Card fraud and scam transfers: credit cards, debit cards and transfers you were tricked into making, whether you can get your money back, and where to complain

1. First, work out how the money was taken

"My money is gone" can happen in different ways, and the rules are very different for each. Use the table below to find which case is yours:

What an "unauthorized transaction" is. FCAC says that, in general, a bank or credit card transaction that you did not make and did not agree to is an unauthorized transaction. These transactions can happen when your card is lost or stolen, when your phone is lost, or when someone steals your personal information and uses it. FCAC also points out that each bank may define "unauthorized" differently, so check your credit card, debit card and account agreements.

Why money you were tricked into sending is the hardest to get back. In June 2026, the federal Department of Finance put it plainly in the Canada Gazette: under federal law today, the only consumer protection related to fraud is the rule on unauthorized credit card transactions (at most $50); debit cards rely on a code that banks signed voluntarily; for everything else, including e-Transfers and wire transfers sent by a scammer who signed in to your account, banks can make the customer bear the full loss; and transfers that customers were tricked or pressured into authorizing themselves, such as in romance scams, investment scams and online shopping scams, are currently also borne by the customer.

2. Credit cards: by law you pay at most $50, and most of the time nothing

What the law says. Section 627.33 of the federal Bank Act has three points that affect you directly:

1. For a credit card issued to you in Canada, if the card, account information such as the card number, or authentication information such as a PIN you set is used without your authorization, you bear at most $50. The exception is if you were "grossly negligent" in protecting the card, the account information or the PIN.
2. If you have told the bank that your card, card number or PIN was lost or stolen, or is at risk of being misused, you bear nothing for fraudulent charges made after the bank receives your report.
3. The fact that your PIN was used does not, by itself, prove that you were grossly negligent.

The FCAC page adds one point: if the credit card was issued not by a bank but by another federally regulated financial institution, the most you bear is $50 or the limit in your credit card agreement, whichever is less. FCAC also says your credit card agreement must state clearly the most you may have to pay.

There are also "zero liability" promises, so you usually do not even pay the $50. FCAC says that Visa, Mastercard, American Express and Interac have all promised to protect you from financial loss if your credit or debit card is used without your consent (Interac covers debit cards; see section 3). If you took reasonable care of your account information and PIN, you usually get the full amount back. The Department of Finance also writes in the Canada Gazette that, in practice, the major credit card issuers give cardholders zero liability. What each company says:

• Visa: for unauthorized transactions, your liability is $0. But there are conditions: it covers only cards issued in Canada; it does not cover anonymous Visa prepaid cards, corporate cards, business cards or purchasing cards, or transactions not processed by Visa; you must tell your bank right away when you find out your card was misused; and in cases such as gross negligence or a delay in reporting, the issuing bank can withhold, delay or take back money it credited to you earlier.
• American Express: as long as you took reasonable care of your account information, your PIN and any device that stores your card information, you do not bear the fraudulent charges. If your card or device is lost or stolen, or you suspect someone is using it, tell American Express right away.
• Mastercard: the FCAC page lists its zero liability protection, but we could not open Mastercard's terms page, so we have not checked the exact conditions. Go by what the bank that issued your card says.

An example. Your card has been in your wallet the whole time, but your statement shows an online purchase of $1,200 from a store you have never heard of. The bank investigates and finds that you did not make it and were not grossly negligent: by law, you pay at most $50, so at least $1,150 must be taken off what you owe; if the zero liability terms apply, the whole $1,200 is reversed.

When you report matters a lot. Say you call at 10 a.m. to report that your card number was leaked, and the bank records it; at 11 a.m. the scammer uses the card again. Under subsection 627.33(2) of the Bank Act, you do not bear the 11 a.m. charge. So when you call, always ask the bank to record the time of your report. Also note that the date shown on your statement is not necessarily when the card was used. CIBC's explanation says credit card transactions can take 5 to 7 business days to post. When you ask the bank, ask for the actual transaction time of each charge.

The law has no list of what counts as "gross negligence." The Bank Act does not say which actions count as gross negligence. What is clear is this: if you give your card, card number or PIN to someone else to use, what that person charges is usually your responsibility. For example, CIBC's credit card agreement says that if you authorize someone else to use your card, card number or PIN, you are responsible even for charges that person makes without your permission.

A card can be used for small amounts without a PIN. FCAC points out that credit cards have a "tap" (contactless) feature, so purchases below a certain amount need no PIN. If you lose your card, whoever finds it can spend up to that amount. So report a lost card right away.

3. Debit cards: there is no $50 line; it depends on whether you protected your PIN

A debit card spends the money in your deposit account, and the money is taken out directly. Debit cards do not have the Bank Act's $50 limit. Instead, they are covered by a code called the Canadian Code of Practice for Consumer Debit Card Services. This code was worked out together by consumer groups, banks and credit unions, retailers, and representatives of the federal and provincial governments, and banks sign it voluntarily. The Department of Finance says most banks have signed it. FCAC oversees it.

