Credit and debit card fraud in Canada: what to do — and what you could owe

Card fraud is any use of your credit or debit card, or its details, without your permission, the Financial Consumer Agency of Canada (FCAC) explains. Chip and PIN make stolen cards harder to use in person, but contactless payments work up to a limit without a PIN.

How card details get stolen

• Skimmers on payment terminals that record your card information.
• Shoulder surfing, or an ATM rigged to jam your card while an 'accomplice' watches you retry your PIN.
• Phishing emails and texts asking for your card details, and fake websites.
• Hacks of companies that hold your payment information.
• Statements taken from your mailbox or trash, and lost or stolen phones.
• Callers who pretend to be your bank.

Beware the 'bank investigator' call

Fraudsters pose as your bank, the police or a credit bureau, claim your account is compromised and ask for help with an 'investigation': remote access, a money transfer, a code sent by text, or your card, picked up at your home. Canadians reported about $28.6 million in losses to bank investigator fraud to the Canadian Anti-Fraud Centre (CAFC) in the first six months of 2026. Hang up and call the number on the back of your card, from another phone or after waiting 10 minutes, the CAFC advises. Banks and police never collect cards at your home.

If your card or its details are stolen: first steps

1. Call your card issuer or bank immediately, on the number on the back of the card, if you spot a transaction you don't recognize or lose the card. Note who you spoke to and when, and tell your mobile provider if you lost a phone you bank on.
2. Change your passwords and PINs, and report each transaction you didn't make or approve.
3. Mind the deadline in your account agreement: for chequing and savings accounts it's usually 30 days after the statement date, the FCAC says.
4. Report it to your local police and to the CAFC through Report Cybercrime and Fraud (reportcyberandfraud.canada.ca) or at 1-888-495-8501.
5. Ask Equifax and TransUnion for a fraud alert, and check both credit reports.

What you could owe

For a credit card, use of your PIN doesn't by itself prove gross negligence under the Bank Act, and the FCAC says liability can't rest only on a correct chip and PIN: institutions must consider shoulder surfing, coercion, theft or a malfunction. Under the debit code, your institution must respond within 10 business days, and to refuse full reimbursement it must show, on the balance of probabilities, that you contributed.

Contributing means voluntarily sharing your PIN — even with family — writing it on the card or keeping a poorly disguised note of it nearby, or choosing a PIN made from your name, phone number, birth date, address or SIN. A PIN obtained by trickery or force doesn't count. The code doesn't cover transactions outside Canada.

Payments you made because of a scam

If a scammer talked you into sending money yourself, no Canadian rule makes your bank reimburse you. The Department of Finance says the only legislative protections are the $50 credit card cap and the debit code; the Canada Gazette notes that consumers are held liable for payments they authorized as a result of coercion or deception. Bank Act changes and draft regulations proposed to take effect July 1, 2027 would make banks get your express consent before enabling Interac e-Transfers, wires and global money transfers — but they don't require reimbursement and aren't in force. Tell your bank right away anyway: the Ombudsman for Banking Services and Investments (OBSI) says it may recommend compensation when a bank was aware of risks but didn't act reasonably.

If your bank won't reimburse you

1. Complain through your bank's complaint-handling process. It must give you a detailed written response within 56 calendar days.
2. If you're not satisfied, or 56 days have passed, go to OBSI — free, independent and, since November 1, 2024, the single external complaints body for federally regulated banks. You have 180 calendar days after the bank's final response; call 1-888-451-4519.
3. OBSI must make a final written recommendation within 120 days of getting the information it needs. Its recommendations aren't binding on banks.
4. Provincially regulated credit unions have their own process — ask your provincial or territorial regulator. Desjardins members can turn to the Desjardins Group Ombudsman.

How to make your card a harder target

• Choose a PIN that's hard to guess — not your birth date, SIN, address or phone number — memorize it and never share it.
• Cover the keypad and keep your card in sight when you pay.
• Ask your bank to lower your daily debit limit or to turn off contactless on your debit card.
• Lock your mailbox, review statements monthly and check your credit report yearly.
• Use multi-factor authentication, and never read out a code to someone who calls you.
• Turn on Autodeposit for Interac e-Transfers, which the CAFC calls an extra layer of security.

Can security software help?

Only with the online part. No app can spot a skimmer or stop someone watching you enter your PIN. The FCAC advises keeping your firewall, anti-virus and anti-spyware up to date, and some security suites add protection against scam texts and calls. That's a useful extra layer, but reporting fast and guarding your PIN matter more.

Call first, report every transaction, and keep your PIN to yourself. Under Canada's rules, how you protected your PIN often decides who pays.