There are three Interac e-Transfer scams, and each needs a different check. The one you receive: a fake “you’ve received money” message copies Interac’s look and its “Deposit your money” button, then sends you to a counterfeit bank login that steals your password. A genuine notice for a recipient without Autodeposit also carries a deposit link, so the button alone proves nothing either way: confirm the payment with the sender and open your bank’s app yourself. The one that hits when you send: if the recipient isn’t on Autodeposit, the money waits behind a security question, and a fraudster who gets into the recipient’s email and guesses or obtains the answer can divert it, as CIBC describes. And the one that reverses direction: approve a money request and money leaves your account, whatever the message calls it. Autodeposit removes the security-question step; Interac says funds then go directly into your account “without the need for a security question and answer.” It does not make the other two routes safe.
For most people the scam arrives as a single email or text: an Interac e-Transfer notification saying money is waiting, with a “Deposit your money” button. The trouble is that a genuine notice and a fake one can look almost identical, and a familiar logo or displayed sender address is not proof either way. So the useful test is not whether the email looks real, but what is happening to the money. There are three routes, and each needs its own check.
Was Interac "hacked," "compromised," or "exploited"? A scam message is not evidence of it, and the distinction tells you where the fix is
If you searched whether Interac was hacked, your e-Transfer was compromised, or there's an Interac e-Transfer “exploit” going around, here is the plain answer: a scam message is not evidence of a breach. Phishing copies a brand’s logo and wording because that costs nothing, and the interception CIBC describes needs no software exploit at all: it works through a compromised email account and a guessed or obtained security answer. That distinction is the whole point, because it tells you where the fix lives: not in waiting for Interac to “patch” something, but in checking messages through your bank and closing the one step a fraudster can win. That step is the security question, and Autodeposit removes it.
“Did my e-Transfer get doxxed?” A fake “you’ve received an e-Transfer” message on its own does not show that your details were leaked or that anyone knows anything about you; phishing is sent in bulk, and reaching your inbox is not a sign you were chosen. The real exposure is narrower, and worth checking: if a fraudster has gotten into the recipient’s email inbox, they can see a genuine transfer notice and any security answer sent alongside it, which is how CIBC says interception happens. So the move isn’t to panic about being doxxed; it’s to secure the inbox: change the password, turn on two-factor authentication, and check for mail-forwarding rules you never set up.
"Interac Verified," "Interac Debit," "blacklisted": the exact words, decoded
The wave is worded a dozen different ways, and the wording is the weapon: each phrasing is picked to make you react before you check. A few you may have searched, and the plain answer to each:
“Interac Verified” / “verify your account.” Interac’s published rule is that it will never ask for your banking password via email or text. However a message is branded, “Interac,” “Interac Verified,” “verification required,” a demand to “verify,” “confirm” or “reactivate” your account through its own link is a reason to stop: don’t log in through it. Forward it to phishing@interac.ca and, if you want to check, open your bank’s app yourself.
“Interac Debit” fraud. That’s your tap-or-insert card, a different product from e-Transfer. A “your card is blocked, verify now” message is the same pressure wearing a card instead of a transfer, and the message itself is not evidence the card network was hacked. Call the number on the back of your card, watch your statement, and don’t unblock or “verify” a card through a texted link.
“Breached,” “leaked,” “blacklisted.” These words describe a system compromise, and a scam text reaching you is not evidence of one, or that your data leaked. The “leak” worth checking is the email account that receives your transfers, because that is what makes an interception possible.
Why the security question is the weak point
An e-Transfer to someone not on Autodeposit is protected by a single shared secret: the security question and its answer. The system assumes only the right recipient can answer it. But that assumption breaks in ordinary ways. People pick answers that are easy to guess or already public: a pet's name, a street, a favourite team, or, in one case CBC reported, “What is your wife’s name?” They reuse the same answer across many transfers. And if a fraudster has gotten into the recipient's email, the notification and, often, the answer are sitting right there to read. CIBC spells it out: fraudsters intercept transfers “by gaining access to the recipient’s email account and guessing or obtaining the security question answer.” Answer first, and the money is theirs.
Anatomy of an interception, decoded
Interception isn't a hack of Interac or your bank. It's a quiet exploitation of the one step where the money pauses. Naming each move makes the gap visible.
The other two routes: a fake deposit page and a money request
The fake deposit page borrows the bank’s identity. The message offers money; the linked page asks for your bank login. The reassuring part comes first and the dangerous step is presented as routine. Because a real notice can also carry a link, the defence is not to judge the button: confirm the payment with the sender through a contact you already know, and check your account in your bank’s own app.
A money request reverses the direction. Interac’s Request Money feature lets one person ask another to pay them. Approve a request and money leaves your account. A message that calls it a deposit, a refund or a verification step does not change what your bank’s confirmation screen authorizes, so read who is paying whom, and the amount, before you approve anything.
What Autodeposit protects, and what it cannot decide
With Autodeposit, Interac says funds sent to your registered email address or mobile number go directly into your account without a security question and answer, and when you send to someone registered for it, you see their full legal name before you confirm. That removes the interception step. It does not establish that a seller is honest, make an unexpected message genuine, or stop you approving a money request. And once a transfer is deposited, Interac says the sender can’t cancel it; with Autodeposit, that deposit can happen automatically after routine fraud checks.
