Most Canadians assume their bank will make them whole if money vanishes from their account. That assumption is broadly right for a credit card, mostly right for a debit card, and wrong for an e-Transfer or a wire. This is not a theory or a reading of the fine print. It is the Government of Canada's own description of the current law, published in the Canada Gazette on 27 June 2026 in support of new regulations designed to close the gap.
The short answer
Today, a bank may hold you fully liable for a fraudulent Interac e-Transfer, wire transfer or global money transfer sent from your account by someone who got into it. The only fraud protection written into federal banking law is for credit cards. Debit cards are covered by a voluntary industry code that most banks have signed. Everything else sits outside both.
That changes on 1 July 2027. Proposed regulations published on 27 June 2026 will require banks to get your express consent before they turn these transfer capabilities on, to let you turn them off, and to act on your requests to change your transaction limits within set timeframes.
The catch: banks will not have to ask for consent on capabilities that are already switched on when the rules take effect. If you have an account today, the new rules will not disable anything for you. You have to ask.
The gap, in the government's own words
The Regulatory Impact Analysis Statement published alongside the proposed regulations sets out the current state of the law bluntly. It says that under the current financial sector legislative framework, the sole fraud-related consumer protection requirement for banks relates to unauthorized credit card transactions. It then says this:
"Banks may hold consumers fully liable for all other fraudulent transactions made from their account, including unauthorized Interac e-Transfers, wire transfers, and global money transfers made by a fraudster who has gained access to their account."
Regulatory Impact Analysis Statement, Regulations Amending the Financial Consumer Protection Framework Regulations, Canada Gazette, Part I, Volume 160, Number 26, 27 June 2026.
That is the government describing its own rules in order to justify changing them. It is the clearest statement on this subject that exists in Canadian consumer finance, and almost nobody has repeated it to consumers.
The same document also explains why the exposure is larger than people assume. It notes that bank-offered personal deposit accounts often have default features, such as wire and international money transfer, which permit online banking transactions with values as high as $50,000, and that many consumers do not need those features and may not be fully aware they are available on their account at all.
What is actually protected, and what is not
| Payment method | What protects you today | How strong is it |
|---|---|---|
| Credit card | Bank Act framework: your liability for an unauthorized transaction is capped at $50, unless you were grossly negligent in protecting your card, account information or personal authentication information | Legislated. In practice the RIAS notes all major credit card issuers offer zero liability, which goes beyond the $50 cap |
| Debit card | The Canadian Code of Practice for Consumer Debit Card Services, which requires that consumers not be held liable for losses resulting from circumstances beyond their control, including fraud, theft, or coercion by trickery, force or intimidation | Voluntary. The RIAS says most banks have signed on to it. It is a code, not a statute |
| Interac e-Transfer | Nothing in federal banking law that limits your liability | None as a legal right. Whether you get your money back is the bank's decision, subject to complaint and ombudsman review |
| Wire transfer | Nothing in federal banking law that limits your liability | None as a legal right, and this is the method with the highest default limits |
| Global money transfer | Nothing in federal banking law that limits your liability | None as a legal right |
One protection does apply across cards and is worth knowing about, because banks sometimes forget it. FCAC Bulletin B-6 tells federally regulated financial institutions that they must take all relevant factors into account before finding a consumer liable for an unauthorized credit or debit card transaction, that they must investigate whether circumstances beyond the cardholder's control were involved, and that they must not rely solely on authentication technologies to shorten or skip that investigation. The bulletin states directly that a finding of liability cannot be based solely on the fact that a transaction was completed with the correct chip and PIN combination. If a bank tells you the transaction used your PIN so the file is closed, that is not a sufficient investigation under FCAC's stated expectations.
Your account probably has capabilities you never asked for
The reason this matters is that account takeover is fast. A fraudster who gets into online banking does not need to guess what your account can do. Wire and international transfer capability is commonly enabled by default, with limits up to $50,000 according to the government's own analysis. The proposed regulations exist precisely because turning those off makes an account a much less useful target.
