Payments Fraud in Canada 2026: Digital Cards, Impersonation and the Cost of Trust
Canada is a high-volume card market preparing for a new real-time payment rail. But its most serious reported scam losses increasingly begin outside the payment system: a forged supplier email, a supposed bank investigator, a fraudulent investment, or a familiar account taken over by someone else. The payment may authenticate correctly even when the decision to send it is wrong.
Cards Own the Checkout; EFT Carries the Value
Canada's electronic economy has two scales: billions of comparatively small consumer purchases and large-value transfers that dominate monetary flows. The security decisions differ accordingly.
Payments Canada’s October 2026 report puts 2025 retail payment activity at 26.7 billion transactions worth C$12.9 trillion. Credit cards accounted for 43% of transaction volume and debit cards 25%. Together, cards represented 68% of transactions; electronic funds transfer (EFT) represented 12%, cash 9% and online transfers 6%. The categories are a payment-method classification and should not be confused with whether a transaction was initiated on a phone.
The value distribution is radically different. EFT represented 63% of total payment value, while cheques still represented 20%, credit cards 8% and online transfers 5%. The monetary importance of EFT reflects high-value business and institutional payments as well as consumer activity. It does not, by itself, establish that transfers have a higher fraud rate than cards.
Credit cards were used in 11.6 billion transactions, with their total 2025 value reaching C$1.02 trillion. Payments Canada also reports contactless payment volume growing 9% year over year, and notes that its credit-card figures were recast using a 2026 forecast model, so they differ from earlier editions. Separately, the Bank of Canada’s 2025 Methods-of-Payment survey estimates cash made up around 18% of point-of-sale payments by count in 2025, down from 21% in 2024, and about 10% by value. That differs from Payments Canada’s 9% share across all retail payment activity because the survey population, setting and methodology differ.
A Bank of Canada merchant acceptance survey (2023) illustrates the operational reality: 89% of surveyed small and medium businesses accepted credit cards and 89% debit cards; 63% accepted Interac e-Transfer. Offering several options can improve conversion, but it creates separate card-dispute, transfer-reconciliation and identity-verification processes.
Investment Scams Dominate Reported Losses; Identity Fraud Dominates Certain Reports
Canadian Anti-Fraud Centre statistics describe complaints and losses that reach the authorities. They are not a ledger of every unauthorized card payment, every reimbursed transfer or every chargeback in Canada.
The Canadian Anti-Fraud Centre’s 2025 summary recorded more than 112,000 reports and C$704 million in reported losses. Investment fraud alone accounted for about C$351 million, approximately half the reported annual loss total. Spear phishing—the business-facing form of impersonation that often redirects a real invoice or payroll transfer—accounted for C$67.9 million in the year-end table—revised to more than C$68 million in the CAFC’s August 2026 update—even though spear phishing does not appear among the ten most-reported fraud types.
Loss counts and report counts produce very different rankings. Identity fraud topped the published frequency table with 8,403 reports, followed by investment fraud with 4,409. But the CAFC lists no direct consumer dollar loss against identity fraud in this ranking, because liability for that activity often falls elsewhere. The absence of a dollar amount is not evidence that the societal harm is zero.
Across the reported loss ranking, relationship scams caused C$63.3 million in losses, job scams C$50.6 million and fraud-investigator impersonation C$28.3 million. These are CAFC fraud categories, not payment rails. A victim may be persuaded to pay through a bank transfer, crypto transaction or another channel; the public summary does not give a card-versus-transfer total comparable to the ECB–EBA data used in our EEA series.
Reporting gaps are also large. The CAFC estimates that only 5–10% of fraud is reported. That estimate signals substantial undercounting but cannot be used to multiply the monetary total into a defensible national loss estimate: what goes unreported may differ systematically in size and severity.
The First Half of 2026 Shows a Stronger Business-Impersonation Threat
Half-year loss totals cannot by themselves predict the calendar-year outcome. They can, however, show which scam mechanisms are producing material losses right now.
