CA · 2026 UPDATEMay 27, 2026Reviewed October 9, 202611 min read
Where to report a scam in Canada, and when to escalate a bank complaint.
A national fraud report, a police report and a bank dispute serve different purposes. This guide explains where each belongs, what OBSI can recommend, and how to protect exposed identity information. The CAFC recorded more than $704 million in reported losses in 2025. That figure makes accurate reporting routes matter; it does not tell you whether a particular loss will be refunded.
$704M
CAFC 2025 reported losses (record)
112,000+
CAFC 2025 fraud reports
$351M
CAFC 2025 investment-fraud losses
56 days
Bank-complaint escalation threshold
The short answer
Contact the affected bank or provider immediately, report to your local police, and submit a national report at reportcyberandfraud.canada.ca or through the CAFC on 1-888-495-8501. For unresolved federally regulated bank complaints, OBSI provides a free independent review after the bank's final response or 56 days. Its recommendations are not binding. Refund rights depend on the transaction and applicable protections; reporting does not guarantee recovery.
Correction, October 9, 2026: This guide wrongly called OBSI decisions binding, described Ontario as the first province with credit freezes, and overstated restrictions on genuine CRA contact. It also implied that national reporting automatically reached local police. The corrected guidance below distinguishes these routes and their limits.
What to keep before reporting in Canada. Illustrative evidence-preparation folder with fictional files. It is not an official reporting form and does not imply that a report has been submitted. View the source. Open full-size image.Illustration added 6 October 2026.Read the image explanation
Payment evidence. Keep the amount, date, recipient and transaction reference.
The original approach. Save messages, sender details and the website address.
A clear timeline. Record what happened and when; use the official routes linked in this guide.
"Fraud is a crime that affects more than just your finances and the emotional tolls can linger for victims long after the fraud is uncovered. If you've been targeted, report it. It's the best way to help with the fight against fraudsters and could help someone else from becoming a victim."
— Chris Lynam, Director General of the Canadian Anti-Fraud Centre, in the joint CSA / CAFC / RCMP statement, 13 March 2025. Reporting helps authorities connect incidents; it does not guarantee an investigation or compensation.
The RCMP launched Report Cybercrime and Fraud on November 6, 2025. The CAFC and RCMP National Cybercrime Coordination Centre administer it as a central repository. The launch notice explicitly says it does not replace existing reporting channels: victims should still contact their local police and financial institution.
In November 2024, the Ombudsman for Banking Services and Investments (OBSI) became the sole external complaints body for Canadian banks. Previously, banks could choose between OBSI and a competing ombudsman service. An eligible bank complaint now has the same external review route; provincial credit unions may follow a different process.
A payment you were deceived into sending and a transaction someone else made without your approval can raise different issues. FCAC's unauthorized-transaction guidance explains why the account agreement and investigation matter. Describe the facts accurately instead of treating every scam as an unauthorized payment. OBSI offers external review of eligible unresolved complaints; it cannot order a bank to pay.
The new joint RCMP/CAFC reporting system: what changed in November 2025
The national system helps authorities connect reports across Canada. A local-police report and a provider's fraud complaint remain separate steps; do not assume that submitting one has completed the others.
—Victims and witnesses can report. The portal accepts incidents and suspicious activity, including anonymous reports. Preserve any confirmation and ask the affected provider what further records it needs.
—Phone alternative: 1-888-495-8501. Use the CAFC's published line if you prefer to report by phone.
—Reported losses are not an estimate of all losses. The CAFC's 2025 figures record over 112,000 fraud reports and more than $704 million in losses. An estimate of how many incidents go unreported cannot simply be applied to the loss total to calculate all Canadian losses.
Your bank, your money, and the OBSI escalation path
Report suspected fraud immediately, then follow your institution's complaint process if you dispute its decision. Account terms matter alongside applicable consumer protections. FCAC's bank-complaint guidance gives the escalation timing for federally regulated banks:
1Contact the bank through its genuine app or published number. Explain exactly what happened and keep the case reference, correspondence and disputed transaction records.
2Check your account agreement's reporting deadline. FCAC says deposit accounts usually require disputes within 30 days of the statement date, but the period can differ. Do not wait for that deadline to report.
3Follow the bank's internal complaint process. A federally regulated bank must provide a detailed written response within 56 calendar days from your first complaint.
