Card Fraud in Canada 2026: Credit Cards, Online Attacks and Merchant Risk
Canada's payment habits are increasingly card-led, but its fraud statistics tell several different stories. Unauthorized charges, stolen payment credentials and disputed ecommerce orders are related problems—not interchangeable measures. This briefing follows the evidence from the cardholder's account to the merchant's settlement.
Cards Account for 68% of Canada's Retail-Payment Transactions
Credit and debit are both card payments, but they travel through different network arrangements and expose merchants to different authentication and dispute workflows. Canada’s unusually strong credit-card adoption also matters for online commerce.
Payments Canada's October 2026 Canadian Payment Methods and Trends report counted 26.7 billion retail payment transactions worth C$12.9 trillion in 2025. Credit cards represented 43% of payment counts and debit cards another 25%; together, cards were used for more than two-thirds of retail-payment transactions.
The mix was different in 2024, when credit cards represented 33% of transactions and debit cards 30%. The 2025 credit-card share should be read within Payments Canada's full market methodology rather than interpreted as a fraud indicator. Credit-card transactions reached 11.6 billion in 2025 with C$1.02 trillion in value. That is a considerable legitimate activity base over which individual fraud events are distributed.
Contactless transaction volume grew 9% in 2025, with contactless credit-card volume up 12%. Online commerce is important too: ecommerce represented 6.1% of Canadian retail sales, and 58% of consumers made an online purchase in a given month. The online shopper is often a card shopper—61% of online shoppers paid with credit cards, according to the same report.
For merchants, the practical distinction is between the physical card environment and a remote authorization where the merchant cannot inspect the physical card. A digital wallet can authenticate its user, but it does not automatically resolve every dispute about the purchase, delivery, or entitlement to the underlying account.
Unauthorized Charges and Stolen Credentials: Two Different Data Lenses
Canada has valuable fraud survey evidence, but no verified 2025 or 2026 public national series that cleanly allocates total confirmed card-fraud value among online and in-store transactions, credit and debit, and merchants and issuers. The best briefing starts by saying what is known.
Payments Canada's August 2025 survey questioned 1,500 people in February and March. Thirteen per cent reported experiencing payment fraud within a six-month period. That statistic covers numerous payment methods; it is not a card-fraud transaction rate.
Among people who experienced payment fraud, 33% reported a fraudulent transaction on a bank or credit-card statement, down from 38% in the prior survey. Twenty per cent reported an unauthorized purchase involving stolen credit-card information, up from 18%. Reports of purchases using stolen debit-card information rose from 7% to 10%. Categories can overlap and the denominator is respondents reporting payment fraud, rather than all card transactions.
There is a longer-term signal in the Financial Consumer Agency of Canada's 2024 Canadian Financial Capability Survey: 36% reported unauthorized use of bank or credit-card numbers, versus 18% in 2019. Its wording includes bank numbers as well as cards, so it cannot be equated with the Payments Canada survey's narrower categories or used to calculate a national card transaction fraud rate.
These measures are useful precisely because they show different aspects of risk: experiences reported by people, kinds of unauthorized activity, and the broader prevalence of compromised financial credentials. They should not be added to the Canadian Anti-Fraud Centre's crime-report loss totals or divided by annual card-payment value.
Reported unauthorized use of bank or credit-card numbers.
Same survey question, five years later; not limited to credit cards.
Experienced any payment fraud in a six-month period, across payment methods.
Online Card Fraud Starts Before the Customer Reaches Checkout
Remote payments remove the physical card from the verification process. The relevant risk therefore extends beyond the authorization message to account login, stored credentials, checkout-page integrity and order fulfilment.
In May 2026, TransUnion reported that 13% of surveyed Canadians said they had lost money to digital fraud over the preceding year. Among those who lost money, 26% identified stolen credit-card information or fraudulent charges as a cause—more than the 22% identifying third-party seller scams and the 21% identifying account takeover. These are respondent shares, not the distribution of Canada's total card-fraud dollars.
The same company measured a 4.4% suspected digital-fraud attempt rate across interactions involving Canadian consumers in its proprietary client network in 2025. It reported a much higher 14.2% suspected rate at account login. These are risk-model flags within the reporting network, not confirmed nationwide card-fraud rates and not a percentage of all Canadian ecommerce purchases.
For a merchant, the difference matters. An attacker may test a stolen credential, hijack an account, replace its stored card, or use legitimate login credentials to place an abnormal order. Effective controls look for continuity between the customer's account, device, order, payment token and delivery instructions. That requires analyzing a sequence of events rather than assuming a successful card authorization validates the whole transaction.
Interac adds a Canadian peculiarity. Interac Debit supports in-store transactions and eligible online/in-app wallet payments at participating merchants; an Interac e-Transfer is a different account-to-account product. Neither should be casually treated as a Visa or Mastercard credit-card transaction when describing authorization and chargeback processes.
Phishing, malicious checkout scripts, data theft, and exposed stored-card details.
Low-value attempts, automated account probes, or credential-stuffing attacks.
Unfamiliar device, new shipping address, unusual basket or sudden order velocity.
Issuer investigation, cardholder claim, potential chargeback and evidence review.
Older Adults Report More Unauthorized Card Use, but the Financial Outcome Varies
The strongest Canadian demographic evidence concerns actual reported fraud and financial outcomes—not credit-card ownership, online spending or social-media use. Those differences should be made explicit rather than reduced to a stereotype about who is vulnerable.
The Financial Consumer Agency of Canada reports that respondents aged 55 and older were more likely than younger respondents to report experiencing phishing and unauthorized use of bank or credit cards in the 2024 Canadian Financial Capability Survey. The published narrative does not give a reliable numeric rate for each age band in the accessible text, so this briefing does not invent age-specific card-fraud prevalence percentages.
