Bank Fraud and Scams in Canada: Protect Yourself, Report It, Recover

This page sets out what the Canadian Anti-Fraud Centre, FCAC, Interac, the credit bureaus and the institutions themselves say about bank scams, what protects an account, and what to do when something has gone wrong. The CAFC says not to share codes received by text message or email with anyone, because in most cases they are multi-factor authentication codes that will give fraudsters access to your account. How scams work and what protects an account come first; if a card is already missing, money has gone or your identity was used, the sections on a lost or stolen card, reporting fraud, after a loss and identity theft cover it. What institutions say about locking a card, reporting it lost and reaching their fraud lines is listed by institution.

How do bank scams work?

Calls, texts and emails that pretend to be your bank

• The CAFC says fraudsters impersonate financial institutions, law enforcement, Amazon and credit reporting agencies, claiming your bank account has been compromised.
• The CAFC says suspects who have your debit card number and password may contact you claiming to be your financial institution and say you must give them the code you get by text message or email to confirm your identity, and that this is the multi-factor authentication code, which gives them full access to your bank account.
• The CAFC says criminals use call-spoofing to mislead victims, so you should not assume that phone numbers on your call display are accurate.
• The CAFC says that if you get a call claiming to be from your financial institution, you should advise the caller you will call them back, end the call, and dial the number on the back of your bank debit card from a different phone if possible or wait 10 minutes before making the outgoing call.
• The CAFC says institutions or online merchants will never request transferring funds to an external account for security reasons, and institutions or police will never request you to turn over your bank card or attend your residence to pick up your bank card.
• The CRA says it will not demand or pressure immediate payment by Interac e-transfer, cryptocurrencies, prepaid credit cards or gift cards from any type of retailer, and will not threaten to deport or arrest you or put you in prison.

Card skimming and stolen card details

FCAC says a person might steal your debit card information by installing a device on a payment terminal that records your card information, looking over your shoulder at the PIN you enter at an ATM or payment terminal, sending fraudulent emails or text messages asking for your debit card information, pretending to be a bank employee and asking for your debit card information over the phone, using a device that jams your card in an ATM, or accessing your lost or stolen mobile device. Interac says that when you use Interac Debit in-app through Apple Pay or Google Pay your card number is not stored or shared with merchants.

e-Transfer fraud

Interac says that with Autodeposit set up you can avoid the risk of having your funds intercepted by fraudsters, because the funds are deposited directly into your bank account with no additional steps needed and no security question or answer is required; how to set it up is on Autodeposit. Interac says that whether or not you enable Autodeposit, if you receive an Interac e-Transfer or money request you were not expecting, you should always contact the sender through a different channel to check if it is real. Fake e-Transfer notices are covered on e-Transfer scams, and what can happen once a transfer has been sent is in after a loss.

SIM swaps and account takeover

The Canadian Centre for Cyber Security says SIM swapping is an attack against your mobile phone account that transfers your phone number to a threat actor's SIM card or eSIM without your knowledge or permission. The CAFC says fraudsters use SIM swapping and phone number porting to gain access to your email, social media and financial accounts. What the Cyber Centre recommends in place of codes sent to a phone number is under online banking.

Identity theft scams

What to do if someone has used your personal information is in identity theft; Service Canada’s statement on keeping your SIN safe is under personal information.

Payments you were tricked into making

FCAC says that generally any banking or credit card transaction you did not make or approve is an unauthorized transaction, and that each financial institution may define unauthorized transactions differently, so you should read your credit card, debit card and account agreements carefully. The Code defines an authorized debit card transaction, and excludes trickery, in who pays. What can be done after money is lost is in after a loss. Fake cheques and overpayment scams are on fake cheques and overpayment scams, and investment scams on investment scams.

How can you protect your accounts?

Online banking

The Canadian Centre for Cyber Security recommends a minimum of 12 characters for passwords, and passphrases of at least 4 words and 15 characters. FCAC says that whenever possible you should enable multi-factor authentication (MFA), which needs more than one authentication factor to access a device or an account, so that if cyber criminals gain access to your password they still need to provide additional information to access your accounts. The Canadian Centre for Cyber Security recommends using authenticator applications that generate one-time passcodes for multi-factor authentication rather than verification measures connected to the phone number (for example, text message and phone call).

FCAC’s statements on banking apps are on mobile banking apps, and what FCAC says about screen scraping is on screen scraping.

