If you’re hit with unauthorized debit card charges or a hijacked Interac e-Transfer in Canada, you’ll usually get your money back, provided the fraud was genuinely beyond your control, you kept your PIN and security answers protected, and you reported the problem to your bank quickly. Reimbursement for unauthorized debit and e-transfer fraud in Canada runs on three overlapping layers: the Canadian Code of Practice for Consumer Debit Card Services, Interac’s Zero Liability Policy, and independent review by the Ombudsman for Banking Services and Investments if your bank turns you down.
When the Bank Absorbs the Loss and When You Do
The Canadian Code of Practice for Consumer Debit Card Services sets the baseline. The Financial Consumer Agency of Canada monitors bank compliance with it, and every major Canadian bank participates.1Financial Consumer Agency of Canada. Legislation, Regulations, Codes of Conduct and Public Commitments Overseen by FCAC Under the code, the question isn’t whether you were negligent in some vague sense. It’s whether you “contributed to unauthorized use” of your card. If you didn’t contribute, the bank eats the loss. If you did, you eat it.2Financial Consumer Agency of Canada. Canadian Code of Practice for Consumer Debit Card Services
Contributing means one of two things. The first is voluntarily disclosing your PIN. That covers writing your PIN on the card, keeping a poorly disguised record of it near your card, or picking a PIN based on obvious personal information like your date of birth, phone number, or social insurance number. The second is failing to report promptly once you know your card is lost, stolen, or compromised.
The code is specific about what “voluntary” means. If someone gets your PIN through coercion, trickery, force, or by watching over your shoulder at a terminal, that’s not voluntary disclosure, and you keep your protection. Using the same PIN across multiple cards is also explicitly fine under the code.2Financial Consumer Agency of Canada. Canadian Code of Practice for Consumer Debit Card Services
Poorly Disguised PIN Records
Many fraud disputes turn on this point. A record is poorly disguised if it sits in the same wallet, purse, or bag as your card with no real attempt at concealment. A four-digit sticky note next to the card is the classic example the bank will use to deny your claim. A record is reasonably disguised if the digits are rearranged, mixed with substitute symbols, or embedded in a longer string so the number reads as something else. The standard is what a reasonable cardholder would consider adequate, not what a determined thief could ultimately crack.2Financial Consumer Agency of Canada. Canadian Code of Practice for Consumer Debit Card Services
Interac’s Zero Liability Language
On top of the code, Interac promotes a Zero Liability Policy for its debit network. Under that policy, your bank may reimburse you when the fraud was beyond your reasonable control and you’ve followed your client agreement.3Interac. Protect Your Payments The word “may” matters. Zero liability isn’t automatic, and the same questions decide the outcome: did you protect your PIN, did you report quickly, and did you follow the security terms your bank set out.
E-Transfer Fraud and Autodeposit
Interac e-Transfers fail differently than card transactions. The typical attack is interception: a fraudster guesses or steals the security question and answer and claims the transfer before your intended recipient does. If that happens, your bank will look at whether your security question was too easy to guess or whether you sent the answer through the same email or text as the transfer notification.
The strongest defense is Autodeposit. When a recipient enables it, incoming e-Transfers land directly in the bank account with no security question involved, so there’s nothing for a fraudster to intercept.4Interac. Safely Receive Money With Interac e-Transfer Autodeposit Turning it on eliminates the most exploited weakness in the system.
Reporting the Fraud
Call your bank as soon as you spot anything you didn’t authorize. Most banks run 24-hour fraud lines, and many let you flag transactions inside their mobile app. For deposit accounts like chequing or savings, the FCAC says you generally have 30 days from your statement date to dispute a transaction, though your specific account agreement may set a shorter window.5Financial Consumer Agency of Canada. Resolving an Unauthorized Transaction Don’t assume you have time.
Before you call, pull together the dates and dollar amounts of each unauthorized transaction, the merchant names and locations from your statement, and confirmation of whether your physical card is still with you. Banks will ask you to categorize the incident — a stolen card, a duplicated card, an intercepted e-transfer — and a clear written timeline helps the investigator move faster.
Police and the Canadian Anti-Fraud Centre
Your bank handles the money. Fraud is also a crime. The FCAC recommends contacting your local police service and keeping any documents that could support an investigation.6Financial Consumer Agency of Canada. Debit Card Fraud File a report with the Canadian Anti-Fraud Centre as well, through the National Fraud Reporting System run jointly by the RCMP and the CAFC. Your report feeds a central database that helps law enforcement connect incidents and track patterns.7Canadian Anti-Fraud Centre. Report Fraud and Cybercrime A police report also helps your bank claim by showing you acted seriously and quickly.
What the Bank’s Investigation Looks Like
Once your report is in, the bank opens an internal investigation, pulling system logs, merchant data, and the details you provided. Timelines vary. Some banks issue a temporary credit while the review is underway; some don’t. You’ll get the final decision in writing, and if the claim is denied, the bank should explain the evidence behind that outcome.
Keep watching your statements while the review is open and report any new unauthorized activity right away. The bank may freeze the card and issue new credentials. Document every interaction, including names and dates, in case you need to escalate.6Financial Consumer Agency of Canada. Debit Card Fraud
Escalating to the Ombudsman
If your bank denies the claim or offers a resolution you don’t accept, the Ombudsman for Banking Services and Investments (OBSI) provides independent review. Since November 1, 2024, OBSI is the sole external complaints body for all Canadian banks.8Ombudsman for Banking Services and Investments. Single ECB Transition FAQs
You can go to OBSI once you have a final response letter from the bank, or once 56 days have passed since you first complained in writing without a resolution. On your side, there’s a hard deadline: you must bring the complaint to OBSI within 180 calendar days of the bank’s final written response. Miss it and OBSI treats the complaint as out of mandate.9Ombudsman for Banking Services and Investments. FAQs
One limitation to know upfront: OBSI’s recommendations are not legally binding. It investigates, decides what should have happened, and recommends compensation, but a bank can reject the recommendation or pay less. OBSI publicly names firms that refuse to follow its recommendations, and that reputational cost is what gives the process most of its weight.
Compensation for the Bank’s Own Mishandling
OBSI can also recommend compensation for what it calls Extraordinary Distress and Inconvenience (EDI) when the bank’s handling of your case, not the fraud itself, causes unreasonable hardship.10Ombudsman for Banking Services and Investments. Extraordinary Distress and Inconvenience Situations that can support an EDI recommendation include poor complaint handling such as losing your file or bouncing you between departments, unreasonable delays with no communication, privacy breaches during the investigation, and compounding errors like freezing the wrong account.
The test is whether a reasonable person in your position would find the experience extraordinary rather than merely frustrating. Ordinary complaint-process stress doesn’t qualify, and OBSI does not assess health-related harm like anxiety or sleep loss. What it looks at is whether the bank fell short of its obligations and that failure produced objectively unreasonable distress.10Ombudsman for Banking Services and Investments. Extraordinary Distress and Inconvenience