The scale of the underlying problem, from the same documents: Canadians reported losses of $704 million to the Canadian Anti-Fraud Centre in 2025, which the Regulatory Impact Analysis Statement describes as a nearly 300 per cent increase over reported losses in 2020. The Department of Finance news release accompanying the regulations put reported losses since 2022 at more than $2.4 billion. Both documents note that the Canadian Anti-Fraud Centre estimates only 5 to 10 per cent of fraud is reported at all, so the real figures are larger and unknown.
What changes on 1 July 2027
The proposed Regulations Amending the Financial Consumer Protection Framework Regulations come into force on 1 July 2027. They operationalize amendments to the Bank Act that were passed through the Budget Implementation Act, 2025, No. 1, and the stated intention is for those legislative amendments to come into force on the same day. Here is what banks will be required to do.
1. Ask before switching transfer capability on
A bank will have to obtain your express consent before enabling electronic funds transfer capability on a personal deposit account, including wire transfers, global money transfers and Interac e-Transfers, and only after telling you the nature and potential uses of those capabilities.
2. Let you switch it off
Banks will have to allow you to disable those same electronic funds transfer capabilities. This is the provision that matters most. It turns a request the bank can currently refuse into a right.
3. Act on limit increases on a clock, and only on a clock
A request to increase a transaction limit must take effect without delay if the institution has verified that the person making the request is the account holder, or within one business day after the day the request is made if it has not. The stated purpose of the delay is to frustrate a fraudster who has gained access to an account and immediately tries to raise the limit.
4. Have written procedures for suspicious activity
Banks will need policies and procedures for how they investigate suspicious transactions, and for notifying consumers of suspicious requests to enable capabilities or increase transaction limits.
5. Tell you at account opening
Banks will have to disclose, when you open the account, that certain capabilities require your express consent to enable, that they can be disabled, and that transaction limits can be adjusted.
6. Report the fraud data they currently keep to themselves
Banks will have to collect and report prescribed fraud data to the Financial Consumer Agency of Canada, including the scheme type and the transaction method used to defraud the consumer. FCAC compiles it and reports to the Minister of Finance. The regulations set the first report to the Commissioner as due by 15 May 2029, covering the period from 1 January 2028 to 31 December 2028. Public national fraud data reported by banks rather than by victims is genuinely new.
The government's cost benefit analysis puts the discounted benefits of these measures at $2.9 billion against discounted costs of $611 million over the ten years following registration, a net benefit of $2.3 billion, discounted to 2027 at 7 per cent and expressed in 2026 dollars. It states that all of the monetized benefits would be borne by consumers.
Consultation status, checked 5 August 2026. These regulations were pre-published for a 30 day comment period on 27 June 2026, which means the window closed on or about 27 July 2026. Comments went to the Department of Finance at consumer.consommateur@fin.gc.ca. The regulations are proposed, not final. Final text is published in the Canada Gazette, Part II, and the coming into force date could move. The separate Consumer-Driven Banking Regulations published on the same day are still open for comment until late August 2026, and we cover those in our open banking guide.
The catch that will affect almost everyone reading this
The proposed regulations say banks would not be required to obtain express consent for capabilities that are already enabled on existing accounts when the rules come into force. The government's own cost analysis states that consumers who opened an account before the coming into force date would not incur the cost of enabling a capability unless they choose to disable one first.
Read that plainly: if you have a bank account today, nothing will be switched off for you in July 2027. The consent requirement applies to accounts opened after that date. What you gain is the right to ask, and a bank that has to say yes. If you want the exposure reduced before then, you have to raise it yourself, and you have to raise it again after the rules land.
What to do this week
None of this is a legal right yet, so treat it as a request rather than a demand until July 2027. In our experience of how these calls go, banks handle limit reductions far more readily than capability removals, because reducing a limit is a standard setting in most online banking systems.
- Find your current transfer limits. They are usually under a settings, security or transfer limits area in online banking, and they are often much higher than anything you have ever sent. Note the daily, weekly and monthly limits separately.
- Lower every limit to what you actually use. If your largest e-Transfer in five years was $600, a $3,000 daily limit is pure downside. You can raise it temporarily when you need to, and after July 2027 the bank has to action a verified increase without delay.
- Ask what wire and international transfer capability is enabled on your account, and ask for it to be removed if you never use it. Use those words. Many people have never sent a wire in their life and are carrying a five figure default capability because of it.