Cards, PINs and ATM skimmers

FCAC says to protect your PIN: don't keep it close to your debit card, don't write it on the card, never give it to anyone (not even a family member), cover the PIN pad, and tell your financial institution immediately if you think somebody has it. FCAC says to check your account statements often to make sure all transactions are correct and legitimate, to contact your financial institution right away if your card is lost, stolen or stuck in a machine, and not to use public Wi-Fi or public computers to do your online banking or shopping. Changing a card’s daily limit is covered on ATM and debit limits.

Personal information

Service Canada says to avoid carrying your SIN around with you, to keep documents containing your SIN in a locked cabinet or safe or on password-protected devices, not to keep your confirmation of SIN letter or SIN card in your wallet or bag, and to shred documents containing your SIN and personal information before disposal. What to do if your identity has been used is under identity theft.

What if your debit card is lost or stolen?

FCAC says to report a lost or stolen card as soon as possible and to check your cardholder agreement for how long you have to report it. FCAC says that if your card is lost or stolen and purchases are charged to it afterwards, you won't be held responsible if: your card has expired or had previously been cancelled; you report that someone else, beyond your control, may know your PIN; you've taken reasonable steps to protect your PIN.

FCAC says a daily limit applies to ATMs, online and in-store transactions and also to debit cards that have a contactless feature, that someone who has your debit card may access that amount, and that you can contact your financial institution to change the limit or ask it to disable the contactless feature on your debit card. FCAC says that if you pay online using a debit card with a payment card network logo (such as Interac, Visa or Mastercard), the network's zero liability protections apply, and that you should check the terms and conditions and contact the card issuer for more details.

Who pays when a card is used without your permission is in the next section. Pre-authorized debits set up on the account have their own page.

Locking, reporting and replacing a card, by institution

The entries below are taken from the institutions’ own pages and documents, on locking a card, reporting it lost or stolen, a replacement, and a fraud line. Where an institution states nothing for one of these, that line is left out, and a card the institution calls prepaid is marked beside its name.

Where an institution's page states nothing for one of these, that line is left out.

Checked against each institution's pages on October 23, 2026.

Institutions in this list: Bank of Montreal, CIBC, Desjardins, EQ Bank, KOHO, National Bank, RBC Royal Bank, Scotiabank, Simplii Financial, Tangerine and TD Canada Trust.

General help lines by bank are on the support page. Locking a card as an app feature, with each app’s scope, is on what each app can do.

Who pays when your debit card is used without your permission?

The Canadian Code of Practice for Consumer Debit Card Services is a voluntary code; these are its conditions as FCAC publishes the Code, with the Code’s own words behind each one.

What the Code is and what it covers:

• The Code describes itself as a voluntary code of practice, developed through consultation with the Electronic Funds Transfer Working Group, which is made up of representatives from consumer organizations, financial institutions, retailers, and federal and provincial governments.
• The Code's title page says it was prepared by the Electronic Funds Transfer Working Group in May 1992 and revised in 1996, 2002 and 2004.
• The Code says organizations endorsing it will maintain or exceed the level of consumer protection it establishes, and that it does not preclude the protection given by existing laws and standards.
• The Code lists the Canadian Bankers Association, the Canadian Federation of Independent Business, Credit Union Central of Canada, the Consumers' Association of Canada, La Fédération des caisses Desjardins du Québec and the Retail Council of Canada as endorsing it, and the Canadian Payments Association (the name the Code uses) as supporting it.
• FCAC publishes the Code on its website, in its list of codes of conduct and public commitments overseen by FCAC.
• The Code applies only to services that use debit cards and personal identification numbers (PINs) to access point-of-service terminals, such as automated banking machines, point-of-sale terminals and debit card terminals in the home, and it does not cover transactions that take place outside Canada or that transfer funds into or out of Canada.

