Debit card fraud has a particular kind of panic to it, because the money is not a pending charge you can argue about later. It is already gone from your chequing account. Rent, groceries, a bill that is about to bounce, all sitting behind a balance a stranger just drained. The good news is that Canadian rules protect you in most of these situations, and if you took reasonable care of your PIN you should get the money back. The important news is that there is a short list of things that can flip the liability onto you, and one detail about linked accounts that can make the loss much bigger than you would expect.
This page lays out who is actually responsible, how much you can be on the hook for, and the exact steps to recover the money. It is about your own debit card and the bank account behind it. If the problem is a charge on a credit card instead, the rules are similar but not identical, and there is a link to that guide below.
The short answer
In most cases you will not be held responsible for a debit transaction you did not authorize, as long as you took reasonable care to protect your PIN and you report the problem without delay. You are not liable for losses that are beyond your control, and Interac, Visa and Mastercard all carry zero liability commitments. Report it to your financial institution the moment you notice it, and they must investigate before they can find you at fault.
The catch: your protection can fall away if you contributed to the loss, for example by using an easy-to-guess PIN, sharing your PIN, or not reporting a lost card in time. And because a debit card can reach a linked line of credit or overdraft, the loss can be larger than the cash sitting in the account.
Two things to do in the first five minutes, before anything else: change your PIN and any online banking password, and phone your financial institution to report the transactions you did not make. Everything else follows from those two steps.
How much you can actually lose
This is the part most people get wrong, and it is worth being precise about. With debit fraud, the exposure is not a tidy $50 cap the way it is with a credit card. It is tied to what a thief can physically reach.
- The maximum you are responsible for usually cannot be more than the withdrawal limits of your debit card. Those daily limits exist partly to contain exactly this kind of loss.
- However, you may be responsible for more than the balance of your account. That happens when your account links to a line of credit or overdraft protection, or links to one or more other accounts, because the person who has your card and PIN can pull from that money too.
When the bank has to cover you
You are protected when you use debit card services in store at a point-of-sale terminal, at an ATM, and online. You are not responsible for losses that result from circumstances beyond your control. The Financial Consumer Agency of Canada gives these examples of losses you are not on the hook for:
- A technical problem, for example an ATM that does not give you the full amount of cash you asked for but still deducts it from your account.
- An unauthorized transaction, as long as you did not contribute to the loss by failing to protect your PIN.
- Someone forced you to use your card.
- Shoulder surfing, where someone got your PIN by looking over your shoulder while you entered it at an ATM or terminal.
On top of that, Interac, Visa, Mastercard and American Express have public commitments to protect you against financial loss if your card is used without your permission. Under those commitments, if you took reasonable care, you generally will not be held responsible at all. And a federally regulated institution cannot hold you responsible for a transaction just because it was completed with your PIN or other authentication technology. It must fully investigate and weigh every circumstance first.
When it can become your fault
This is the short list that matters, because it is the difference between a full refund and eating the loss. You could be held responsible for losses if you contributed to or encouraged the unauthorized use of your card. The specific examples from FCAC are:
- You used your date of birth or telephone number as your PIN.
- You shared your PIN with someone, even a family member.
- You kept a written record of the PIN close to the card, or wrote your PIN on the card itself.
- You did not report a lost or stolen card within the time your card agreement specifies.
- You refused to cooperate with the investigation of the unauthorized use.
- You made fraudulent deposits with your card.
- You otherwise did not take the necessary steps to protect your PIN.
The steps to get your money back
Step 1: Change your PIN and passwords immediately
The moment you suspect fraud, change your card PIN and your online banking password. If you think someone knows your PIN, changing it stops further withdrawals while everything else gets sorted out.
Step 2: Report every unauthorized transaction to your institution, without delay
Contact your financial institution right away. Report any transaction you did not make or approve, and tell them if your card was lost or stolen, or if a mobile device you use for banking is gone. Reporting without delay is a condition of getting a full reimbursement, so do not wait for the next statement.
Step 3: Let the institution investigate
Federally regulated institutions must always investigate a transaction you dispute, and must take all relevant factors into account before finding you at fault, no matter how the transaction was processed. If you protected your PIN and reported promptly, the finding should be in your favour and the money returned. Keep notes of who you spoke to and when.
Step 4: Keep watching your accounts and your credit report
After you report it, keep monitoring your accounts for anything else out of place, and check your credit report for accounts or inquiries you did not make. Fraud is often not a single hit.
See every transaction the second it happens
Debit fraud does the most damage when nobody notices for days. The single best defence is a real-time notification on every transaction, so an unfamiliar withdrawal pings your phone immediately, while the reporting window is wide open and the money is easiest to recover. KOHO is a Canadian no-fee prepaid Mastercard account that sends a notification on every single transaction by default, which makes it a clean way to keep tight eyes on your day-to-day spending money without exposing your main chequing account and its linked overdraft to the same card. It is a prepaid spending account, not a full chequing or credit replacement, so use it as one closely-watched account alongside the rest. Check current plan features and any fees on the provider's own page before signing up.
See how the account worksThe 30-day rule, and why speed matters
There is a reporting window, and missing it is how recoverable money becomes unrecoverable.
- For deposit accounts like chequing and savings, you usually have 30 days after the date of your statement to dispute a transaction. This can differ from one institution to another.