What the code covers. The code covers transactions made with a debit card and PIN at a terminal, such as an ATM or a store's payment terminal. The code says it does not cover transactions made outside Canada, or transactions that move money into or out of Canada. The FCAC page says debit cards are protected when used in stores, at payment terminals, at ATMs and online. Interac also has its own zero liability policy, which covers Interac debit tap payments, online and in-app payments, ATM cash withdrawals, and purchases where you insert your card and enter your PIN. Interac says that if your bank or credit union decides the fraud was beyond your reasonable control and you meet the conditions, your bank or credit union can refund you under your customer agreement.

In these cases, you do not bear the loss. In plain words, section 5 of the code and its appendix say:

• Machine or system problems, or the bank's own mistakes. For example, as FCAC describes, an ATM gives you less cash than you asked for but takes the full amount from your account. The code's appendix also says you do not bear the loss if a merchant or bank charges you twice for the same transaction.
• Use by someone else after you have reported the card lost or stolen; use of a card that was cancelled or had expired; use by someone else after you have reported that your PIN may be known to someone else.
• The card was counterfeit or faulty.
• Transactions made before the bank confirmed that you had received the card and PIN.
• You were tricked or robbed, or forced by trickery, force or intimidation to use the card. The condition is that you report it promptly and cooperate fully with the investigation.
• You unintentionally made it possible for someone else to misuse the card, as long as you cooperate with the investigation that follows.

In these cases, you may have to bear the loss. What the code calls "contributing to" unauthorized use comes in two kinds:

• You voluntarily told someone your PIN, including writing it on the card, or keeping a written PIN together with the card without properly disguising it;
• Your card was lost, stolen or misused, or your PIN may have become known to someone else, and you did not tell the bank within a reasonable time. The code explains that a "reasonable time" means as soon as you find out.

The code also explains a few points. Some work in your favour, and some you need to watch for:

• If your PIN was obtained by trickery, force or intimidation, you did not "voluntarily" disclose it. Having your PIN seen by someone watching you at a payment terminal does not count either.
• Using the same PIN for several cards does not count as contributing to unauthorized use. But the FCAC page lists "using different PINs for different cards and accounts" as one of the things you should do to get a full refund, and some card agreements may say the same, so it is best to use different PINs.
• However, the code treats a PIN made from your name, phone number, birth date, address or Social Insurance Number (SIN) as a "voluntary" disclosure of your PIN. The code also says you are only responsible if that disclosure actually caused the loss.
• FCAC lists a few more cases where you may be responsible: telling your PIN to a family member also counts; not reporting a lost card within the time set in your card agreement; refusing to cooperate with the investigation; and using the card to deposit fake cheques or empty envelopes.

If you are responsible, the most you bear. The code says the loss you bear will not exceed your debit card's withdrawal limits. But this can sometimes be more than the money actually in your account: for example, if the account is linked to overdraft protection or a line of credit, or to other accounts. The code gives an example: your bank sets your daily limits at $1,000 for ATM cash withdrawals and $2,000 for purchases, $3,000 in total; even if your account has only $2,000, with overdraft protection up to $3,000 could be taken in one day. So if this happens, ask the bank to set out clearly which account the money came from, which limit was used, and how your responsibility was worked out.

How soon the bank must answer you. Section 6 of the code says that when you report an unauthorized debit card transaction, the bank must tell you it will investigate and that any refund depends on the results, and it must respond as soon as possible, and no later than 10 business days. During the investigation, the bank may ask you to sign a written statement or, where appropriate, an affidavit; until it receives it, the 10 business days can be paused. Note that this is a deadline for a response, not for a refund.

Who has to prove it. The code also says: if the bank does not give you a full refund after its investigation, it is up to the bank to show, on a balance of probabilities, that you contributed to the unauthorized use. While the dispute is unresolved, the bank cannot unreasonably restrict your use of the money in dispute.

When you must report. FCAC says that for deposit accounts such as chequing and savings accounts, you generally have to dispute a transaction within 30 days of the statement date, but this may vary from bank to bank, so check your account agreement. If you miss the time set in your agreement, you may have to bear the loss yourself. The safest thing is to report it the day you find it.

4. When the bank says "your PIN was used," that alone does not make you responsible

Many people are refused a refund with this reason: "This transaction used the correct PIN (or verification code, or chip), so you authorized it." That alone is not a valid reason to refuse a refund.

What the official sources say.