A separate Payments Canada survey offers a more quantitative, but different, age comparison: among its payment-fraud-affected respondents, the share reporting no money lost was 23% for ages 18–34, 34% for ages 35–54 and 60% for adults 55 and older. This is not card-only fraud and it is not a rate of attempted fraud among all Canadians in those age groups.
These two findings are not contradictory. One captures reported unauthorized card or bank-number use; the other captures whether money was lost in an experience of payment fraud. Detection, reimbursement, scam type, payment behaviour and sample composition can all alter the financial outcome. The available data do not establish a reliable card-fraud loss amount per age group.
For fraud prevention, age should not be a substitute for transaction evidence. Identity continuity, unusual order changes, authentication quality and account history generally provide a more defensible operational screen than demographic profiling.
From Stolen Credentials to Account Takeover: Four Merchant-Side Failure Modes
Merchants need controls that match the attack mechanism. A physical stolen-card attempt is not operationally equivalent to an automated card-testing campaign or an account takeover against a recurring customer.
Compromised card numbers
Payment details can be stolen through phishing, breached databases or malicious checkout scripts. A criminal then attempts purchases at unrelated merchants. An apparently valid card number proves that credentials were available—not that the customer authorized the order.
Card testing and credential stuffing
Attackers submit bursts of small payment requests to find live cards, or reuse compromised customer passwords to enter existing accounts. The first sign may be a spike in declined authorizations, rather than a customer complaint.
Stored-card and account takeover
An established account can be abused when passwords, email access or session tokens are compromised. The attacker may change the delivery destination, make purchases with a card on file or attempt password resets that appear routine.
Unauthorized-use claims and misclassified disputes
A buyer may dispute a genuinely fraudulent payment; other cases concern subscriptions, fulfilment, confusing billing descriptors or refund delays. Treating every dispute as evidence of stolen-card fraud conceals the operational cause.
Cardholder Protection Does Not Automatically Determine Merchant Liability
Canada's consumer protections and card-network dispute rules operate in different layers. Banks must investigate unauthorized transactions, but a merchant's financial exposure depends on the transaction, authentication, evidence and applicable network rules. A documented chargeback-prevention process helps keep dispute evidence separate from confirmed fraud.
The Financial Consumer Agency of Canada states that a consumer's maximum liability for unauthorized use of a bank-issued credit card is generally C$50, subject to exceptions such as gross negligence. Debit-card protection depends on circumstances, applicable rules and account arrangements. Card-network zero-liability commitments may provide additional protections subject to their terms.
The investigation itself is not optional for federally regulated institutions. FCAC makes clear that a valid chip-and-PIN event is not by itself proof of cardholder liability. Institutions must consider theft, coercion, shoulder-surfing, equipment failure and other evidence. This protects cardholders without proving which other party ultimately absorbs the loss.
For merchants accepting Visa online, Visa Secure using EMV 3-D Secure adds issuer-connected cardholder authentication. Qualified transactions can receive a fraud-related liability shift from merchant/acquirer to issuer, but the shift is conditional, and authentication is not protection against all dispute types or processing errors.
Checkout-page integrity matters even when a payment form is hosted. PCI DSS v4.0.1's expanded ecommerce requirements became effective on March 31, 2025. The PCI Security Standards Council updated SAQ A guidance but stressed that the underlying payment-page security obligations were not eliminated. Merchants should confirm the specific requirements applicable to their integration and validation category.
Card-present defence
Use EMV-capable terminals, investigate fallback and unattended-terminal anomalies, reconcile refunds, and maintain terminal security. Do not assume a PIN alone resolves unauthorized-use allegations.
Card-not-present defence
Use tokenization, risk-based authentication, checkout integrity monitoring, account security, device/velocity signals and fulfilment checks. Preserve evidence for authorization and dispute review.
Control the Full Card Transaction, Not Just the Authorization
The commercial goal is not simply to reject more transactions. It is to reduce fraud-related losses while preserving legitimate approvals and the evidence merchants need when a dispute occurs.
Watch account and order changes
Monitor sudden changes to device, login location, basket, shipping address and purchase frequency. Apply additional verification when several signals change together, rather than treating one unusual characteristic as definitive.
Make consent and billing legible
Retain the original order terms, subscription authorization, cancellation process and customer communications. Separate unauthorized-card fraud from recurring-billing disputes and avoid ambiguous descriptors.
Verify before irreversible release
Apply manual review thresholds to high-value, rush, reship and pickup orders. Document who approved any delivery or beneficiary change after payment. Prioritize evidence that can be tied to the original authorization.
Confirm network and region-specific rules
Review acquiring country, card product, transaction currency, 3-D Secure eligibility and dispute conditions. Canadian Interac Debit activity and international Visa/Mastercard card transactions should not be merged into one risk bucket.
Keep the denominators clean
Measure suspected fraud attempts, confirmed unauthorized transactions, disputes, dollars lost and order-level false positives separately. Use consistent volume denominators to compare periods and product categories.
Explain the business accurately
Document billing schedules, cancellation and refund policies, fulfillment times, transaction volumes and dispute history. Evidence quality matters when merchant accounts are evaluated for transaction and chargeback risk.
Build a Defensible Card-Processing and Fraud-Control Plan
A merchant's sales model, billing practices, refunds, fulfillment, transaction size and dispute history all influence payment-processing risk. Durango Merchant Services helps businesses assess underwriting concerns and organize the information needed to pursue appropriate payment-processing approval. Merchants selling across borders can also review DMS' international merchant account guidance.