Finding a charge you did not make is a jolt, and the fear that follows is almost always bigger than the actual exposure. People picture being on the hook for the whole amount a thief ran up. In Canada that is not how it works. There is a legal ceiling on what you can owe for an unauthorized credit card transaction, the major networks layer their own protection on top, and the bank has to investigate before it can pin anything on you. This page lays out exactly what you owe, the single thing that can change the answer, and the steps that keep you fully protected.
The short answer
Your maximum liability, by law, is $50. For an unauthorized transaction on a credit card, you cannot be held responsible for more than $50, unless you demonstrated gross negligence in protecting your card and your PIN or passwords. Your card agreement must spell this out.
In practice you usually pay nothing. Visa, Mastercard, American Express and Interac all carry zero liability commitments. If you took reasonable care and reported the fraud promptly, you generally will not be held responsible at all. Report it to your issuer immediately, change your passwords and PINs, and let the investigation run.
The whole game is staying on the right side of one line: reasonable care. Do that, and the $50 is usually the theoretical ceiling rather than a bill you actually pay. Fail to protect your PIN, and the protections can fall away.
The $50 legal cap, precisely
Here is the rule as it actually reads, because the details decide close cases.
- When an unauthorized transaction is made with your credit card, your maximum liability by law cannot be more than $50, unless you demonstrated gross negligence, which in Quebec is called gross fault.
- This applies to safeguarding both your credit card and its account information, and your personal authentication information, which includes your PIN, passwords, or other information used to verify your identity.
- Your credit card agreement must explain your maximum liability if your card is used without your permission. If you are unsure, that agreement is where the exact figure lives.
- If a federally regulated financial institution other than a bank issued your card, your maximum is the lesser of $50 or the maximum set by your card agreement. In other words, it can be lower than $50, never higher.
On top of that legal cap sit the network commitments. Visa, Mastercard, American Express and Interac have publicly committed to protect you against financial loss when your card is used without your permission. Under those commitments, provided you took reasonable care, you generally will not be held responsible for the unauthorized transactions at all. That is why most cardholders who report fraud promptly end up paying zero, not even the $50.
| Your situation | Your maximum liability |
|---|---|
| Bank-issued credit card, you took reasonable care | $50 by law, and usually $0 under network zero liability |
| Non-bank federally regulated issuer, reasonable care | The lesser of $50 or your agreement's stated maximum |
| You were grossly negligent with your card or PIN | The cap and zero liability can fall away; you may owe more |
The gross-negligence catch
The $50 cap and the zero liability protection are conditional. They can disappear if you were grossly negligent, meaning you did not take reasonable care of your card and your authentication information. This is the one part worth taking seriously, because it is the only thing standing between you and full protection.
- Never write your PIN on the card or keep a written PIN near the card.
- Never share your PIN with anyone, including a family member. If you share it, you may be responsible for transactions you did not personally make.
- Report a lost or stolen card right away. If you do not report it within the time your agreement requires, you can be held responsible.
- Choose a PIN that is hard to guess. Avoid your date of birth, phone number, address or Social Insurance Number, and use different PINs for different cards.
- Cooperate with the investigation. Refusing to help can also count against you.
Your right to a real investigation
You do not have to prove your own innocence, and the bank cannot take a shortcut to blaming you. The rules are specific about this.
- A federally regulated financial institution cannot hold you responsible for a transaction just because someone used an authentication technology, such as your PIN or a password, to complete it.
- It must always fully investigate a transaction you dispute, no matter how it was processed, whether by PIN, magnetic swipe, or other technology.
- It must consider all the circumstances that contributed to the unauthorized use, including ones beyond your control: someone forced you, someone stole your card, a system malfunctioned, or someone got your PIN or password by shoulder surfing, meaning looking over your shoulder as you entered it.
What to do the moment you spot it
Step 1: Notify your card issuer without delay
Contact your issuer the moment you notice an unauthorized or suspicious transaction, or if your card or a mobile device you use for banking is lost or stolen. Reporting without delay is a condition of full reimbursement, so this comes first, ahead of everything else.
Step 2: Change your passwords and PINs
Change your online banking password and your card PIN immediately, and report every transaction you did not make or approve. If your authentication information may be exposed, closing that door stops further damage.
Step 3: Check your credit report and keep monitoring
Look at your credit report for any credit you did not apply for or other suspicious activity, and keep watching your account after you report the fraud. A single fraudulent charge is often the first sign, not the last.
Step 4: Cooperate with the investigation
Give your issuer the information it asks for and keep a record of who you spoke to and when. Cooperating protects your claim; refusing to help is one of the things that can shift liability onto you.
