A fake "Tangerine" verification text can steal your login details and one-time code. Receiving it alone does not prove a bank breach or account access. Tangerine's suspicious-spend alerts ask for a Y/N text reply and never request link clicks or personal information. If uncertain, open the app yourself or call the number on your card. If you exposed credentials or see unauthorized activity, contact Tangerine promptly.
Is Tangerine Bank safe, or is the text the scam?
Tangerine itself is a real bank. The scam is the message that borrows its name. Tangerine's own website describes it as a trade name of Tangerine Bank, a wholly-owned subsidiary of The Bank of Nova Scotia (Scotiabank) and a CDIC member in its own right. So the useful question is not whether Tangerine is legitimate. It is whether this particular text, email or call is.
Tangerine publishes a short list of things it will not ask for. Its Security Centre says it will never send you an email or text message asking for your Client Number, Account Number, Credit Card Number, Secret Questions or PIN, and that it will never ask you to download any software or remote access app. A message that asks for any of those, or for the login security code from 864674, fails the test whatever name it shows. Genuine suspicious-spend alerts also arrive by email from noreply@notifications.tangerine.ca, according to the same alert guidance quoted above, though a displayed sender address can be faked and proves nothing on its own.
Correction — October 16, 2026: clarified genuine alert requests and follow-up calls, removed blanket login-link and no-breach assurances, and corrected Canadian reimbursement rights. The verification graphic replaces an illustration carrying the old rules.
If you bank with Tangerine, use the checks below before acting on an unexpected account-verification request. The impersonation borrows the bank's voice and your own instinct to protect your money.
Was Tangerine hacked, or is my account compromised?
A message alone cannot establish a bank breach or tell you whether your account is secure. This article explains a smishing pattern in which a fake alert directs you to a credential-stealing page; it does not diagnose a particular incident. Check recent transactions and security notifications by independently opening the app or website. If you entered details, shared a code, approved an unexpected login or see unauthorized activity, contact Tangerine. Not interacting with one message does not rule out other ways an account could be compromised.
A name collision explains many "Tangerine hacked" results. Searches for a Tangerine hack or breach often surface reports that about 232,000 customers were exposed. That incident, disclosed in February 2024, was at Tangerine Telecom, an Australian internet and mobile provider, not at Tangerine Bank in Canada. Cyber Daily, quoting the telco's statement, reported that names, dates of birth, contact details and account numbers were involved, and that no card numbers, banking details or passwords were disclosed. That story tells you nothing either way about a Tangerine Bank account. Check yours through the app, and apply the steps below if anything looks wrong.
If you entered sensitive information, treat it as exposed and follow the containment steps below. The Interac e-Transfer guide explains a separate distinction: a genuine manual transfer notice can contain a deposit link. A link alone does not settle whether a message is fraudulent. Verify an unexpected request through a route you open independently.
Why a "security alert" is the perfect disguise
A fraud warning is the one message you're primed to act on fast — which is exactly why scammers wear it. The text mimics the alert you'd want, attaches a deadline ("verify now to avoid suspension"), and gives you a single, helpful-looking button. Tangerine, the Canadian Anti-Fraud Centre and Canadian media have all flagged bank-impersonation as one of the fastest-growing fraud types; the CAFC reported Canadians lost at least $704 million to fraud in 2025, and estimates only 5–10% of fraud is ever reported, so the real total is far higher. Tangerine itself lists account takeovers and impersonation among the threats to watch.
Anatomy of the scam, decoded
This illustrative sequence explains the impersonation pattern; it is not a transcript of a verified message. Naming each move makes the pressure easier to recognize.
What to do
Tangerine fraud department number, and the four ways to report a scam
If you exposed credentials or see unauthorized activity, contact the bank promptly to contain the risk. If you only want a suspicious email checked, use its published phishing address. Forwarding an email is not a substitute for asking the bank to secure affected access.
Will Tangerine reimburse an unauthorized transaction?
The transaction matters. Bank Act section 627.33 generally limits liability for unauthorized bank-issued credit-card use to $50, unless the borrower demonstrated gross negligence or gross fault in Quebec. Using the correct authentication information does not by itself establish that exception. FCAC says banks must fully investigate disputed unauthorized card transactions. These rules do not promise reimbursement for every payment made under deception.
Tangerine's Security Guarantee separately covers unauthorized account activity subject to its conditions, including notification within 30 days of the first statement showing it. A transfer you approved yourself needs a different assessment from a transaction someone made without your permission. Report promptly, preserve the messages and transaction records, and request a written decision. Reporting alone does not guarantee reimbursement, but timely notice and evidence can matter to the claim. Our Canada guide explains the complaint route if you dispute the result.
Got a "Tangerine" text you're not sure about? Send it to us first.
Paste the message or the link. A real expert reviews every case and replies within 24 to 48 hours. Free, confidential, no pressure — before you tap anything.
Common questions about the Tangerine scam
What is the Tangerine scam?
This article describes an impersonation pattern: a text or email claims there is unusual activity and directs you to a fake Tangerine login page. The page can steal login details and a one-time security code for an account takeover. Receiving a suspicious text alone does not establish that the bank was breached or that your account was accessed. Open the Tangerine app yourself or type tangerine.ca to check. Do not disclose a login security code to a caller or enter it through an unexpected message link.