What to do
An e-Transfer or "deposit" message you're unsure about? Send it to us first.
Paste the message or the link. A real person reads every case and replies within 24 to 48 hours. Free, confidential, no pressure, before you tap anything. Leave out passwords, security answers and full account details.
Common questions about Interac e-Transfer scams
What is an Interac e-Transfer interception scam?
It’s when money you send by e-Transfer is diverted before it reaches the person you meant to pay. When the recipient isn’t on Autodeposit, the transfer waits for them to answer a security question, and the notice reaches them by email or text. CIBC says fraudsters intercept transfers “by gaining access to the recipient’s email account and guessing or obtaining the security question answer,” then divert the money to a different bank account. The recipient simply never receives it.
How do I stop my e-Transfers from being intercepted?
Turn on Autodeposit. Interac says funds sent to your registered email address or mobile number then go directly into your account without the need for a security question and answer, so there is nothing for a fraudster to answer. If you ever send to someone not on Autodeposit, use a security question whose answer can’t be guessed or found online, don’t reuse it across recipients, and never send the answer by email or text; CIBC suggests sharing it by phone.
Will my bank refund an intercepted e-Transfer?
Don’t count on it. Reimbursement depends on the facts, what access was compromised and your account agreement. CBC’s Go Public has documented Canadians refused after interception: a Manitoba man lost $3,000 when a fraudster got into his contractor’s email and correctly answered his security question, and TD said it wasn’t to blame. Report it to your bank the moment you notice, ask for any refusal in writing, and see our Canada guide for the complaint route and the honest odds.
I got an email saying I have an e-Transfer to “click to deposit.” Is it safe?
It may be genuine: Interac says recipients without Autodeposit deposit the money by clicking the link in the email or text notification. It may also be phishing that leads to a fake bank login page. So the link alone settles nothing. If you weren’t expecting the money, confirm it with the sender through a contact you already know, and if you are unsure, check through your bank’s own app instead of logging in through the link. You can forward a suspicious Interac message to phishing@interac.ca.
Was Interac e-Transfer hacked or compromised in 2026?
A scam message cannot tell you that, and it is not evidence of a breach. What people usually mean is phishing and interception: copying Interac’s branding, and guessing or obtaining a transfer’s security answer through a compromised email account. Neither needs a hack of Interac itself. The fix on your side is the same either way: turn on Autodeposit, which removes the security-question step, and check any deposit message through your bank’s own app.
I got a fake e-Transfer email. Does that mean I was doxxed?
Not on its own. Phishing is sent in bulk, and a fake “you’ve received an Interac e-Transfer” notice reaching you does not show that your information was leaked or that the sender knows anything about you. The genuine risk to watch is the email inbox that receives your transfers: if a fraudster has access to it, they can see a real transfer notice and any security answer sent alongside it, which is how interception happens. If you’re worried, secure the inbox: change the password, turn on two-factor authentication, and check for mail-forwarding rules you didn’t create.
I got a message from “Interac,” “Interac Verified,” or asking me to “verify” my account. Is it real?
Treat any “verify,” “confirm,” or “reactivate your account” demand that comes with its own link as a reason to stop, however it’s branded. Interac says it will never ask for your banking password via email or text. Don’t log in through the link; forward the message to phishing@interac.ca and, if you want to check your account, open your bank’s app yourself.
Is “Interac Debit” fraud the same as an e-Transfer scam?
They’re two different Interac products. Interac Debit is the card you tap or insert to pay; Interac e-Transfer is the email and text money-send this page is about. A phishing message about either, including a “your Interac Debit card is blocked, verify now” text, is social engineering, and the message itself is not evidence of a breach of Interac’s network. Don’t act through a link in it: call the number on the back of your card, watch your statement, and ask for a replacement if a charge you didn’t make appears. On the e-Transfer side the weak point is the security question; on the debit side it’s a lost or skimmed card or a phished PIN.
Was my Interac e-Transfer “breached,” “leaked,” or “blacklisted”?
Those words describe a system compromise, and a scam message reaching you is not evidence of one, or that your data leaked. The one real “leak” worth checking is your own email inbox: if someone else can read your mail, they can see a genuine transfer’s notice and any security answer sent with it, and intercept it. So secure the inbox (new password, two-factor authentication, and remove any mail-forwarding rule you didn’t set). Turn on Autodeposit and there’s no security question left to leak in the first place.
Is Request Money the same as receiving an e-Transfer?
No. Request Money asks you to pay someone. If you approve and complete that payment, money leaves your account. Read the action, recipient and amount in your banking app; do not approve an outgoing payment because a message calls it a deposit or refund.
Can I cancel or recover an e-Transfer?
Check the transfer’s status with your bank immediately. Cancellation may be possible before the money is deposited, through the sender’s bank. Interac says a sender can’t cancel a transfer once it is deposited, and with Autodeposit the deposit can happen automatically after routine fraud checks. Suspected fraud still needs to be reported to the bank for investigation; reimbursement depends on the facts.
Sources & further reading
Claims here follow Interac’s own guidance, CIBC’s interception guidance, the Canadian Anti-Fraud Centre, the Financial Consumer Agency of Canada and CBC’s Go Public reporting on e-Transfer reimbursement, rechecked 16 October 2026. Bank procedures and app menus change; use your own provider’s current instructions. The diagram is illustrative, built from that guidance, not a captured real transfer.