See a charge you did not make the day it happens
The reporting window is the whole game, and it is easiest to hit when you find the fraud immediately rather than a month later on a statement. The simplest defence is a real-time notification on every transaction, so anything you did not authorize pings your phone the moment it posts. KOHO is a Canadian no-fee prepaid Mastercard account that sends a notification on every single transaction by default, which is a clean way to keep tight visibility on your day-to-day spending. It is a prepaid spending account, not a full chequing or credit replacement, so use it as one closely-watched account alongside the rest. Check current plan features and any fees on the provider's own page before signing up.
See how the account worksFraud versus a billing dispute: not the same thing
The $50 cap and zero liability are specifically for unauthorized transactions, charges you never made or approved. A charge you or a service you signed up for set in motion, that then went wrong, is a different animal called a billing dispute, and it follows a different path.
| What happened | What it is | Where to start |
|---|---|---|
| A charge you never made and do not recognize | Unauthorized transaction (fraud) | Call your issuer immediately, this page |
| Wrong amount, or charged twice | Billing dispute | Contact the merchant first, then dispute |
| A subscription keeps charging after you cancelled | Dispute, plus a cancellation | Cancel with the merchant, then dispute |
| Paid but never received the goods or service | Dispute | Merchant first, then dispute |
Only the first row uses the fraud rules on this page. For the others, contacting the merchant first is normally a condition of filing, and your issuer reverses the charge through a chargeback if it qualifies. The full process is in our guide to disputing a credit card charge in Canada, including the cancelled subscription that will not die.
Get the free Credit Building Playbook
A plain English plan for building a Canadian credit file from zero or rebuilding a bruised one, including which products report to which bureau and what order to do things in. One file, no fluff.
Five things to take away
- Your legal maximum is $50, and with network zero liability you usually pay nothing at all.
- Gross negligence is the only real risk. Protect your PIN, never share it, and report a lost card fast.
- A non-bank issuer can be lower. Your maximum is the lesser of $50 or your agreement's stated figure.
- You are entitled to an investigation. The bank cannot blame you just because your PIN was used.
- Report immediately. The deadline comes from your card agreement, so speed protects both your money and your rights.
Frequently asked questions
By law, your maximum liability for an unauthorized credit card transaction cannot be more than $50, unless you demonstrated gross negligence in safeguarding your card and your PIN or passwords. Your credit card agreement must explain your maximum liability. On top of the legal cap, Visa, Mastercard, American Express and Interac have public zero liability commitments, so in practice, if you took reasonable care and reported promptly, you usually will not be held responsible at all.
Gross negligence, called gross fault in Quebec, means you failed to take reasonable care to protect your card and your personal authentication information such as your PIN and passwords. Examples that can void your protection include writing your PIN on the card, sharing your PIN with someone, or not reporting a lost or stolen card within the time your agreement requires. If any of that applies, the $50 cap and the network zero liability can fall away and you can be held responsible for more.
If a federally regulated financial institution other than a bank issued your credit card, your maximum liability is the lesser of $50 or the maximum amount set by your credit card agreement. So it can be lower than $50, never more, as long as you were not grossly negligent. Read your agreement, which must state your maximum liability if the card is used without your permission.
No. A federally regulated financial institution must always fully investigate a transaction you dispute, and it cannot hold you responsible just because someone used your PIN or other authentication technology to complete it. It must consider all the circumstances, including ones beyond your control such as being forced, a stolen card, a system malfunction, or shoulder surfing. Report it, cooperate with the investigation, and let them do the work.
Report it immediately. Your card agreement may require you to report an unauthorized transaction within a specific time, and if you do not, you may be held responsible and may not get the money back. There is no single friendly national deadline, so notify your issuer the moment you spot a charge you did not make, change your passwords and PINs, and keep monitoring your account and your credit report afterward.
Fraud is a charge you never made or approved, an unauthorized transaction, and it is covered by the $50 liability cap and the network zero liability commitments. A billing dispute is a charge you or a service you signed up for set in motion that went wrong, such as a wrong amount, a double charge, goods not received, or a subscription that keeps billing after you cancelled. Those are handled through the chargeback and dispute process, where you contact the merchant first. The starting move is different, so be clear which one you have.
Related guides
- Someone used my debit card: am I liable and can I get my money back?
- How to dispute a credit card charge in Canada
- How credit card fraud protection works in Canada
- How to stop or reverse a pre-authorized debit in Canada
- A bank refused to open your account: your rights and the complaint path
- Hard credit check vs soft credit check in Canada
Disclosure: Some links on this page are referral links, and Bremo may earn a commission if you open an account, at no cost to you. This does not change what we recommend. The rules and figures on this page were verified on 23 July 2026 against the Financial Consumer Agency of Canada pages "Unauthorized credit and debit transactions: know your rights and responsibilities" (dated 15 October 2025), "Resolving an unauthorized transaction" (dated 2 September 2025), and "Credit card fraud" (dated 1 December 2025). Your exact maximum liability and any reporting deadline are set by your card agreement and the Visa, Mastercard, American Express or Interac network rules, which vary by issuer and card, so confirm the details with your own issuer. This page is educational general information, not legal or financial advice.