• Subsection 627.33(3) of the Bank Act: the fact that your PIN was used on a credit card does not, by itself, prove that you were grossly negligent.
• The FCAC page says that a federally regulated financial institution cannot hold you responsible just because someone used authentication technology (such as a PIN, or other passcodes or verification details you set up); for transactions you dispute, whether they were made with a PIN, the magnetic stripe or another technology, the bank must investigate fully.
• FCAC Bulletin B-6, which is addressed to banks, is more specific: banks must investigate whether something beyond your control caused the fraud, such as someone watching you enter your PIN (called shoulder surfing: someone looking over your shoulder at the keys you press), coercion, a stolen card or a system failure; they cannot decide you are responsible only because "the chip and PIN were correct"; and FCAC requires banks to report the specific steps they took to investigate before deciding a customer is responsible.

You can ask the bank to do these things.

• Check the time and place of each transaction (which ATM, which store, which website), and compare them with when you reported the card lost or changed your PIN;
• Explain how the transaction passed verification: which kind of PIN or verification code was used, when the code was sent, and to which phone number;
• Explain in writing why it decided you are responsible, what evidence it looked at, and which clause of the agreement it relied on.

If you did receive a verification code. If you received a verification code from your bank and then an unfamiliar transaction appeared, keep the original text message and tell the bank exactly what happened: whether the code said it was for signing in, adding a payee, adding the card to a mobile wallet, or making a payment; and whether you gave it to anyone, who, and what that person told you. The debit card code has a rule on PINs: a PIN taken from you by trickery, force or intimidation does not count as "voluntarily" disclosed. Whether a verification code counts in the same way is not stated by either the code or FCAC, and banks may see it differently. Either way, tell the truth, and explain clearly, on its own, the step you did not agree to.

What you can say on the phone:

"I did not make or approve this transaction. The use of my PIN alone does not mean I authorized it. Please do a full investigation, as FCAC requires, and give me the result and the reasons in writing."

5. Someone got into your online banking, or you were tricked into sending money: no legal refund rule for now, so act fast

The two cases in this section are the two hardest rows in the table in section 1.

First case: someone signed in to your online banking and moved money out. For example, you clicked a link in a fake text message and entered your online banking password, and the next day you find $3,000 missing from your account, sent by e-Transfer to a stranger. The federal Department of Finance says in the Canada Gazette that, for now, banks can make the customer bear the full loss of e-Transfers and wire transfers sent by a scammer who signed in to the customer's account. The debit card code covers "card plus PIN" transactions at terminals; e-Transfers are not included. So how much you get back in this case depends mainly on two things: what your online banking agreement with the bank says, and the result of the bank's investigation. When you call, ask the bank to send you the clauses of your online banking agreement on unauthorized transactions.

Second case: you were tricked and sent the money yourself. For example, someone claiming to be from your bank's fraud department says your account has been hacked and tells you to move your money "to a safe account"; or someone you met online gets you to "invest"; or you buy something online and the seller takes your money and ships nothing. You pressed "send" yourself, and the Department of Finance says that in these cases the customer usually bears the loss now. Whether the money can be stopped or recovered depends on how far it has gone.

e-Transfer: whether the other person has accepted it makes a big difference.

• Not yet accepted (shown as pending): you can cancel it. Interac says to sign in to online banking, find the transfer in your transaction or payment history, and select "Cancel." Each bank's steps are different, and some charge a cancellation fee. Scotiabank says that after you cancel, in most cases the money goes back to your account right away.
• Already accepted: Interac says that once the money has been deposited into the other person's account, there is no way to reverse the transaction, and you can only work it out with the recipient yourself.
• The other person has Autodeposit turned on: RBC and Scotiabank both say the money goes into the other person's account automatically and cannot be cancelled.
• If you cannot find a "Cancel" button in your online banking, it can no longer be cancelled (RBC's explanation).
• Interac says it does not hold funds and cannot trace where the money went; for any problem, you have to contact your own bank.

So if you find out you have been scammed, do not wait: call the bank the money was sent from right away. The Canadian Anti-Fraud Centre also says the first thing to do is contact the financial institution you sent the money through. Ask the bank to act right away, and ask whether it can contact the receiving bank to stop the money. There is no official guarantee that it can be stopped, but the sooner you call, the better your chances.

What you can say on the phone:

"Someone pretending to be a bank employee tricked me into sending this transfer. Please record the time of my report. Please check right away whether the transfer can be stopped, contact the receiving bank if possible, and give me a case number."

If you were scammed once, watch out for a second time. The Canadian Anti-Fraud Centre warns that scammers often come back to victims a second or third time, saying they can help you "get your money back." Whether they say they are a lawyer, a police officer or a recovery company, do not pay anything to get your money back.

If you were tricked into using your debit card, the code has a separate rule. If someone tricked or forced you into entering your PIN with your debit card at an ATM or payment terminal, that falls under the debit card code described in section 3: the code says that if you were tricked, robbed, or forced by trickery, force or intimidation to use the card, you do not bear the loss, as long as you report it promptly and cooperate fully with the investigation. This rule covers debit card transactions; it does not cover e-Transfers or wire transfers.

Related: to stop further losses after a scam, also see section 9 of No. 20 · Staying safe and getting help.