- Turn on transaction alerts for every outbound movement, not just low balance. Federally regulated banks already have to send you an electronic alert when your balance falls below a threshold, $100 by default, but you can usually add alerts for outgoing transfers, which is what actually catches a takeover in progress.
- Do not keep your emergency savings in the account your card and your transfers touch. This one is free and it is the single largest reduction in exposure available to you. A fraudster can only send what is reachable.
- Use a unique password and app based two factor authentication for online banking. Text message codes are the weakest common form because they can be intercepted through a SIM swap.
A fraudster can only send what is reachable from the account they got into
Nothing here requires a new account. The largest reduction in exposure available to you is structural: keep the account your card and your transfers touch small, and keep the money you are not spending this month somewhere separate. If you want a second everyday account for that, KOHO is a Canadian no fee prepaid Mastercard account that takes direct deposit and e-Transfer and pushes a notification on every transaction, which is what actually catches an unauthorized movement early. Be clear about what it is not: it is not a bank, deposits are held differently than at a chartered bank, it carries no special legal protection against unauthorized transfers that a bank account does not have, and paid plans exist alongside the free one. Read the current plan terms on the provider's own page before you sign up.
See how the account worksGet the free Canadian Banking Rights Playbook
The plain English version of the rules banks would rather you skimmed: what they can take, what they must tell you, the fee caps that came into force in 2026, and the exact complaint path with the deadlines that apply. One file, no fluff.
If it already happened
Speed matters more than anything else here, because banks can sometimes stop or recall a transfer that has not been claimed yet, and cannot do anything once the money is gone from the receiving account.
- Call the bank immediately and ask them to attempt a recall or stop. Do it before you do anything else, including writing anything down.
- Put it in writing the same day. Email or the bank's secure message system. Include the date and time you noticed, the transactions, the amounts, and the fact that you did not authorize them. The written date starts the clock on the complaint process.
- Change your online banking password and revoke any app that has your banking credentials. If you gave a budgeting app your bank login, that is a live copy of your credentials sitting somewhere else.
- Report to the Canadian Anti-Fraud Centre. It will not recover your money, but the reporting gap is exactly why these rules were slow to arrive.
- Escalate through the bank's internal complaint process if you are refused. A federally regulated bank has to provide a detailed written response, and you can take the complaint to the external ombudsman once 56 days have passed since you first complained or once you have that final response, whichever comes first. Our guide to the Canadian bank complaint process sets out the steps and the deadlines.
- If it involved a card, cite FCAC Bulletin B-6 in the complaint. A refusal that rests only on the fact that the correct PIN was used does not meet FCAC's published expectation of a comprehensive investigation.
The harder case: you sent it yourself
There is a second category the documents call out, and it is the one with the least protection of all. If you authorized the payment because you were deceived or coerced, the money is gone as a matter of law even though you were the victim of a crime. The Regulatory Impact Analysis Statement names three patterns specifically:
- Romance scams, where the fraudster builds an emotional connection over time and then asks for money.
- Investment scams, where the fraudster solicits funds for a false or deceptive investment opportunity.
- Merchandise and online marketplace scams, where a false advertisement gets you to send payment for something that never arrives.
The government describes these as consumer-targeted fraud and includes them in the problem the new rules are meant to address, but the July 2027 regulations do not create a reimbursement right for them. They make the account harder to drain and force better data collection. Nothing in Canadian law currently requires a bank to refund a payment you were tricked into authorizing. That is worth knowing before you send money to anyone you have not met, because the safety net you are imagining is not there.
One useful consequence of lowering your limits: it applies here too. A limit you set when you were calm is a check on a decision made when you are being pressured, and every one of these scams runs on urgency.
Common questions
It might, and many do as a matter of goodwill or policy, but it is not currently a legal right. The Government of Canada's own Regulatory Impact Analysis Statement published on 27 June 2026 states that banks may hold consumers fully liable for fraudulent transactions other than credit card transactions, including unauthorized Interac e-Transfers, wire transfers and global money transfers made by a fraudster who has gained access to the account. If your bank refuses, your route is its internal complaint process and then the external banking ombudsman, not a statutory liability cap.
