What types of banking fraud are most common in Canada?

Phishing emails/texts (pretending to be your bank), debit card skimming, SIM swap fraud, cheque fraud, authorized push payment (APP) scams, and identity theft. E-transfer interception is also growing as Canadians use Interac e-Transfer for more transactions.

Am I liable for unauthorized transactions on my bank account in Canada?

Generally no. Under the Canadian Code of Practice for Consumer Debit Card Services, you are not liable for unauthorized transactions if you did not contribute to the loss (i.e., did not share your PIN or leave your card unsecured). However, if the bank proves negligence, liability can shift to you.

What should I do if my bank account is compromised?

Call your bank immediately to freeze accounts. Change online banking passwords. Report to the Canadian Anti-Fraud Centre (1-888-495-8501). Check credit reports at Equifax and TransUnion. File a police report. Monitor accounts for 6-12 months afterward.

Can someone steal money from my e-transfer?

Yes, if you use security-question-based e-transfers (the recipient has not set up Autodeposit). The most common method is email interception where a fraudster answers the security question. Always use Autodeposit, which eliminates the security question and sends funds directly to the registered account.

How to Protect Yourself From Banking Fraud in Canada 2026

Banking fraud costs Canadians over $500 million per year in reported losses alone — and the true figure, including unreported cases, is likely two to four times higher. The methods are getting more sophisticated, from AI-generated phishing emails that perfectly mimic your bank’s branding to SIM-swap attacks that hijack your phone number. The good news is that the vast majority of banking fraud is preventable with a few straightforward precautions, and if you do become a victim, Canadian banking regulations generally protect you from financial loss when you act quickly.

Common Banking Fraud Types

Understanding how each type of fraud works is the first step to protecting yourself. Fraudsters rely on the fact that most people do not know the warning signs until it is too late.

Phishing (Email, Text, Phone)

Phishing remains the most common entry point for banking fraud in Canada, responsible for over 60% of all incidents. The attacks have evolved far beyond the obvious Nigerian prince emails — today’s phishing messages often use your real name, reference recent transactions, and include links to websites that are nearly identical to your bank’s actual login page. The single best defence is this: your bank will never ask you for your password, PIN, or full account number via email, text, or phone call. If someone does, it is a scam — no exceptions.

Feature	Details
How it works	Fake email/text/call pretending to be your bank
Goal	Get your login credentials, card number, or SIN
Red flags	Urgent language, suspicious links, asking for PIN/password
Volume	60%+ of all banking fraud starts with phishing
Example	“Your account has been locked. Click here to verify.”

Debit/Credit Card Fraud

Card fraud has declined significantly since chip and tap technology replaced magnetic stripe cards, but it has not disappeared. Skimming devices on ATMs and point-of-sale terminals still capture card data, and card-not-present fraud (where stolen card numbers are used for online purchases) is growing rapidly. Using tap payment or a digital wallet like Apple Pay adds an extra layer of security because your actual card number is never transmitted to the merchant.

Type	How It Works	Prevention
Skimming	Device on ATM/POS copies card data	Use tap, cover PIN, use bank ATMs
Card-not-present	Stolen card number used online	Use virtual cards, monitor statements
Lost/stolen card	Physical card used in person	Report immediately, freeze via app
Counterfeit card	Cloned card from stolen data	Chip + tap makes this harder

E-Transfer Fraud

Interac e-Transfer is one of the most popular payment methods in Canada, processing billions of dollars annually, and fraudsters have taken notice. The most common e-transfer scam involves intercepting emails to answer the security question before the intended recipient. The simplest way to eliminate this risk entirely is to enable Autodeposit on your account — funds go directly to your bank with no security question, so there is nothing for a fraudster to intercept.

Type	How It Works	Prevention
Email interception	Hacker intercepts email, answers security question	Use Autodeposit (no question needed)
Phishing request	Scammer sends e-transfer request pretending to be someone	Verify requests independently
SIM swap	Hacker takes over your phone number to intercept codes	Use authenticator apps, not SMS

Identity Theft

Identity theft is particularly insidious because you may not discover it for months. A fraudster who obtains your Social Insurance Number and basic personal information can open bank accounts, apply for credit cards, and take out loans in your name. By the time you notice the damage on your credit report, the cleanup process can take months and significant emotional energy. Regularly checking your credit report — which is free through services like Borrowell or Credit Karma — is the best early warning system.