6. The 2026 federal anti-fraud law: what passed and when it takes effect

The law that has passed. On March 26, 2026, federal Bill C-15 (short title: Budget 2025 Implementation Act, No. 1) received Royal Assent and became law. It amended the Bank Act to require banks to:

• have policies and practices to detect and prevent fraud against consumers and to reduce its impact;
• get your express consent before turning on certain account features;
• let you turn these features off;
• let you adjust the withdrawal and transfer limits on your account;
• report fraud-related data to FCAC every year.

The supporting regulations: what we found is a draft. On June 27, 2026, the federal Department of Finance published draft supporting regulations in Part I of the Canada Gazette, with 30 days for comments. The main points of the draft:

• Before turning on transfer features such as e-Transfers, wire transfers and international money transfers on your personal deposit account, the bank must first explain what they do and how they could be misused, and get your express consent. Moving money between your own accounts at the same bank, ATM withdrawals, paying with a debit or prepaid card, pre-authorized debits and direct bill payments are not covered by this requirement;
• For features already turned on in your account when the regulations take effect, the bank does not have to go back and ask for your consent;
• You can turn these transfer features off, and the bank must tell you about this option when you open an account;
• If you ask for a higher transfer limit and the bank has verified that it is you, it must make the change right away; if it has not verified it is you, by the next business day;
• Banks must have practices to investigate suspicious transactions and to alert customers to suspicious requests;
• Banks must report data on each fraud, including how much the victim lost, how much the bank refunded the victim (if anything), and whether the scammer acted without authorization or the victim was tricked into authorizing it.

When it takes effect. The draft says the regulations are intended to take effect on July 1, 2027, and the anti-fraud parts of C-15 are also intended to take effect on the same day, with the date to be formally set by order of the Governor in Council. When we checked on November 3, 2026, the current version of these regulations (the Financial Consumer Protection Framework Regulations) on the federal Justice Laws Website was current to October 19, 2026, was last amended on March 12, 2026, and did not yet contain the anti-fraud provisions. The final version must be published in Part II of the Canada Gazette, and that version governs; when it comes out, both the dates and the content may change.

The new law does not say "all scam victims get their money back." What the law and the draft require is: get consent before turning on transfer features, let you turn them off and adjust the limits, and have banks report data. The draft only requires banks to report "how much was refunded"; it does not require banks to repay people who were scammed. When the Department of Finance estimated the benefits of these regulations, it counted only "unauthorized" fraud that could be prevented.

A survey (an opinion, not a rule). On October 13, 2026, the Quebec consumer group Option consommateurs published an online survey it commissioned from Léger (October 2 to 5, 1,519 people): 87% said that, unless the victim was grossly negligent, banks should repay victims of bank fraud. This reflects the views of the people surveyed; it is not the law.

What you can do now, before the new law takes effect. FCAC says that if your debit card's daily limit is higher than you need, you can contact your bank to lower it, and you can also ask the bank to turn off the tap feature on your debit card. If you do not normally use e-Transfers or wire transfers, you can also ask your bank whether it can lower those limits. You can ask: "Can you lower my daily debit limit and my Interac e-Transfer limit?"

7. What to do in the first hour after you spot a suspicious transaction

1. Hang up on suspicious calls and call your bank yourself. FCAC says real credit card companies will not ask for your personal information over the phone. If a call seems suspicious, hang up and call back using the number on the back of your card. Get the number from the back of your card, your bank's official app or its official website; do not use a number the caller gave you, and do not call back the number shown on your call display.

2. Lock your card first if you can. If your bank's app has a temporary card lock feature, lock the card first, then call.

3. Report it by phone, and write down three things. FCAC says to write down who you spoke to and when. It is also a good idea to ask for a case number (or reference number). Write all three on paper: the exact time you called, the name of the person you spoke to, and the case number.

4. Go through each transaction clearly. For each one, give the date, the amount, and the merchant or recipient, and say which ones you made and which you did not. Ask the bank what happens next and how soon it will answer.

5. Replace your card and change your passwords. FCAC says that if you think someone has used your card or account, or there is a risk of it, change your passwords and PIN right away. CanDo Studio adds one more tip: if you suspect your phone or computer has been taken over, it is best to change your passwords on a different device you can trust. Taking CIBC as an example: if you submit a credit card fraud dispute online, it cancels the card and mails a new card to the address on file within 10 business days (30 business days in remote areas); a card already stored in your mobile wallet can still be used and is updated automatically with the new card details. Other banks may do this differently, so ask when you call.

6. If you lose your phone, make two calls. FCAC says that if you lose the phone you use for online banking, tell your bank, and also tell your phone company to suspend the phone.

7. Check your credit reports. FCAC says to look for loans or credit cards you never applied for, or other suspicious entries. Section 9 explains more.

