Internal Immigration, Refugees, and Citizenship Canada (IRCC) documents have exposed widespread third-party fraud, technical vulnerabilities, and security red flags across international visa application centres run by federal contractor VFS Global. Despite receiving over $770 million in federal contracts, VFS operations in countries like Bangladesh have been heavily exploited by unauthorized third-party resellers who block-book appointments and sell them to desperate applicants for hundreds of dollars. Furthermore, internal records detail security deficiencies regarding un-screened staff, technical outages, and a malware attack at a visa hub in Russia. While critics and immigration lawyers urge the government to implement more rigorous audits over "ethical concerns" regarding forced premium fees, IRCC maintains that VFS has met its overall contractual expectations and asserts that corrective measures are applied when necessary.