Method	Details
Data breaches	Your info leaked from a company hack
Mail theft	Physical mail with banking/tax info stolen
Social engineering	Scammer tricks you into revealing personal info
Dark web purchase	Your info bought on dark web
SIN theft	Used to open accounts in your name

Authorized Push Payment (APP) Scams

APP scams are the fastest-growing type of banking fraud in Canada, and they are especially dangerous because you authorize the payment — which means your bank may argue it was a legitimate transaction. These scams prey on emotions: romance scams where you send money to a fake partner, urgent CRA calls demanding immediate payment, or fake invoices from a contractor you recently hired. The common thread is pressure to send money immediately. Legitimate organizations never require instant e-transfers or cryptocurrency payments.

Feature	Details
How it works	Scammer tricks you into willingly sending money
Common types	Romance scams, fake invoices, “CRA owes you”
Why it works	You authorize the payment, so bank may not refund
Growing trend	Fastest-growing fraud type in Canada
Prevention	Never send money to someone you haven’t met/verified

How to Protect Yourself

Prevention is far easier than recovery. The steps below are listed in order of impact — if you do nothing else, enable two-factor authentication on your bank accounts and turn on Autodeposit for e-transfers. Those two actions alone eliminate the majority of common attack vectors.

Online Banking Security

Protection	How to Implement
Strong, unique password	12+ characters, mix of upper/lower/number/symbol
Two-factor authentication (2FA)	Enable on all banking apps
Use authenticator app (not SMS)	Google Authenticator, Microsoft Authenticator
Biometric login	Face ID / fingerprint when available
Don’t bank on public Wi-Fi	Use mobile data or VPN
Log out after sessions	Don’t stay logged in on shared devices
Update devices regularly	Security patches prevent exploits
Use official bank apps	Download from App Store / Google Play only
Monitor account alerts	Set up text/email notifications for all transactions

SMS-based two-factor authentication is better than nothing, but it is vulnerable to SIM-swap attacks where a fraudster convinces your phone carrier to transfer your number to their device. Authenticator apps like Google Authenticator or Microsoft Authenticator generate codes locally on your device, making them immune to this type of attack.

Card Protection

Protection	How to Implement
Use tap/digital wallet	Avoids handing over physical card
Cover PIN at ATMs	Even when no one seems nearby
Use bank-owned ATMs	Avoid standalone ATMs at convenience stores
Set transaction alerts	Get notified for every purchase
Lock card in app	Lock debit/credit card when not in use
Virtual card numbers	Use for online shopping (available at some banks)
Review statements monthly	Flag unfamiliar charges

E-Transfer Protection

Enabling Autodeposit is the single most effective thing you can do to protect your e-transfers. When Autodeposit is active, incoming e-transfers go directly into your account with no security question — which means there is nothing for a fraudster to intercept. Every major Canadian bank supports Autodeposit and it takes about two minutes to set up.

Protection	How to Implement
Enable Autodeposit	Most important step — no security question needed
Don’t use obvious security questions	Avoid answers findable on social media
Verify requests independently	Call/text sender separately to confirm
Don’t send to unknown recipients	Verify identity first
Use strong email password	If email is hacked, e-transfers are exposed

Identity Protection

Protection	How to Implement
Check credit reports	Free from Equifax + TransUnion (annually at minimum)
Credit monitoring	Free via Borrowell, Credit Karma
Fraud alert on credit files	Free — notifies you of new account applications
Credit freeze	Prevents new accounts from being opened
Shred documents	Tax forms, bank statements, anything with SIN
Secure your mail	Locked mailbox or PO box
Protect your SIN	Never carry it in your wallet

Signs Your Account May Be Compromised

Most people discover fraud through small warning signs they initially dismiss. A login notification from a device you don’t recognize, a declined transaction you didn’t expect, or a credit score drop that doesn’t make sense — any of these should trigger immediate investigation. Speed matters: the faster you act, the more likely your bank can reverse unauthorized transactions and prevent further damage.

Warning Sign	What It Means
Transactions you don’t recognize	Possible unauthorized access
Login notifications from unknown devices	Someone else is accessing your account
Password reset emails you didn’t request	Attempted takeover
New accounts you didn’t open	Identity theft
Missing mail	Mail may have been redirected
Calls from “your bank” asking for info	Likely phishing (banks don’t call asking for passwords)
Credit score drop	Possible fraudulent accounts
Declined transactions	Possible card compromise and bank freeze

What to Do If You’re a Victim

If you discover you are a victim of banking fraud, the first 24 hours are critical. Your primary goals in that window are to stop the bleeding (freeze accounts, change passwords) and create an official record (bank report, police report, CAFC report). Every hour of delay gives fraudsters more time to drain additional funds or open more accounts in your name.