8. Keep watching your accounts. After you report it, FCAC says to keep checking your accounts for new suspicious transactions.

What you can say first on the phone:

"Hi, there is a transaction on my account that I did not make. I'm reporting it now. Please record the time of my report, block this card, investigate the transaction, and give me a case number."

The rules for your money are different before and after you report. As sections 2 and 3 explained: for a credit card, you do not bear charges made after the bank receives your report; for a debit card, the code says you also do not bear use that happens after you report the card lost. So do step 3 as early as you can.

Related: for how to prepare before you call, also see No. 7 · Phone directory.

8. Report it to the police, and again to the Canadian Anti-Fraud Centre

Gather your materials first. The Canadian Anti-Fraud Centre (CAFC) says: first stay calm, and keep everything related to what happened: documents, receipts, and screenshots of emails and text messages. FCAC also suggests writing down what happened, including how you found out about the theft. CanDo Studio suggests also making a timeline: when you last used the card yourself, when you noticed something was wrong, and when you told the bank.

Report it to your local police and get a file number. CAFC says to report it to your local police and keep the file number for later. If you later find suspicious entries on your credit report, tell the police too, so they can update the file. CAFC also explains that investigating is the job of the local police; CAFC collects information to help the police with their cases.

• If someone is in danger or it is happening right now, call 911.
• For a non-urgent report after the fact, call your local police non-emergency line. If you live in the City of Victoria or Esquimalt, the main number for the Victoria Police Department (VicPD) is 250-995-7654, and its website also has a way to report online. If you live in another municipality, see section 10 of the guide "Staying safe and getting help" for non-emergency numbers.

Report it to CAFC as well. Whether you are a victim or a witness to a fraud, you can report it:

• Online: reportcyberandfraud.canada.ca, where you can choose to stay anonymous;
• By phone: 1-888-495-8501, Monday to Friday, 10 a.m. to 4:45 p.m. Eastern Time, closed on holidays. Since 2026, B.C. uses the same time all year and no longer changes its clocks, so in B.C. time there are two periods: from the first Sunday in November to the second Sunday in March, it is 8 a.m. to 2:45 p.m.; the rest of the year, it is 7 a.m. to 1:45 p.m.

CAFC says the information reported is shared with the National Cybercrime Coordination Centre, which may link cases from different places and help the police solve them. FCAC also suggests that victims report through this national fraud reporting system, which is run jointly by the Royal Canadian Mounted Police (RCMP) and CAFC.

If your personal information was also stolen. CAFC says to flag all your accounts, change all your passwords, and report it to both credit bureaus (Equifax and TransUnion). If your passport, driver's licence or SIN was lost or misused, each has its own place to report it, listed on the CAFC page.

If your SIN was lost or is being misused: if your information was only in a data breach and you have not found anyone using it, you do not need to tell Service Canada's SIN Program; keep a close watch on your two credit reports, your statements and your mail, and consider adding fraud alerts with the two credit bureaus. If you know someone is using it, ask the police to include your name and SIN (in full, or its last 3 digits) in the report, then call the right place depending on where the problem showed up: the CRA at 1-833-995-2336, EI at 1-800-206-7218 or the SIN Program at 1-866-274-6627. Service Canada generally does not recommend getting a new SIN. See sections 9, 10 and 11 of Guide No. 50.

→ No. 50 · Protecting your SIN

Related: for local police non-emergency numbers in B.C., see section 10 of No. 20 · Staying safe and getting help.

9. Add an alert to your credit reports to make it harder for someone to borrow in your name

When a card number is stolen, sometimes your personal information is stolen along with it. Scammers may use your name to apply for credit cards and loans. FCAC and CAFC both suggest contacting Canada's two main credit bureaus, Equifax and TransUnion, and asking them to add a fraud alert to your credit report. You have to contact each one separately; an alert added at one is not automatically added at the other.

Equifax's two kinds of alert. The Equifax website says:

• Fraud Alert: only for confirmed victims of fraud or identity theft. It is free and stays on your credit report for 6 years. It includes a phone number, and lenders are encouraged to call you to confirm before lending, but this is not required by law. You can add it by calling Equifax's customer service centre, or apply online or by mail (online: on the Equifax website, click "Start Dispute," then "Start Electronic Dispute," and choose "Alerts" for the part you want to change). Once it is added, Equifax will also help you look into suspicious inquiries and accounts on your report if needed. Equifax's examples of a "confirmed victim" include: your bank tells you someone used your information to open a new credit account; after a data breach, inquiries you do not recognize appear on your report; your bank account was accessed illegally; the police or the RCMP told you to call Equifax.
• Identity Alert: you do not need to be a victim already. You add a phone number and a note yourself, and it stays for 6 years. When you apply for credit in B.C., lenders are "encouraged" to call you to confirm, but they do not have to (only Manitoba and Ontario require it). Automated phone line: 1-800-465-7166.