4You may contact OBSI when the bank closes the complaint with its written response, or once 56 days have passed. File within 180 days after the final written response. You do not have to wait indefinitely for a letter.
5OBSI's review is free and independent, but its recommendations are not binding. FCAC oversees compliance and does not resolve individual claims or award compensation. Consider qualified legal advice about other options and deadlines if needed.
OBSI can recommend compensation; it cannot compel payment. Its consumer FAQ says a firm may refuse a recommendation, in which case OBSI publishes the refusal. Keep your complaint documents and any applicable legal deadlines in view.
The Interac e-Transfer reality
A fake deposit notice, interception of a genuine transfer and an outgoing money request are different events. Our Interac guide explains these three mechanisms and what Autodeposit can protect. Tell your bank which event happened instead of assuming that all e-Transfer fraud has the same remedy.
—Check whether a transfer has been deposited. Interac's FAQ describes cancellation through the sender's bank before deposit, subject to its process. Once deposited, it cannot be cancelled. Contact the bank immediately about suspected fraud; this limit does not remove the need for an investigation.
—A deposit link alone is not proof of fraud. Genuine notifications for recipients without Autodeposit may include an email or text link. Verify an unexpected transfer with the sender independently, then use your bank's genuine service or published support route. Logos and displayed sender addresses can be copied.
—A money request asks you to pay. Before approving anything, read the bank's confirmation and check who is sending money to whom. A message describing a refund does not turn an outgoing payment into a deposit.
—Bank impersonation may expose credentials. If you entered login details or a one-time code, contact the bank immediately and secure the affected accounts. See how to verify a suspicious Tangerine message. Reimbursement still depends on the facts and applicable protections.
Investment fraud: the regulators you need to know
Investment fraud is the largest single source of Canadian fraud losses, accounting for $351 million of the $704 million 2025 CAFC total — half. Canadian Securities Administrators (CSA), an umbrella for the thirteen provincial and territorial securities regulators, is the main coordinating body. You will generally report investment fraud to your provincial regulator, not directly to CSA.
—Ontario — Ontario Securities Commission (OSC). osc.ca. The largest provincial regulator by case volume. The OSC also runs investor education through GetSmarterAboutMoney.ca.
—Quebec — Autorité des marchés financiers (AMF). lautorite.qc.ca. Quebec's all-in-one financial regulator, covering both securities and insurance. The AMF is one of the most aggressive enforcement bodies in Canada.
—British Columbia — BC Securities Commission (BCSC). bcsc.bc.ca. Active on retail-investor fraud, particularly crypto and forex schemes.
—Alberta — Alberta Securities Commission (ASC). asc.ca. Energy-sector and natural-resources investment fraud is particularly relevant here.
—Other provinces. Manitoba (mbsecurities.ca), Saskatchewan (fcaa.gov.sk.ca), Nova Scotia (nssc.novascotia.ca), New Brunswick (fcnb.ca), PEI (princeedwardisland.ca), Newfoundland (gov.nl.ca/dgsnl), territories. The CSA national page at securities-administrators.ca has the full directory and a redirect-to-your-regulator wizard.
—National umbrella — the CSA itself. Between June and November 2025, the CSA in collaboration with the Canadian Investment Regulatory Organization (CIRO) deactivated more than 3,900 fake investment platforms and 6,900 individual URLs. Reports translate into takedowns. For the broader investment-fraud playbook, see our investment-fraud guide.
Credit freezes are available in Ontario and Quebec
TransUnion's current credit-freeze FAQ lists Ontario and Quebec residents as eligible. Quebec's protection began on February 1, 2023; Ontario was not the first province. A freeze restricts access for specified credit purposes, including some phone payment plans. It is different from a fraud alert, which asks lenders to verify identity. Neither repairs an existing fraudulent account.
—Contact each bureau separately. Ask Equifax and TransUnion about fraud alerts and, where eligible, freezes or locks. A request to one does not automatically protect the other file.
—TransUnion's freeze is free. Eligible residents can use ocs.transunion.ca or call 1-800-663-9980. For French service or English service in Quebec, its fraud-assistance number is 1-877-713-3393.
—A freeze has limits. Some access, including existing-account review and certain non-credit purposes, remains possible. Keep monitoring accounts and report unfamiliar credit directly to the provider.