When the Code says the cardholder is not liable:

• Cardholders are not liable for losses resulting from circumstances beyond their control, which include (but are not limited to) technical problems, card issuer errors and other system malfunctions, and unauthorized use of a card and PIN where the issuer is responsible for preventing such use, for example after the card has been reported lost or stolen, is cancelled or expired, or the cardholder has reported that the PIN may be known to someone other than the cardholder.
• Cardholders are also not liable for unauthorized use to which they have unintentionally contributed, provided they co-operate in any subsequent investigation.
• The Code's guide says a cardholder is not liable for transactions where the cardholder has been the victim of fraud or theft, or has been coerced by trickery, force or intimidation, provided the cardholder reports the incident promptly and co-operates fully in any subsequent investigation.
• The Code's guide says a cardholder is not considered to have disclosed the PIN voluntarily if it is obtained by coercion, trickery, force or intimidation (which includes a PIN observed at point-of-sale terminals), and that using the same PIN for more than one card is not a contribution to unauthorized use.

When the Code says the cardholder is responsible, and what it counts as contributing:

• Cardholders are responsible for all authorized use of valid cards.
• The Code's guide says an authorized transaction is one in which the card and PIN are used to carry out the transaction and in which the cardholder has not been the victim of trickery, force, intimidation or theft.
• Cardholders are also responsible if they make entry errors at point-of-service terminals, or if they make fraudulent or worthless deposits.
• In all other cases, when a cardholder contributes to unauthorized use, the cardholder will be liable for the resulting loss; the loss will not exceed the established debit card transaction withdrawal limits, but in some circumstances it may exceed the actual funds in an account.
• The Code gives as examples of a loss above the funds in the account an account with a line of credit or overdraft protection or linked with another account or other accounts, and a debit card transaction made on the basis of a fraudulent deposit at an ABM.
• A cardholder contributes to unauthorized use by voluntarily disclosing the PIN, including writing the PIN on the card or keeping a poorly disguised written record of the PIN in proximity with the card, or by failing to notify the issuer, within a reasonable time, that the card has been lost, stolen or misused, or that the PIN may have become known to someone other than the cardholder.
• The Code's guide says that for the cardholder to be liable, a voluntary disclosure of the PIN must contribute to the loss.
• The Code's guide says the card issuer should be notified of lost, stolen or misused cards and/or disclosure of the PIN as soon as the cardholder becomes aware of the loss or disclosure.
• The Code's guide says cardholders are considered to have disclosed the PIN voluntarily if they use a PIN combination selected from the cardholder's name, telephone number, date of birth, address, or social insurance number.
• The Code's guide says a PIN is poorly disguised when it is written on the card, or when a record of it is kept without a reasonable attempt to hide or disguise the code and could be lost or stolen simultaneously with the card, for example in the same wallet, purse, briefcase or suitcase, or in the same location so the card and PIN record can be easily associated.

After the cardholder reports it:

• When a cardholder contacts the PIN issuer about an unauthorized transaction, the issuer will say that it will investigate, that any reimbursement will stem from the investigation, and that it will respond as soon as possible and no later than 10 business days; it may require a signed written statement or affidavit, which may temporarily suspend the 10-day limit until it is received.
• If an investigation finds that not all the funds will be reimbursed, the PIN issuer is responsible for showing that, on the balance of probabilities, the cardholder contributed to the unauthorized use of the card, subject to section 5 of the Code.

FCAC’s own pages state the protections separately, for federally regulated institutions, and they are listed here apart from the Code’s.

• FCAC's page on unauthorized credit and debit transactions says its stated rights apply when you are dealing with a federally regulated financial entity like a bank, federal credit union or payment card network operator.
• FCAC says you are not responsible for losses due to situations beyond your control, for example technical problems or someone using your card after you reported it lost or stolen, and that the most you are responsible for usually can't be more than your debit card's withdrawal limits, though you may be responsible for more than your account balance if the account links to a line of credit, overdraft protection or one or more other accounts.
• FCAC says federally regulated financial institutions can't hold you responsible for a transaction you didn't authorize just because someone used an authentication technology to do it, which means a PIN or any other password or information you create to verify your identity.
• FCAC says a federally regulated financial institution must always fully investigate a transaction you dispute, however it was processed, and should consider all circumstances that contributed to the unauthorized use, including circumstances beyond your control such as someone forcing you, someone stealing your card, a system malfunction, or someone obtaining your card number, PIN or password through shoulder surfing.
• FCAC says you are protected against unauthorized transactions when you use debit card services in store, at a point-of-sale terminal, at an ATM or online.
• FCAC says you could be responsible for losses where you contribute to or encourage unauthorized use of your card, and could be liable if you use your date of birth or telephone number as your PIN, share your PIN with someone (even a family member), keep a written record of the PIN close to the card or write it on the back of the card, don't report a lost or stolen card in the time specified in your card agreement, refuse to cooperate in an investigation, make fraudulent deposits with your card, or don't take the necessary steps to protect your PIN.
• FCAC says that in some cases you may need to report an unauthorized transaction within a specific amount of time set by your account agreement, and if you don't you may be held responsible for the transaction and may not get the amount back.

