An Ottawa man is among critics urging stronger oversight of Canada’s international visa hubs — run by a federal contractor paid hundreds of millions in taxpayer dollars — after what he describes as “unjustifiable” and “shady” experiences at a visa centre in Bangladesh.

Salah Uddin’s frustration comes as internal documents obtained by CBC News reveal issues were already on Immigration, Refugees and Citizenship Canada’s (IRCC) radar in countries like Bangladesh — including allegations of third-party fraud and security red flags.

“It’s unbelievable,” said Uddin of his experience accessing VFS Global’s services in Dhaka multiple times over the past few years to get visas for his parents and in-laws.

VFS Global runs a network of 164 visa application centres (VAC) in 109 countries on behalf of the Canadian government. It doesn’t make decisions on immigration cases, but for more than 20 years, it has been providing administrative services like collecting biometrics and sending and returning application documents and passports for IRCC.

Uddin said in 2023 he felt he had to pay for VFS’s “premium lounge access” in order to submit his parents’ passports on time, after a friend tried for multiple days to stand in a “very big line” for hours on his behalf.

Uddin paid about $130 Canadian for that premium service, and his friend was “served within five minutes with a cola.”

We could write a novel about all the fraud we are seeing.– Email from Canadian official, ATIP documents

Then in 2024, while trying to obtain a visa for his in-laws, Uddin said there were no appointments available for the foreseeable future and that a third-party reseller asked him for the equivalent of about $250 Canadian, per person, for an appointment to submit their passports. They faced a tight 30-day deadline.

Uddin declined the reseller and opted to mail the passports to a friend in Malaysia who submitted them there for his family.

“It’s a fraud. It’s not justifiable,” Uddin said of the third-party activities.

When asked about these issues, a VFS spokesperson provided a general statement saying “fraudulent activity by criminal actors” isn’t unique to visa services and that the company conducts awareness campaigns to protect applicants.

IRCC wrote that “all credible fraud tips are rigorously” investigated. For example, it identified third-parties “exploiting” the booking system and implemented measures to “disrupt this activity.”

CBC made an access to information request to IRCC in 2024 about government site visits to Bangladesh and Russia visa application centres, after hearing concerns from applicants.

The records took about two years to receive and contain emails and redacted reports between Canadian immigration and embassy staff and VFS employees. The documents note “deficiencies” and other issues, including overcharging applicants with “premium” fees, security screening concerns, technical outages, and a malware attack.

“We could write a novel about all the fraud we are seeing,” reads an email from a government official who was planning to visit Bangladesh in February 2024, alluding to third-party misconducts. They asked for more information on the “scale of fraud, most common types/trends of fraud, [and] the role [of] ‘consultants’ in the fraud we are seeing.”

Those emails indicate Canadian officials were concerned about the type of appointment reselling in Dhaka that Uddin experienced — enough that they tried creating accounts and simulating booking as an applicant and ran into issues as well.

Resellers were somehow block-booking appointments and selling them at high costs to desperate applicants trying to meet IRCC’s deadlines, according to the records.

“The fact that [redacted] of the clients need to go to third parties to be able to provide their passports to your office is also an issue. It means that [redacted] of the client do not have access to the service as they are supposed to,” a government official wrote to VFS in January 2024.

How can that be ethical?– Salah Uddin, Ottawa resident

Canadian staff flagged that it was hard for clients to follow IRCC’s strict processing timelines “unless they use the premium services, which is more expensive,” calling that “a concern.”

“How can that be ethical?” asked Uddin, who pointed out that applicants already pay a standard processing fee to IRCC. “VFS should get the money they’re due from IRCC, not from the people.”

“They just made people hostages. You have to come through this back channel, pay some extra money,” Uddin added about the resellers.

$770M in contracts

Masud Rana also felt he had to pay more than $300 for his family of four for VFS premium services in Bangladesh — but said it was “nothing very special” other than the ability to submit their biometrics on time.

“I don’t think it’s just,” said Rana, who arrived in Canada in 2023 to study business analytics at Carleton University.

In a statement, VFS told CBC it does offer “optional value‑added services” for applicants’ convenience, but only does so with “prior approval from the Canadian government.”

IRCC said in a statement it doesn’t track VFS’s extra revenue from those services and that they’re “not mandatory” for applicants to use.

The IRCC documents also list a number of concerns at the Dhaka office — including disposing of records, use of personal email and social media, and security screening of staff — but the details are redacted.

“The only person security screened is the one agent,” reads one 2023 email from an IRCC staff member who warned “staff listening to calls or monitoring emails” need screening.

According to CBC’s review of federal tender history, the government has awarded more than $725 million in contracts from 2012 to March 2026 to VF Worldwide Holdings Ltd. (VFS Global) to run 128 visa centres.

A second firm bought out by VFS in 2017, TT Visa Services, has also been awarded $45.9 million since 2018 to run 36 visa centres. CBC was unable to verify the contract totals prior to 2012, the year Canada hired VFS again to operate “standardized” visa centres throughout the world.

VFS says its clients include Canada’s intelligence partner countries such as Australia, New Zealand, the U.K. and U.S., plus the vast majority of NATO countries.

Other issues in Russia, Mexico

The records obtained by CBC also reveal that internet outages paralyzed visa centres in Russia in April 2024, amidst the ongoing Russia-Ukraine War.

“We need a workaround for people who cannot wait for their biometrics to make their way into the system,” wrote one Canadian official that month, suggesting some urgent cases like “those joining ships and with family emergencies” be serviced at the Canadian embassy to bypass VFS’s stalled infrastructure.

“We have received an updated [report] regarding the malware attack,” reads a later email from an IRCC manager. “We are continuing to discuss the contractor’s proposed solutions.”

Karina Juma, an immigration and refugee lawyer in Burnaby, B.C., said one of her clients recently ran into an issue with VFS Global’s visa centre in Mexico when agents offered contradictory advice from Juma’s.

“These issues are still very prevalent today,” Juma said.

Juma and her team have attempted to learn more about VFS operations by filing access to information requests, but she says getting a clear picture remains a challenge except for what lawyers hear anecdotally or through social forums.

And while problems may have slowed in some regions, she says there’s still a “slew” of issues related to data security and third-party fraud and “great ethical concerns” about extra fees applicants feel pressured to pay to VFS.

“There are probably thousands more stories,” Juma said. “Because we know that it’s not just one centre. It’s multiple centres in multiple countries.”

She urges IRCC to conduct more rigorous audits and believes its oversight of VFS “doesn’t go far enough.”

VFS has met expectations: IRCC

VFS Global declined an interview but provided a statement on behalf of VFS and TT Services.

VFS said all of its visa centres undergo regular security audits and staff undergo “deep” background checks. VFS added it continues to “enhance vigilance measures” for IRCC including frequent audits and strengthened data security oversight.

“We strive to meet the performance standards embedded in our contracts,” a spokesperson wrote.

When asked if VFS faced consequences for documented issues, IRCC didn’t directly answer but said contractors are “subject to corrective measures” — either financial or administrative — when standards aren’t met.

The department said VFS has met its contractual expectations.

IRCC wrote it’s “aware of all reported incidents at VACs” and it acts “decisively” when wrongdoing is identified.

“IRCC maintains robust oversight and monitoring of its VAC partners” and it “continues to strengthen its systems and oversight to detect, prevent, and respond to fraud,” it added.

The current contracts for both VFS and TT Visa Services are set to expire in October 2027, with an option to extend by a year. A procurement process is underway.