CANADA · INTERAC · UPDATED SEPTEMBER 29, 2026
Interac e-Transfer scam: check the message, the request and the payment.
Already clicked or lost money? Act now →A fake deposit notice, an intercepted transfer and a request for you to pay need different responses. Start with what happened to the money, rather than the logo in the email.
An unexpected Interac e-Transfer notice needs independent verification. A legitimate transfer without Autodeposit can include a deposit link, so the presence of a button alone does not prove fraud. Verify the sender through a known contact and check with your bank. If you entered banking credentials or money is missing, contact the bank immediately. Autodeposit reduces interception risk; it does not prevent every scam.
Which situation are you in?
A deposit notice is not proof of a deposit
Interac’s guide to sending and receiving transfers explains why this is a difficult message to judge: recipients without Autodeposit can receive a genuine link to deposit funds. A rule that says every deposit link is fake would reject part of the real service.
Use a different test: were you expecting this payment from this person, and can you confirm it independently? A familiar logo, the displayed From address and a screenshot supplied by the sender do not confirm the money is in your account. Do not release goods solely on that evidence.
For a suspicious message, leave its link unused and contact the sender through an existing trusted channel. Interac’s e-Transfer FAQ advises verifying unexpected notifications. You can forward suspected phishing to phishing@interac.ca; account and transaction problems go to your financial institution.
Three mechanisms, three different checks
These distinctions also matter when reporting. Tell the bank whether you entered credentials, approved a payment, or sent a transfer that never reached its intended recipient. “Interac scam” is a useful search term, but it does not tell an investigator which event to examine.
What Autodeposit protects — and what it cannot decide
With Autodeposit, transfers to the registered email address or phone number go to the associated account without a security question. CIBC recommends it to reduce interception risk. Set it up within your own banking service and follow the bank’s registration steps.
If a recipient does not use Autodeposit, use a security answer that cannot be guessed or found publicly. Share it through a separate trusted channel, not in the same email as the transfer information. CIBC’s interception guidance explains why exposed answers matter.
Four checks before your next transfer
Register Autodeposit through your bank
Follow your bank’s setup process for the email address or phone number you use to receive transfers. This removes the security-question step for transfers to that registered identifier.
Protect any security answer you still need
For a recipient without Autodeposit, choose an answer that cannot be guessed or found publicly. Share it using a separate trusted channel, not alongside the transfer information.
Verify the person and payment direction
Before sending or approving a request, check whom you are paying, the amount and whether the bank’s screen says money is leaving your account. Autodeposit is not a check on a seller’s honesty.
Secure your bank and email access
Use the additional authentication your providers offer. Investigate unfamiliar sign-ins and email forwarding rules, and report suspected compromise through your bank’s genuine app or published contact details.
If you already clicked, disclosed information or lost money
If the bank refuses reimbursement
Ask for its decision and reasons in writing, then use its formal complaint process if you disagree. Do not assume every loss is automatically refundable, or that every refusal is final. Whether you authorized a payment, what access was compromised and the account agreement all matter.
The Financial Consumer Agency of Canada explains that it oversees federally regulated institutions’ complaint handling but does not resolve individual claims. Its complaint guidance describes the possible route to an independent review by OBSI. Follow the process for your institution; a provincially regulated credit union may have a different route.
Common questions
Can a real Interac e-Transfer email contain a deposit link?
Yes. Interac describes email or text deposit links for recipients who do not use Autodeposit. That does not make an unexpected link safe. Verify the sender independently and consult your bank through its genuine app or published contact details if uncertain. A copied logo or displayed sender address is not proof.
What is an Interac e-Transfer interception scam?
A criminal can use access to a recipient’s email and a guessed, reused or exposed security answer to divert a transfer that requires that answer. CIBC describes this form of interception. It is different from a fake deposit page that steals credentials or a payment you send to a dishonest seller.
Does Autodeposit stop e-Transfer scams?
Autodeposit sends funds to the registered account without the security-question step, reducing that interception risk. It does not establish that a seller is honest, make an unexpected message genuine, stop you approving a money request, or replace securing your bank and email accounts.
Is Request Money the same as receiving an e-Transfer?
No. Request Money asks you to pay someone. If you approve and complete that payment, money leaves your account. Read the action, recipient and amount in your banking interface; do not approve an outgoing payment because an email calls it a deposit or refund.
Can I cancel or recover an e-Transfer?
The sender should check the transfer’s status through their bank immediately. Cancellation may be available before deposit, subject to the bank’s process. Interac says a deposited transfer cannot be cancelled. Suspected fraud still needs to be reported to the bank for investigation; reimbursement depends on the facts and applicable rules.
Does a fake Interac email mean Interac or my inbox was hacked?
The message alone cannot establish either. Impersonation does not prove a network breach. If you have signs of email-account access or a missing transfer, tell your bank and secure your email account. Avoid drawing conclusions about a breach from the branding on a phishing message.
Sources
Official guidance checked September 29, 2026. Bank procedures and app menus can change; use the current instructions from your own provider.