FCAC says Visa, Mastercard, American Express and Interac have committed to protect you against financial loss if someone uses your credit or debit card without your permission, and that if you took reasonable care of your account information and PIN they'll usually reimburse you in full. Credit cards have their own limits on what a cardholder pays; disputing a charge is covered on disputing a credit card charge.

Where do you report fraud?

The CAFC says to report the incident to the financial institution that transferred the money, and, if you are a victim of identity fraud, to place flags on all of your accounts, change all of your passwords and report the fraud to both credit bureaus (Equifax and TransUnion). Fraud lines, where an institution publishes one, are listed by institution.

The CAFC says that if you have been a victim of fraud or cybercrime you should contact your local police as soon as possible, that investigating is the role of local police, and that the CAFC assists law enforcement by keeping a central repository of information to assist with investigations.

The CAFC’s toll-free number is 1-888-495-8501. The CAFC says it answers calls Monday to Friday, from 10 am to 4:45 pm (Eastern time), and is closed on holidays. The CAFC says that, whether you are a victim or a witness, you can report a fraud or cybercrime online at reportcyberandfraud.canada.ca, and you can report anonymously. The CAFC says anyone who suspects they have been the victim of cybercrime or fraud should report it to their local police and to the CAFC, and that someone who is not a victim should report it to the CAFC anyway.

What can you do after losing money to a scam?

By the way the money was paid:

• Interac e-Transfer: Interac says a transfer is cancelled from the transaction or payment history in online banking, that the process varies by financial institution, and that the institution may also charge a cancellation fee. Interac says that once a deposit has been made there is no way to reverse the transaction, and the sender has to make arrangements directly with the recipient.
• Debit card: FCAC says a federally regulated financial institution must always fully investigate a transaction you dispute, however it was processed (with your PIN, by magnetic swipe or through other technology); the Code’s conditions are under who pays.
• Credit card: disputing a charge is on disputing a credit card charge.
• Wire transfer: wire fraud.
• Pre-authorized debit: getting money back.
• Cryptocurrency: The CAFC says to be careful when sending cryptocurrency because once the transaction is completed it is very unlikely to be reversed.

The CAFC says fraudsters often target victims of fraud a second or third time with the promise of recovering money, and to never send recovery money. How to complain about the way an institution handled it is on complaining to your bank.

For community and social services in general: 211 says it is Canada's primary source of information for government and community-based, non-clinical health and social services, and that in most of Canada the free and confidential service can be accessed 24 hours a day, in more than 150 languages, by phone, chat, text and web.

What if your identity is stolen?

The CRA says that if your personal or financial information has been compromised or you suspect unauthorized activity on your CRA account, you should contact your financial institution, credit reporting agencies such as Equifax or TransUnion and your local police, and that after reporting to the CRA you should also notify the Canadian Anti-Fraud Centre. On this page:

• telling your financial institution, the police and the CAFC: reporting fraud;
• fraud alerts and credit freezes: fraud alerts;
• the CRA and your SIN: the CRA and your SIN;
• identity documents and your credit report: documents and credit report.

Fraud alerts and credit freezes

Each bureau’s statements are below, and how the two compare is on Equifax and TransUnion. Equifax says a Fraud Alert is only available to confirmed victims of fraud or identity theft, is free, and stays on the Equifax credit report for six years. Equifax says the special statement a Fraud Alert adds to your credit report includes a phone number to encourage (but not legally require) lenders to call you before extending credit. The number Service Canada lists for Equifax is 1-800-465-7166. Equifax says an alert placed with it applies only to its credit report, and that you need to contact TransUnion directly to place an alert on your TransUnion credit report.

TransUnion says a fraud alert statement is retained on your credit file for six years from the date it was added or until you request its deletion in writing. TransUnion says that, subject to applicable law, credit grantors have the discretion to decide what steps they will take (if any) when they see the fraud alert on your credit file. TransUnion’s fraud victims page gives 1-800-663-9980 for placing a Potential Fraud Alert over the telephone.