TransUnion. We could not open the TransUnion website, so we have not checked how to add an alert there or whether there is a fee. Please go to the TransUnion website directly, or call and ask.

Get a copy of your credit report while you are at it. FCAC suggests asking each of the two bureaus for a copy of your credit report, reading it carefully, and reporting anything that looks wrong.

For a credit freeze, see another guide. FCAC says that in some provinces you can also put a "freeze" (security freeze) on your credit report, so that lenders cannot see your report. For B.C.'s new credit protection rules, see No. 34 · Protecting your credit.

10. You bought something and it never arrived: that is a merchant dispute, not fraud

If you really placed the order and paid, but the merchant did not ship, sent the wrong item, did not give a refund it owed, or charged you twice, that is not an "unauthorized transaction"; it is a merchant dispute.

Go to the merchant first. The debit card code says that problems with goods or services bought with a debit card must be settled with the merchant. The same goes for credit cards: go to the merchant first. Taking CIBC as an example, its explanation says you should first try to resolve it with the merchant (unless the merchant has gone bankrupt or closed); only if the merchant has not replied within 2 business days, or has not resolved it, do you raise a dispute in online banking.

Then raise a dispute with the bank that issued your card. For a merchant dispute on a credit card, you can raise a dispute with the bank that issued the card. The conditions and deadlines differ from bank to bank. Taking CIBC as an example:

• In online banking or the app, tap the transaction and choose "Dispute this transaction";
• Submit it no later than 30 days after the statement date;
• While a transaction is still "pending," you can only raise a dispute if you do not recognize it and suspect fraud; for ordinary disputes, wait until it has posted;
• Keep your order, receipt, emails with the merchant and the delivery date the merchant promised; you may need to provide them.

CIBC's credit card agreement also requires you to review every statement and report unauthorized or suspicious transactions within 30 days of the statement date. For other banks' deadlines, check your own credit card agreement, or call and ask: "What is the deadline to dispute a charge, and what documents do you need?"

If something you bought online in B.C. was not delivered, B.C. law also gives you another route: for orders placed on or after August 1, 2026, if the goods have not arrived 30 days after the agreed delivery date (or 30 days after you ordered, if no delivery date was stated), or if the business did not give you a copy of the contract within 15 days after you ordered (in that case you must cancel within 30 days after you ordered), you can cancel under the law; if the business then does not refund you within 15 days and you paid by credit card, you can ask your card issuer to reverse the charge under section 52 of B.C.'s Business Practices and Consumer Protection Act, and the issuer must reverse the charge and the related interest and fees within two complete billing cycles or 90 days, whichever comes first. For how to send the notice of cancellation and the six things the request must include, see sections 4 and 11 of Guide No. 45.

→ No. 45 · Online shopping problems and returns

If it is not fraud and not a problem with a merchant, but the bank itself got it wrong, for example the annual fee or interest does not match your agreement, or you paid the full balance on time but were still charged interest: call the number on the back of your card and say clearly which statement and which charge. If a pre-authorized debit (PAD) from your bank account was wrong, different rules apply: first ask the company that took the money; if you are not satisfied, ask your bank for a reimbursement within 90 calendar days of the day the money was taken. Monthly automatic charges on a credit card are not PADs, so those 90 days do not apply to them. See sections 9 and 10 of Guide No. 49.

→ No. 49 · Checking and disputing your bills

11. If the bank will not pay: how to complain, who to go to, and the deadlines

Step one: make a formal complaint to the bank and ask for a written answer.

FCAC says to get these ready and write them down first:

• the key facts of what happened;
• the specific dates, the names of the staff who handled it, and any other supporting documents;
• the result you want, such as a refund or a correction to your account records.

Every bank has its own complaint process, posted on its website and also available at its branches; the FCAC website has a list of the complaint processes of federally regulated financial institutions. Banks generally have two internal levels. You can complain in person, by phone or online. FCAC says that after receiving a complaint, the bank must: confirm in writing the date it received the complaint and explain its complaint process; and, within 56 calendar days of your first complaint, give you a detailed written answer. If the bank closes the complaint and you are not satisfied with the solution it offered, it must also answer in writing.

Your complaint letter can be simple: the original case number; the disputed transactions (date, amount, merchant or recipient); what you want the bank to do; and copies of the key evidence. Ask the bank to explain what facts it investigated, which clause of the agreement or which law it relied on, and whether interest and fees will also be refunded. Keep copies of the emails and letters you send.

Step two: go to the banking ombudsman, OBSI. It is free.

OBSI's full name is the Ombudsman for Banking Services and Investments. It is an independent external complaints body that reviews disputes between you and your bank fairly and free of charge. Since November 1, 2024, OBSI has been the only external complaints body for all federally regulated banks in Canada. RBC, TD, Scotiabank, National Bank, Tangerine and Digital Commerce Bank used to use another body called ADRBO; they have all moved to OBSI, and ADRBO is only finishing the open cases it received before November 1, 2024.