—Removing a freeze differs from scheduled suspension. TransUnion says removal stays in effect until you request a new freeze. Its FAQ dates automatic reinstatement after a scheduled suspension to July 1, 2027.
If the incident began with a discounted handset or an instruction to return a supposedly incorrect phone, our Rogers phone scam guide explains the order-and-return trap. Contact the carrier about any order or financing in your name before treating it solely as a bank dispute.
Verify CRA contact instead of relying on blanket rules
The CRA can contact you by phone, letter and certain emails. Its compromised-account guidance also describes calls or letters asking people to validate their identity, sometimes with identification, proof of address or banking documents. The request alone does not authenticate the caller: verify independently before providing anything.
Use the CRA's actual contact rules:
—No arrest threats or gift-card tax demands. The CRA does not threaten arrest or deportation, provide or accept cryptocurrency payments, or demand immediate payment by gift card, prepaid card or Interac e-Transfer. It does not send refunds by e-Transfer.
—Some calls and identity questions are genuine. CRA agents may ask for identity information, including a SIN, or financial details in permitted circumstances. End a suspicious call and obtain the CRA's contact details yourself; do not trust caller ID.
—MFA texts are a real exception. The CRA sends sign-in codes to people enrolled in telephone multi-factor authentication. It does not text refund links or start tax conversations through instant messaging. Never give a sign-in code to an unsolicited caller.
—Use the published reporting route. If your CRA account or identity information may be compromised, follow the CRA's scam and identity-theft reporting guidance and notify the CAFC.
The same structural pattern animates the broader digital-arrest scam family — a fake authority figure on a phone call demanding immediate payment to avoid arrest. The CRA imposter is the Canadian variant.
The 8-step playbook
This is the sequence to follow when a scam has just happened to you (or to someone you are helping) in Canada in 2026.
1Contact the affected bank, payment provider or account provider immediately. Use its genuine app or published contact details. Explain what you approved, what someone else did and which credentials you shared. Ask about account protection and any available dispute or cancellation. Keep the case reference. If a phone was fraudulently ordered, contact the carrier and delivery provider about the order as well.
2Report at reportcyberandfraud.canada.ca. Use the national RCMP/CAFC reporting portal, or call the CAFC at 1-888-495-8501. Include contact details, payment references, dates, amounts and evidence. This supports intelligence and policing; it does not guarantee a refund.
3Report to your local police too. The national portal does not replace local-police reporting. Use the non-emergency route unless there is immediate danger. Keep the police reference and ask your bank, insurer or other affected provider what documents it needs.
4Contact both credit bureaus if identity information was exposed. Review reports and ask Equifax and TransUnion about fraud alerts. Ontario and Quebec residents can also request credit freezes or locks from both bureaus separately. Report unfamiliar credit accounts directly to the provider; a freeze does not fix an existing fraudulent account.
5Report investment fraud to your provincial or territorial regulator. Find the appropriate regulator through the Canadian Securities Administrators directory. Examples include OSC in Ontario, ASC in Alberta, BCSC in British Columbia and AMF in Quebec. Preserve the investment website and transaction records.
6Preserve original evidence. Keep messages, emails, website addresses, payment records, order confirmations and delivery labels. Screenshots are useful, but preserve originals where available. Record dates and case references. Do not publish identity documents or account secrets.
7Escalate an unresolved bank complaint to OBSI when eligible. For a federally regulated bank, you can contact OBSI after its final written response or once 56 calendar days have passed. File within 180 days of the final response. Review is free; recommendations are not binding. A provincial credit union may have a different route.
8Stop engaging and verify any follow-up independently. Preserve evidence, then block the scammer. Be suspicious of unsolicited demands for fees, taxes or another transfer to release recovered money. A CAFC report is not a recovery service or a repayment guarantee. Verify purported bank or police contact through contact details you obtained independently.
An official-looking recovery offer needs independent verification. The CAFC warns about criminals copying its name and documents to demand fees, taxes or transfers to release supposedly recovered money. Do not pay an unsolicited caller or give them account access. Contact the claimed institution through its published details. A report or investigation is not a refund guarantee.
Who to call for what: the quick directory
—Joint RCMP/CAFC fraud and cybercrime reporting: reportcyberandfraud.canada.ca, or 1-888-495-8501 (CAFC line).