Immediate Steps (Within 24 Hours)

Step	Action	Contact
1	Call your bank’s fraud department	Bank’s 24/7 fraud hotline
2	Freeze affected accounts/cards	Through bank app or phone
3	Change all banking passwords	All accounts, not just the compromised one
4	Enable/change 2FA	Switch to authenticator app
5	Report to Canadian Anti-Fraud Centre	1-888-495-8501 or antifraudcentre.ca
6	File a police report	Local police (get report number)

Within 1 Week

Step	Action
7	Check credit reports at Equifax and TransUnion
8	Place fraud alerts on credit files
9	Review all bank and credit card statements
10	Change passwords for email and other financial accounts
11	Update security questions everywhere
12	Document all unauthorized transactions

Ongoing Monitoring

After a fraud incident, you are statistically more likely to be targeted again — fraudsters share and resell victim lists. Continue monitoring your accounts and credit reports closely for at least 12 months following the incident.

Action	Frequency
Monitor bank accounts	Daily for 3 months
Check credit reports	Monthly for 12 months
Review credit card statements	Monthly
Watch for phishing (you’re a target now)	Ongoing
Consider credit monitoring service	For 12+ months

Your Rights in Canada

Canadian banking regulations provide strong consumer protections against fraud, but they come with conditions. For credit cards, you have zero liability for unauthorized transactions — period. For debit cards, the protection is slightly more nuanced: you are generally not liable as long as you did not contribute to the fraud (by sharing your PIN, for example) and you reported the issue promptly. The key is acting fast and keeping a paper trail of every interaction with your bank.

Protection	Details
Zero-liability for credit card fraud	You pay $0 for unauthorized credit card transactions
Debit card protection	Not liable if PIN was secure and you reported promptly
Bank complaint process	Internal complaints → Ombudsman → OBSI or ADR Chambers
Reporting timeline	Report within 30 days of statement for best protection
FCAC oversight	Financial Consumer Agency of Canada regulates bank conduct
Credit bureau correction	Right to dispute and correct fraudulent entries on credit report

If your bank denies a fraud claim and you believe the decision is unfair, you can escalate to the bank’s internal ombudsman, then to an external dispute resolution body (OBSI or ADR Chambers depending on your bank). These services are free to consumers.

Bank Fraud Hotlines

Save your bank’s fraud number in your phone contacts now — not when you are panicking at 11 PM on a Friday night. Every major Canadian bank operates a 24/7 fraud hotline, and calling immediately is the most important thing you can do if you suspect your account has been compromised.

Bank	Fraud Hotline
RBC	1-800-769-2511
TD	1-888-751-9000
BMO	1-844-837-9228
Scotiabank	1-866-625-0561
CIBC	1-888-872-2422
National Bank	1-888-835-6281
Desjardins	1-800-224-7737
Tangerine	1-888-826-4374
EQ Bank	1-844-437-2265
Canadian Anti-Fraud Centre	1-888-495-8501

Banking Fraud Statistics in Canada

The scope of banking fraud in Canada is staggering, and it is growing. The Canadian Anti-Fraud Centre receives over 90,000 reports annually, but estimates suggest only 5-10% of fraud victims actually file a report. The average loss per victim ranges from $7,000 to $15,000, though some cases — particularly romance scams and investment fraud — can reach six figures. Understanding the scale of the problem reinforces why prevention is so much better than cure.

Metric	Amount
Annual fraud losses	$500+ million reported
Unreported (estimated)	$1-2+ billion
Most common method	Phishing/social engineering
Fastest growing	Authorized push payment scams
Average loss per victim	$7,000-$15,000
Recovery rate	~50-70% (banks often reimburse)
Fraud reports to CAFC	90,000+ annually

The Bottom Line

Banking fraud is a reality of modern life, but you do not have to be a victim. The majority of successful scams exploit human behaviour — urgency, trust, fear — rather than sophisticated technical vulnerabilities. Enable two-factor authentication, turn on Autodeposit for e-transfers, never share your banking credentials, and remember that your bank will never call or text asking for your password or PIN. If something feels off, hang up and call your bank’s fraud hotline directly. The two minutes it takes to verify could save you months of cleanup and thousands of dollars.