed over names, email addresses, home addresses, and, in many cases, payment-card details entered to reserve a deal. The association estimates dozens of shoppers bought through the fake page before it was reported, and several later received suspicious calls and messages using details only the fake checkout had collected. For the shoppers, the loss was compounded by the moment of discovery — checking on a delivery that was never coming, for a deal that never existed.

The fictional association says it has since changed how it shares sale links. Real deals now come only from the shop’s own website and the association’s own mailing list, never from a forwarded social post alone, and the association checks shared links weekly, the way it checks its shop notices. Shoppers who used the fake page are being asked to change any password they reused, watch for calls that quote their home address, and check statements for small charges in the days after ordering.

The fix, experts say, is deliberately unglamorous: get the link from the source, not the share.

That advice applies well beyond one sale. Across Canada, shoppers chase early-access deals, flash sales, and clearance events through links passed along in group chats and neighbourhood pages, and most check them only when something goes wrong. The defence is not a cleverer sale platform. It is a habit of checking where the link came from before handing it personal details.

For shoppers, the checklist is short: buy through the shop’s own website or the number printed on its official notice, be suspicious of any sale page that pressures you to check out before stock “runs out,” and check that a confirmation comes from the shop’s own domain. For retailers, it is equally simple: publish one official link, say clearly where it will come from, and give shoppers a simple way to report a copy.

The fictional association says affected shoppers have been offered help reordering for real, and the copycat page has been reported for removal.

The shoppers showed up early for the deal. The sale they bought was never the store’s. And the difference — one link, checked before the details were entered — was all it took.

Watching the perimeter — and what slips past it.

ODTN News note: ODTN.News is a fictional news platform set within the Operation: Defend the North universe. All names, organizations, quotes, and events in this article are entirely fictitious. Any resemblance to real people, companies, or incidents is purely coincidental. The cybersecurity challenges it represents are very real.

BRANDON, Man. — November 2, 2026 — The gift was chosen with care, the card was loaded at the till, and the envelope was handed over with a birthday message inside. When the recipient tried to spend it, the balance was zero — not spent, not partially used, simply never there. At Prairie Paper & Gift, the fictional Brandon gift shop at the centre of the story, that scene has now repeated more than a dozen times in two weeks, and the shop says the cards were not faulty. They had been tampered with before they were ever bought.

The problem was not visible at a glance. On the open gift-card rack near the front of the shop, some cards carried a second barcode sticker, placed neatly over the original. At the till, the scanner read the sticker, not the card in the customer’s hand — so the money loaded onto the purchase went to a different card entirely, one held by someone who was never in the shop at all. The card the customer took home was never activated, and the money was gone before the gift was even opened.

The card had not been spent. It had never been loaded.

According to the fictional shop’s account, the pattern emerged only when recipients began calling back, one after another, with the same story: a card that showed a zero balance the first time it was used. Staff checked the till receipts, compared them with the cards customers had bought, and found the mismatch — the barcode on the receipt did not match the barcode on the card in the envelope. Someone had been quietly swapping the numbers in between.

“We sell gift cards because people want to give something simple and kind,” said Ingrid Halvorsen, Prairie Paper & Gift’s fictional owner. “Nobody expects to have to inspect a gift card like it’s evidence. But someone treated our rack like an open till, and our customers paid for it twice — once at our counter, and again in embarrassment when the gift didn’t work.”

Tampered gift cards are a quiet, growing target for retail fraud.

Cybersecurity and retail-fraud advisors say gift-card racks are attractive precisely because they are open, unguarded, and trusted. The cards themselves hold no value until they are activated, so a tampered card looks exactly like an untouched one. An attacker only needs a few minutes alone with a rack, a printed sticker, and a card of their own — then they wait for a stranger to load the value for them.

“The rack did exactly what it was designed to do. It displayed the cards,” said one retail-fraud advisor familiar with gift-card cases. “The attacker did not need to break into a till or a system. They only needed to change which card the scanner saw, and let an honest purchase do the rest.”

In this fictional case, the damage was not a single dramatic theft. Individual cards were loaded for twenty-five to one hundred dollars, and the shop estimates several hundred dollars was diverted in total before the tampering was spotted. For the shoppers, the loss was compounded by the moment of discovery — a birthday, a thank-you, a holiday gift that arrived empty, with no way for the recipient to know why.

Prairie Paper & Gift says it has since changed how it sells gift cards. Cards are now kept behind the counter rather than on an open rack, staff check the barcode on each card against the till receipt before handing it over, and any card with a loose, peeling, or mismatched sticker is pulled from sale. The shop is also asking customers to keep their activation receipt until the card has been used, so a diverted load can be traced and refunded.

The fix, experts say, is deliberately unglamorous: check the card before you check out.

That advice applies well beyond one shop. Across Canada, gift cards hang on open racks in grocery stores, pharmacies, and gift shops, and most shoppers grab one without a second look. The defence is not a cleverer card. It is a habit of inspection at the moment of purchase.

For shoppers, the checklist is short: feel for a second sticker or a barcode that looks pasted over the original, ask for a card from behind the counter when one is available, keep the activation receipt, and check the balance before giving the card away. For retailers, it is equally simple: keep high-value cards behind the counter, train till staff to compare the scanned barcode with the card in hand, inspect racks daily for tampering, and make it easy for a customer with an empty card to get help rather than embarrassment.

Prairie Paper & Gift says affected customers are being refunded where a receipt confirms the purchase, and the shop is reviewing its rack displays ahead of the holiday season.

The gift was bought in good faith. The card in the envelope was never the card that was loaded. And the difference — one sticker, checked before the sale was finished — was all it took.

Watching the perimeter — and what slips past it.

ODTN News note: ODTN.News is a fictional news platform set within the Operation: Defend the North universe. All names, organizations, quotes, and events in this article are entirely fictitious. Any resemblance to real people, companies, or incidents is purely coincidental. The cybersecurity challenges it represents are very real.