—Local police (non-emergency): Your municipal or provincial police non-emergency line. 911 only for active danger.
—Bank fraud disputes: Use the number on your card, the genuine app or the institution's published fraud contact.
—Bank dispute external escalation: Ombudsman for Banking Services and Investments (OBSI) — obsi.ca. Sole external body since 1 November 2024.
—Investment fraud: Your provincial securities regulator (OSC, AMF, ASC, BCSC, etc.) plus the national CSA umbrella at securities-administrators.ca.
—Credit bureaus — fraud alerts and eligible freezes: Contact Equifax and TransUnion separately. TransUnion: 1-800-663-9980; for French service or English service in Quebec: 1-877-713-3393. Check the bureaus' official sites for the appropriate current process.
—Privacy breaches and identity theft (federal): Office of the Privacy Commissioner of Canada — priv.gc.ca. For provincial privacy authorities, check your province.
—Consumer-protection / non-financial complaints: Competition Bureau Canada — competitionbureau.gc.ca. Or your provincial consumer-affairs office.
—Financial Consumer Agency of Canada (FCAC): canada.ca/fcac. Oversees consumer-protection compliance; does not resolve individual complaints or compensate consumers.
—CRA account compromise: Use the scam and identity-theft reporting guidance on canada.ca, then notify the CAFC. Verify any purported CRA caller independently.
The useful rule is independent verification: before acting on unexpected contact, obtain the institution's genuine contact details yourself and confirm the request. Real CRA calls and sign-in codes exist. A logo, caller ID or familiar sender address cannot establish that the person contacting you is genuine.
Hit by a scam in Canada and not sure what to file where? Let's walk through it together.
Tell us the scam type, the amount, the bank, the date, and whether you have a police report yet. A real expert reviews every case and replies within 24 hours. Free, confidential, no pressure.
What is the new Canadian fraud reporting system launched in 2025?
The RCMP launched Report Cybercrime and Fraud on November 6, 2025. The CAFC and RCMP National Cybercrime Coordination Centre administer this national reporting repository. Victims and witnesses can report online, including anonymously. It does not replace a report to your local police or financial institution. The CAFC phone alternative is 1-888-495-8501. Filing a report does not guarantee an investigation or a refund.
Does my Canadian bank have to refund me if I was scammed?
A scam report does not automatically entitle you to a refund. The payment method, who made or approved the transaction, applicable protections and your account agreement matter. Report immediately and check your agreement's dispute deadline. If a federally regulated bank closes your complaint unsatisfactorily, or 56 calendar days have passed, you can take it to OBSI. You generally have 180 days after the bank's final written response. OBSI's review is free, but its recommendations are not binding. Provincial credit unions may use a different process.
Where do I report an Interac e-Transfer scam?
Contact your bank through its genuine app or the number on your card immediately. Give the transfer reference, date, amount and an accurate account of what happened. Ask whether an undeposited transfer can still be cancelled; Interac says a deposited transfer cannot be cancelled. Suspected fraud still needs investigation. Report to your local police and Report Cybercrime and Fraud, or call the CAFC at 1-888-495-8501. Use your bank's complaint process if you dispute its decision.
What if the scam was investment fraud?
Notify your own provincial or territorial securities regulator, your local police and the CAFC. Examples include the OSC in Ontario, ASC in Alberta, BCSC in British Columbia and AMF in Quebec. The CSA provides a directory for all provinces and territories. Contact the institution that handled your payment as well. Reporting supports enforcement, but does not guarantee that money will be returned.
How do I freeze my credit in Canada after identity theft?
Credit freezes are currently available to residents of Ontario and Quebec. TransUnion's current FAQ confirms this; Ontario is not the first Canadian province to offer the protection. Contact Equifax and TransUnion separately for their freeze or lock processes. Elsewhere, ask both bureaus about fraud alerts and review your reports for unfamiliar accounts. A freeze restricts access for specified credit purposes; it does not protect every existing account or recover money already lost.
What if the scammer is in another country?
Report through the Canadian channels even if you believe the person or platform is abroad. Include the website, contact details and payment references without assuming that a displayed address proves the scammer's location. Contact your payment provider immediately about any available cancellation, recall or dispute. The CAFC and police can use reports to connect cases; reporting does not promise recovery.
Sources & further reading
Every figure in this piece is drawn from these Canadian authorities. Click any of them to verify.