Is Tangerine Bank safe and legit, or is Tangerine a scam?
Tangerine itself is a real bank. Its own website describes Tangerine as a trade name of Tangerine Bank, a wholly-owned subsidiary of The Bank of Nova Scotia (Scotiabank) and a CDIC member in its own right. A Tangerine scam is an impersonation of that bank: a text, email or call that borrows the name to get your login details or a security code. Tangerine says it will never send you an email or text asking for your Client Number, Account Number, Credit Card Number, Secret Questions or PIN, and will never ask you to download software or a remote access app. Whether a particular message is genuine is a separate question, so check it through the app or a number you already have.
Is the "Tangerine hacked, 230,000 customers exposed" story about Tangerine Bank?
No. Those reports are about Tangerine Telecom, an Australian internet and mobile provider, which disclosed in February 2024 that data belonging to about 232,000 current and former customers had been exposed. It is a different company from Tangerine Bank in Canada. Cyber Daily, quoting the telco's statement, reported that names, dates of birth, contact details and account numbers were involved, and that no card numbers, banking details or passwords were disclosed. That report says nothing either way about a Tangerine Bank account. If you are worried about yours, open the Tangerine app or website yourself and check your activity.
How do I tell a real Tangerine message from a fake one?
Tangerine does send genuine alerts. Its suspicious-spend texts use 826373 for Credit Cards and 92145 for Client Cards, ask for a Y/N text reply and do not ask for personal information or link clicks. Login security codes may come from 864674; do not share them. A sender name or number alone is not conclusive proof. If uncertain, open the app yourself or call the number on your card. Forward a suspicious email to phishing@tangerine.ca for verification.
Will Tangerine refund money lost to the scam?
It depends on the transaction and applicable rules. Bank Act section 627.33 generally caps liability for unauthorized bank-issued credit-card use at $50, with an exception for gross negligence or gross fault in Quebec; authentication alone does not establish that exception. Banks must fully investigate disputed unauthorized card transactions. Tangerine also publishes an account Security Guarantee with conditions, including notice within 30 days of the first statement showing the activity. A scam payment you approved yourself is a different situation: do not assume card protections cover it. Report promptly, ask for a written decision and use the bank's complaint process if needed.
I clicked the link / entered my details — what do I do now?
If you entered credentials, shared a code, approved an unexpected login or lost money, call Tangerine at 1-888-826-4374 and ask it to secure the affected account or card and investigate. Its Security Centre also lists 1-888-723-3304 for phishing requests. Change exposed or reused passwords through the official app or site, enable 2-Step Authentication and check other accounts. Where identity information was exposed, contact Equifax and TransUnion about fraud alerts. Report fraud to the Canadian Anti-Fraud Centre and police. An unexpected caller demanding a code or a transfer to a 'safe account' needs independent verification.
Was Tangerine hacked, or is my account compromised?
A suspicious message alone cannot establish either a bank breach or the security of your account. This article describes impersonation, rather than assessing a particular security incident. Check recent activity by independently opening the Tangerine app or website. If you shared credentials, a login code or other sensitive information, or see activity you did not authorize, contact Tangerine at 1-888-826-4374 promptly. Not interacting with one message does not rule out other ways an account could be compromised.
How do I report Tangerine fraud?
For suspicious account activity or exposed credentials, call Tangerine at 1-888-826-4374 and ask it to secure affected access and investigate. Its Security Centre also lists 1-888-723-3304 for phishing, and phishing@tangerine.ca for suspicious emails. Report fraud to local police and the Canadian Anti-Fraud Centre on 1-888-495-8501 or through reportcyberandfraud.canada.ca. A national report does not guarantee investigation or reimbursement. If you dispute the bank's decision, follow its complaint process and the applicable OBSI escalation route described in our Canada guide.
How do I report a Tangerine phishing email or text?
Forward the email to phishing@tangerine.ca — that is Tangerine's published address for having a suspicious message checked. For a text, forward it to 7726 (SPAM), the free short code Canadian carriers use to collect smishing, and delete it. Don't tap the link first to "see where it goes": loading the page can confirm your number is live, and on a fake login page the risk is that you type something. If you already entered your Client Number, password, security answers or a one-time code, stop reporting and start containing — call 1-888-826-4374 immediately, then change any reused password and turn on 2-Step Authentication.
Is this "Tangerine" text just spam, or an actual scam?
A message using Tangerine's name could be a genuine alert, unwanted marketing or an impersonation attempt; the name alone does not decide it. This article covers fake account-verification messages designed to steal login details. Tangerine says its suspicious-spend alerts require a Y/N text reply and never request link clicks or personal information. If a message unexpectedly asks you to log in or disclose a code, stop and check through the independently opened app or the number on your card. A suspicious email can be forwarded to phishing@tangerine.ca.
Sources & further reading
Alert and reporting guidance was checked against Tangerine's published pages on October 16, 2026 and again on October 26, 2026, when we added its ownership statement, its list of things it never asks for, and the Tangerine Telecom breach reports that share its name. The reimbursement correction uses the Bank Act and FCAC; the graphic explains verification rather than reproducing a real message. Historical Canadian fraud figures retain their original attribution.