- Your account agreement may also require you to report an unauthorized transaction within a specific time. If you do not, you may be held responsible and may not get the amount back.
- Because debit money leaves your account immediately, waiting also means living without that cash while the case is open. Reporting the same day is both a rights issue and a cash-flow issue.
The practical rule is the same one that prevents most of this: read every statement when it arrives, or better, turn on transaction alerts so an unauthorized withdrawal reaches you the day it happens.
Get the free Credit Building Playbook
A plain English plan for building a Canadian credit file from zero or rebuilding a bruised one, including which products report to which bureau and what order to do things in. One file, no fluff.
If the bank refuses to refund you
Most legitimate debit fraud claims end with the money returned. When one does not, there is a free escalation path.
Step 1: Get the decision and the reason in writing
Ask your institution to put its decision and the reason in writing. If the finding is that you contributed to the loss, ask which specific factor they relied on, so you can respond to it directly with your own evidence.
Step 2: File a formal complaint with the institution
Every federally regulated financial institution must have a complaint-handling procedure, published on its website and available in branch. Put your complaint in writing and keep the file open. The bank must give you a detailed written response within 56 calendar days of when you first complained.
Step 3: Escalate to the banking ombudsman
If the bank has given you its detailed written response and closed the file, or more than 56 days have passed, take the complaint to the Ombudsman for Banking Services and Investments. OBSI is independent and free, and it is the route to an actual remedy. The Financial Consumer Agency of Canada oversees whether banks follow the rules, but it does not resolve individual complaints or get your money back.
The full contact details and timelines are in our guide to your banking rights and the exact complaint path, which walks the same escalation from the bank's own process through to the ombudsman.
Five things to take away
- You are usually covered for debit fraud if you protected your PIN and reported promptly. The bank must investigate before blaming you.
- Your loss can exceed your balance if the card links to a line of credit, overdraft, or other accounts. Lower your daily limit.
- The PIN is everything. An easy-to-guess or shared PIN is the main way a claim becomes your fault.
- Report within the window. Deposit accounts generally give you 30 days after the statement date, and your agreement may be stricter.
- If they say no, escalate. Formal complaint, then OBSI, both free.
Frequently asked questions
Usually yes, if you took reasonable care to protect your PIN and reported the problem promptly. Under Canadian rules you are not responsible for losses that result from circumstances beyond your control, such as a technical problem, someone forcing you, or someone getting your PIN by shoulder surfing. Visa, Mastercard, American Express and Interac also have zero liability commitments. If you protected your PIN and reported it without delay, you should get your money back. The bank must always investigate before finding you at fault.
The maximum you are responsible for usually cannot be more than the withdrawal limits of your debit card. Be careful, though: you can be on the hook for more than the balance of your account if your account is linked to a line of credit or overdraft protection, or linked to other accounts, because a thief can reach that money too. If you took reasonable care of your PIN and reported the fraud promptly, in most cases you will not be held responsible at all.
You could be held responsible if you contributed to the loss. Examples from the Financial Consumer Agency of Canada include using your date of birth or telephone number as your PIN, sharing your PIN with anyone including family, writing your PIN on the card or keeping it near the card, not reporting a lost or stolen card within the time your agreement requires, refusing to cooperate with the investigation, or making fraudulent deposits with your card. Protect your PIN and report promptly and you keep the full protection.
For deposit accounts like chequing and savings, you usually have 30 days after the date of your statement to dispute a transaction, though this can differ from one institution to another, and your account agreement may require you to report within a specific time. If you miss that window you may be held responsible and may not get the money back. Report the moment you notice it rather than waiting for the statement.
The protections are similar but the mechanics differ. With a credit card, the fraudulent charge is money you have not paid yet and your maximum legal liability is capped at $50 unless you were grossly negligent. With a debit card, the money is pulled straight out of your own account, so it is already gone while the bank investigates, and your exposure is tied to your withdrawal limit and any linked line of credit or overdraft rather than a $50 cap. That is why reporting a debit problem fast matters even more.
Ask for the decision in writing and the reason. Every federally regulated financial institution must have a complaint-handling procedure, so file a formal complaint and keep the file open. The bank must give you a detailed written response within 56 calendar days. If that fails or drags on, escalate for free to the Ombudsman for Banking Services and Investments. The Financial Consumer Agency of Canada oversees whether banks follow the rules but does not resolve individual complaints or recover your money.
Related guides
- Am I liable if my credit card is used fraudulently? The $50 cap explained
- How to dispute a credit card charge in Canada
- How to stop or reverse a pre-authorized debit in Canada
- NSF fees in Canada are capped at $10: the 2026 rules
- A bank refused to open your account: your rights and the complaint path
- What a void cheque is and how to get one
Disclosure: Some links on this page are referral links, and Bremo may earn a commission if you open an account, at no cost to you. This does not change what we recommend. The rules and figures on this page were verified on 23 July 2026 against the Financial Consumer Agency of Canada pages "Unauthorized credit and debit transactions: know your rights and responsibilities" (dated 15 October 2025), "Resolving an unauthorized transaction" (dated 2 September 2025), and "Debit card fraud" (dated 1 December 2025). Your exact rights and any reporting deadline are set by your card and account agreements and the Interac, Visa and Mastercard network rules, which vary by institution, so confirm the details with your own financial institution. This page is educational general information, not legal or financial advice.