TransUnion says a credit freeze (also called a security freeze or a credit lock) prevents access to your credit information for specific credit-related purposes set out in legislation, is free to place, suspend or remove, and is available to consumers in Ontario and Quebec. Equifax says its credit lock, a tool for locking your Equifax credit report, became available to Quebec residents on February 1, 2023 and to Ontario residents on July 1, 2026, and that to lock your Equifax credit report you must be a resident of Quebec or Ontario.

The CRA and your SIN

The CRA’s number for confirming suspicious activity on a personal account and asking for protections is 1-833-995-2336. The CRA lists its personal accounts line for reporting a scam or identity theft as open Monday to Friday, 8:00 am to 4:00 pm local time, and closed on Saturday, Sunday and public holidays. The CRA says that by phone you can confirm suspicious activity and request protections on your account if needed, and that protections can be placed on your account immediately during your call. The CRA says that if you submit its online form an agent will review it and place protections on your account shortly after it is received, and a designated CRA officer will contact you within 14 business days.

Service Canada says you do not have to report SIN fraud to the SIN Program. The CRA’s page says to report someone else using your SIN to Service Canada at 1-866-274-6627. Service Canada says the SIN Program may issue a new SIN if you have proof that your SIN was used fraudulently but this is not recommended, and that it cannot issue a new SIN without proof that your SIN was used to commit fraud.

Identity documents and your credit report

The CAFC says that for lost or stolen provincial or territorial identity documents (including a birth certificate, driver's license, health card and other documents issued by a province or territory) you should contact the province or territory that issued the document if it has been lost or stolen or you believe someone is fraudulently using the information.

FCAC says you have the right to dispute any information on your credit report that you believe is wrong, and that credit bureaus must correct errors for free; how to dispute an error is on disputing a credit report error. FCAC says Canada's credit bureaus and many credit card issuers and financial institutions offer credit monitoring services, that you usually need to pay for them, and that some institutions may offer it for free in certain circumstances, for example if you have been affected by a data breach.

Why would a bank freeze your account?

The three sections below give one bank’s account agreement on restricting access to an account, the Act that requires suspicious-transaction reports, and the CRA’s garnishment pages; other holds are linked to their own pages. Fraud lines, where an institution publishes one, are listed by institution.

Suspected fraud on the account

One bank's client agreement for personal deposit accounts says nothing in that agreement, the disclosures or any other agreement between the client and the bank prevents the bank from restricting access to an account, refusing to release funds in it if required to or if, in the bank's opinion, there is unusual, improper or suspicious activity in it, or closing an account for any reason, in its complete discretion. A card refused at a till or machine is covered on why a debit card is declined.

Suspicious-transaction reports to FINTRAC

The Proceeds of Crime (Money Laundering) and Terrorist Financing Act, section 7, says every person or entity referred to in section 5 shall, in accordance with the regulations, report to FINTRAC every financial transaction that occurs or is attempted in the course of their activities and in respect of which there are reasonable grounds to suspect that it is related to the commission or attempted commission of a money laundering, terrorist activity financing or sanctions evasion offence. Section 8 of that Act says no person or entity shall disclose that they have made, are making or will make a report under section 7, or disclose the contents of such a report, with the intent to prejudice a criminal investigation, whether or not a criminal investigation has begun.

Money the CRA collects from your account

The CRA says that when it is unable to collect an amount owing or make an arrangement with the taxpayer to pay their debt, it may request funds from a third party, which could include a financial institution, by a garnishment (a requirement to pay, an enhanced requirement to pay or a demand on a third party). The CRA lists money held at a financial institution among the types of payments a garnishment can apply to, and says a third party that receives a garnishment must comply. The CRA says an RTP needs no court order (the exception is for COVID-19 benefits for individuals); more is on why the CRA took money from your account.

Other holds

Other pages cover a court garnishment order (garnishment), balances left untouched for years (unclaimed bank balances) and an account holder’s death (when an owner dies).

How to complain when an institution won’t explain or lift a hold is on complaining to your bank.

Related pages

• What a debit card is
• ATM and debit limits
• Interac e-Transfer
• Pre-authorized debits
• Mobile banking apps
• Complaining to your bank
• CDIC deposit insurance
• Unclaimed bank balances
• Equifax and TransUnion
• Investment scams
• Protecting your money
• The banking section