Yes, though the protection is voluntary rather than legislated. Most banks have signed the Canadian Code of Practice for Consumer Debit Card Services, which requires that consumers not be held liable for losses resulting from circumstances beyond their reasonable control, including being a victim of fraud or theft or being coerced by trickery, force or intimidation. There is no equivalent code for e-Transfers or wires.
You can ask, and many banks will do it or will reduce the limit to zero, but until 1 July 2027 they are not required to. The proposed Regulations Amending the Financial Consumer Protection Framework Regulations, published in the Canada Gazette on 27 June 2026, will require banks to allow consumers to disable wire transfers, global money transfers and Interac e-Transfers from that date. Lowering a transfer limit is usually available today in online banking without calling anyone.
No. The proposed regulations expressly do not require banks to obtain express consent for capabilities that are already enabled on existing accounts when the rules come into force. The consent requirement bites on accounts opened after that date. If you already have an account, the change gives you the right to ask for a capability to be switched off. It does not switch anything off for you.
Higher than most people expect. The government's Regulatory Impact Analysis Statement says bank-offered personal deposit accounts often have default features, such as wire and international money transfer, which permit online banking transactions with values as high as $50,000. Interac e-Transfer limits are set by each institution and are typically much lower, but are still commonly in the low thousands per day. Check your own account rather than relying on a general figure, because the limits differ by bank and by account type.
For a card transaction, FCAC Bulletin B-6 states that federally regulated financial institutions must take all relevant factors into account before finding a consumer liable, must investigate whether circumstances beyond the cardholder's control were involved, and must not rely solely on authentication technologies to shorten or eliminate that investigation. It says directly that liability cannot be based solely on a transaction being completed with the correct chip and PIN combination. Quote the bulletin by name in your written complaint. For an e-Transfer there is no equivalent bulletin, so the argument has to be made on the facts of how the access happened.
Usually not. A payment you authorized, even under deception or coercion, is treated differently from one a fraudster made without you. The proposed 2027 regulations name romance scams, investment scams and marketplace scams as consumer-targeted fraud, but they do not create a reimbursement right for them. They make accounts harder to drain and require banks to report the data. Ask anyway, and use the complaint process, because bank policies are more generous than the legal minimum, but do not plan around a refund.
Related guides
- Open banking in Canada, and the rules that end password sharing
- Am I liable if my credit card is used fraudulently in Canada
- Debit card fraud in Canada and the liability code most banks signed
- How a bank complaint actually works in Canada, and the 56 day rule
- Why a Canadian bank account gets frozen, and how to get access back
- NSF fees in Canada are capped at $10: the 2026 rules
- How Interac e-Transfer works in Canada
Disclosure: Some links on this page are referral links, and Bremo may earn a commission if you open an account, at no cost to you. This does not change what we recommend. Sources, all read on 5 August 2026: the Regulatory Impact Analysis Statement and the proposed regulatory text for the Regulations Amending the Financial Consumer Protection Framework Regulations, Canada Gazette, Part I, Volume 160, Number 26, published 27 June 2026, for the current liability position, the $50 credit card cap and industry zero liability practice, the Canadian Code of Practice for Consumer Debit Card Services, the $50,000 default wire and international transfer capability, the six proposed bank duties, the without delay and one business day limit change rules, the express consent exemption for capabilities already enabled, the 1 July 2027 coming into force date, the 15 May 2029 first reporting deadline for the 2028 calendar year, the $704 million in 2025 reported losses and the nearly 300 per cent increase over 2020, the 5 to 10 per cent reporting estimate, the named scam patterns, and the $2.9 billion benefit, $611 million cost and $2.3 billion net benefit figures; the Department of Finance Canada news release "Government pre-publishes regulations to prevent fraud and facilitate the next phase of consumer-driven banking", dated 26 June 2026, for the reported losses since 2022 exceeding $2.4 billion and the Bill C-15 amendments; and Financial Consumer Agency of Canada Bulletin B-6, "Investigations of unauthorized credit and debit card transactions", for the investigation expectations and the chip and PIN statement. These regulations are proposed and not yet law, and the coming into force date could change when the final text is published in the Canada Gazette, Part II. Confirm the current position with your own institution before you rely on it. This is educational general information, not legal or financial advice.