Three years ago, thieves stole Lionel Hondier's tax return straight out of his mailbox. Within months they'd drained his account at the Royal Bank, leaving just 27 cents behind.

But just as he thought he'd put his life back together, they struck again -- and continued to strike, six more times, getting some $40,000 in the same online banking scam his bank says it can't stop.

"It's terrible, because you can't trust your bank that you'll have money in your account. You don't know for sure," Hondier told CTV News.

"The system is not good. It's not working well," he said.

John Groves, a spokesman for the Royal Bank, said his company had reimbursed Hondier for the money he had lost each time -- and the company sincerely apologized.

But despite new security precautions the bank has taken, Groves said the company couldn't guarantee it wouldn't happen again.

"I don't think there's a financial institution out there that can provide a 100 per cent guarantee that financial fraud will never happen to any client," said Groves.

While the scam has varied slightly over the years, the basic principle is the same: the thieves call the Royal Bank's telephone banking system.

Using the information in the tax return, the thieves bluff the call centre operators into setting up an online bank account. Once the account is set up, they can wire money anywhere.

After the first time, the Royal Bank put a warning on the account. But when they are denied, ID thieves -- who police say are driven by a speed-like high from crystal meth -- will anonymously phone the call centre again and again.

They only need one operator to disregard the warning and set up the account -- and they can make off with thousands.

"People are always the weaker link in the system," said computer security analyst Angela Swan.

Though it won't comment on its own security measures -- or what would happen to operators who mistakenly opened the account -- The Royal Bank has vowed to fight the fraudsters, Groves said.

Hondier told CTV News he doesn't trust online banking any more and has told the bank to not allow any transactions unless he shows up at his local branch with two pieces of ID.

Even with those warnings, operators have unlocked the account as recently as a few months ago, Hondier said.

"I'm not sure if it's going to happen again," he said.