When you can go to OBSI, whichever comes first:

• 56 calendar days have passed since your first complaint to the bank, and the bank has not given you a final answer. OBSI says the count starts from your first "written" complaint and asks you to complain in writing so the timeline is clear; so it is best to complain by email or letter and keep a copy;
• or the bank has given you a detailed written answer and closed the complaint, and you are not satisfied.

You must go to OBSI within 180 calendar days of receiving the bank's final written answer; after that it is too late.

How OBSI handles it:

• If the complaint is not one OBSI handles, FCAC says OBSI must tell you in writing within 30 calendar days;
• Once it has the information it needs, it gives a final written recommendation within 120 calendar days; OBSI itself says that once a case is assigned to an investigator, it aims to finish investigating banking cases within 90 calendar days;
• It can recommend compensation of up to $350,000 per complaint;
• Its recommendations are not binding on the bank. If a bank does not follow one, OBSI publishes the bank's name and its findings, but not your name;
• Using OBSI does not stop you from going to court later.

OBSI phone: toll-free 1-888-451-4519; TTY for people who are deaf or hard of hearing 1-844-358-3442. To complain online, start from OBSI's "Make a Complaint" page.

What FCAC can and cannot do. FCAC does not resolve individual complaints or decide on compensation; it supervises whether banks follow the rules and whether their complaint processes meet the requirements. Its consumer information centre can explain your rights and how a bank's complaint process works. Phone 1-866-461-3222, Monday to Friday, 8:30 a.m. to 5 p.m. Eastern Time. In B.C. time: from the first Sunday in November to the second Sunday in March, 6:30 a.m. to 3 p.m.; the rest of the year, 5:30 a.m. to 2 p.m. You can also complain directly to FCAC, which will use the information in its supervisory work.

B.C. credit unions are different. FCAC says provincial credit unions may have different complaint processes. OBSI says provincial credit unions have 90 days to handle your complaint (not the 56 days banks have). The steps given by the BC Financial Services Authority (BCFSA) are:

1. Go to the credit union's branch manager or regional manager;
2. Escalate to the credit union's senior officer responsible for complaints (such as its chief complaints officer);
3. Then go to the independent external complaints body, OBSI.

At any point in this process, you can complain to BCFSA. BCFSA cannot mediate for you, but it can help you get a clear answer from the credit union. BCFSA phone: local 604-660-3555, toll-free 1-866-206-3030.

How to tell whether your credit union is federally or provincially regulated. First check FCAC's list of complaint processes for federally regulated institutions. For example, Coast Capital Savings Federal Credit Union (a federal credit union) is on it and follows the rules for banks. If you cannot find yours on the list, ask the credit union directly: "Are you federally regulated or provincially regulated?"

The deadlines in one table:

If that still does not work and you want a lawyer. If you do not accept OBSI's recommendation, or the bank does not follow it, you can consult a lawyer about legal action; FCAC points out that this may cost money. If you look for a lawyer in B.C., first check the Law Society of British Columbia's directory to see whether the person is licensed to practise. The BCFSA page also lists the Lawyer Referral Service of the Canadian Bar Association, BC Branch: 604-687-3221, toll-free 1-800-663-1919.

What you can write when you ask for a review:

"Please provide the reasons for the denial in writing, including the evidence and the terms you relied on, and tell me how to file a formal complaint."

12. How to protect yourself day to day

These tips come from FCAC's two pages on credit card fraud and debit card fraud:

• Make your PIN hard to guess. Do not use your birth date, Social Insurance Number, address or phone number as your PIN.
• Do not tell anyone your PIN, not even family. It is best to memorize it; if you must write it down, keep it separate from your card and wallet. Do not store it on your computer or phone. Change your PIN often, and use different PINs for different cards.
• Cover the keypad with your hand or body when you enter your PIN.
• Lower your daily limits. Whoever gets hold of your debit card can use up to the full amount you are allowed to spend or withdraw each day. If you do not need that much, call your bank to lower it, and you can also ask the bank to turn off tap payments.
• Turn on multi-factor authentication. When you sign in, you use a fingerprint or a verification code in addition to your password; this is called multi-factor authentication (MFA). Turn it on wherever you can.
• Check your statements often. Go through your credit card statement every month and check every charge.
• Look after your mailbox and old cards. Lock your mailbox so statements and new cards are not stolen; sign the back of a new card as soon as you get it; cut up old cards you no longer use; when you close a card, get written confirmation.
• Be careful online. Only enter your card number on secure websites (the address starts with https, or there is a padlock symbol); do not use public Wi-Fi or public computers for online banking or shopping; do not let your computer or phone remember your online banking password.
• Keep a list of your cards. Write down each card and the number to call if it is lost, and keep the list somewhere safe, so if a card is lost you know right away which number to call.
• Do not click unexpected e-Transfer notices. Interac says that if you receive an e-Transfer notice you were not expecting, first contact the sender to confirm it; if you cannot confirm it, forward the notice to phishing@interac.ca.
• Check your credit reports at least once a year.

When selling used items online, watch out for fake e-Transfers. The Canadian Anti-Fraud Centre warns that some scammers target people who sell things online: a "buyer" sends an official-looking email or text message saying the money has been sent, and asks you to click a link to "accept the transfer"; it takes you to a fake bank login page, and as soon as you enter your online banking username and password, the scammer uses them to get into your account and steal your money. Overpaying and asking you to refund the difference, or asking you to scan a QR code to "receive payment", are also common tricks. For how to recognize these tricks, and how to make in-person exchanges safer, see sections 10 and 11 of Guide No. 61.

→ No. 61 · Canada Post Swap Spot

Related: for how to limit your losses after a scam, see section 9 of No. 20 · Staying safe and getting help; for how to recognize common scams and check your credit reports day to day, see No. 34 · Protecting your credit; if you have just arrived in Canada, you can ask about the daily limits and e-Transfer settings when you open your account; for opening an account, see No. 2 · First 90 days.

13. Checklist before you act

• First work out which case you are in: credit card fraud, debit card fraud, someone got into your online banking and moved money, you were tricked into sending money yourself, or a merchant dispute.
• Hang up on suspicious calls, and call your bank using the number on the back of your card.
• Write down the time of your report, the name of the person you spoke to, and the case number.
• Go through each transaction and say which ones you made and which you did not.
• If an e-Transfer has not been accepted yet, cancel it in online banking right away.
• Change your passwords and PIN; if you lost your phone, tell your phone company too.
• Report it to your local police and get a file number, then report it to the Canadian Anti-Fraud Centre.
• If your personal information may have been leaked, add alerts at both Equifax and TransUnion.
• If the bank refuses to pay because "the PIN was correct," ask for a full investigation and a written explanation of the reasons.
• If the bank has not given you a final answer within 56 days (OBSI counts from your first written complaint), or you are not satisfied with its answer, go to OBSI; submit within 180 days of the final answer.
• Provincial credit unions: 90 days; see section 11 for the steps; you can also go to BCFSA.
• If anyone says they can help you "get back the money you were scammed out of" but wants a fee first, do not pay.

Related guides

• → No. 34 · Protecting your credit
  How to protect yourself before money is taken: how to check your credit reports for free, how to add an alert to your report, and B.C.'s new credit freeze rules.
• → No. 20 · Staying safe and getting help
  How to stop further losses after a scam (section 9), and local police non-emergency numbers in B.C. (section 10).
• → No. 7 · Phone directory
  How to prepare before you call government and agency lines, and what to do if you cannot get through.
• → No. 2 · First 90 days
  Opening a bank account after you arrive: you can ask about the daily limits and e-Transfer settings when you open it.
• → No. 15 · Saving tax & investing
  What to ask when someone presents a financial product to you, and how to check their credentials.
• → No. 45 · Online shopping problems and returns
  Online purchases that do not arrive, are wrong or are broken: B.C.'s right to cancel and the section 52 credit card chargeback, which is not the same as your bank's own dispute process.
• → No. 49 · Checking and disputing your bills
  What to look for on a credit card statement and who to call when the bank gets interest or fees wrong; if an automatic withdrawal from your bank account was wrong, going to your bank within 90 calendar days.
• → No. 50 · Protecting your SIN
  If someone is using your SIN: report it to the police and get a case number first, then call the CRA, EI or Service Canada's SIN Program depending on where the problem showed up; how to check three places for misuse; why a new SIN is generally not recommended.
• → No. 57 · High-theft vehicles and insurance surcharges
  If your vehicle is broken into and your wallet or bank cards are stolen from it: report it to the police and write down the file number, which items in your vehicle car insurance may or may not cover, and how to claim with ICBC if the vehicle itself is stolen.
• → No. 61 · Canada Post Swap Spot
  How to recognize common scams when buying and selling used items online (fake e-Transfer links, overpaying and asking you to refund the difference, scanning a QR code to "receive payment"), how to make in-person exchanges safer, who to contact first if you are scammed, and Canada Post's Swap Spot hand-overs at post offices, being trialled in some cities.

Main official links in this guide

These are the official pages used most in this guide. The Bank Act section and the pages of FCAC, the Department of Finance Canada, the Canada Gazette, the Canadian Anti-Fraud Centre, OBSI, BCFSA, Interac, Visa, American Express, Equifax and several banks quoted in this guide were all opened and read in the original on November 3, 2026. We could not open Mastercard's zero liability terms page or the TransUnion website, so what they say has not been checked. The final version of the supporting anti-fraud regulations must be published in Part II of the Canada Gazette, and we did not check Part II this time. Other links are at the end of each section.