The CAFC's August 2026 six-month update reports approximately C$351 million in losses in January–June 2026. Investments remained the largest published category, at C$139.6 million. For merchants, the more telling signal is spear phishing: C$57.7 million was reported lost during six months, against C$67.9 million in the CAFC’s full-year 2025 category table. Those figures cover comparable named categories, although seasonal reporting and subsequent data revisions prevent a reliable year-end extrapolation.
Bank-investigator fraud—a separate CAFC category from the “fraud investigator” type in the 2025 top-ten table—reached C$28.6 million in H1 2026, compared with C$37.4 million for the whole of 2025. Extortion losses reached C$25.5 million, already above the 2025 total of about C$23 million. Recovery fraud produced C$13.7 million, against about C$25.9 million for all of 2025, illustrating how a successful initial scam can become the basis for a second attack.
Meanwhile TransUnion’s May 2026 survey and transaction analysis found that 13% of surveyed Canadians reported losing money to digital fraud in the previous year, with a median reported loss of C$1,301. It also identified 4.4% of digital transaction attempts involving Canadian consumers as suspected fraud in 2025, versus 3.8% globally. Those are proprietary detection flags across its client network, not verified payment losses and not the whole Canadian payments system.
The more instructive operational signal may be account access. In that same network, 14.2% of attempted logins from Canada in 2025 were suspected fraudulent. The correct interpretation is not that 14.2% of Canadian bank accounts were compromised: the denominator is attempts within participating digital systems, including repeated failed or suspicious logins.
Fraud Victimization by Age: The Direct Evidence Is Older Than the Headlines
Age-based fraud risk is not the same thing as card or internet adoption. Canada's national survey supplies real victimization rates by age—but its reference period must be visible.
Statistics Canada’s published table from the 2019 General Social Survey found that 17% of people aged 15 and above reported experiencing fraud in the preceding five years. Among people aged 25–34, the rate was 21%; ages 45–54 reported 20%; ages 35–44 reported 19%. The rates for ages 65–74 and 75+ were 16% and 10%, respectively. These are survey estimates from a five-year recall window ending in 2019, not 2025 or 2026 fraud-victimization rates.
The historical results contradict an easy assumption that older people are always the most frequently victimized. But neither frequency nor victim rate measures severity. The sources do not provide a modern directly comparable financial-loss rate by each of these seven age bands, and later technology and victim-reporting practices may have changed exposure.
A more recent February 2026 federal committee briefing citing the CAFC reports that adults aged 60 and older made up 23.4% of reported CAFC fraud victims in 2024 and represented 27.9% of reported dollar losses—at least C$179.9 million that year, including roughly C$111.3 million in investment fraud. These percentages measure shares of reported cases and losses, not the likelihood that someone in a given age cohort will lose money.
Comparing the two lenses is informative but not causal: the 2019 population survey captured self-reported experience over five years; the 2024 CAFC compilation reflects victims who entered an administrative reporting system. It would be misleading to place the 2024 senior share alongside the 2019 age-specific rates as though they described the same denominator.
Digital advertising, investing, marketplace purchasing, professional email and telephone impersonation create different points of exposure. For fraud prevention, age can help tailor education and intervention, but transaction context and the integrity of payment instructions remain the more direct merchant controls.
How a Legitimate Payment Becomes an Illegitimate Loss
The attack frequently starts in a different system from the one that transfers the money. Fraud control should follow that chain, not stop at the checkout screen.
Invoice and executive impersonation
A compromised email thread or convincingly spoofed vendor asks a business to update remittance details. A real employee may then approve a real payment to a criminal-controlled account. CAFC spear-phishing losses illustrate the potential severity, but are not all bank-transfer losses.
Fraud-investigator and safe-account deception
An impostor claims there is a problem at the bank and directs the customer to move money to a supposed safe account. The danger is often a successfully authenticated transaction prompted by a false story, not a missing password check.
Stolen cards, account takeover and fake storefronts
Card-not-present misuse, breached credentials and cloned retail pages create different disputes. A seller can suffer chargeback and fulfillment loss even when the criminal's first contact with the consumer happened off-site. DMS's guide to 3-D Secure 2.0 explains where authentication fits—and where it does not.
Social engineering around e-Transfer requests
An Interac e-Transfer can be embedded in a legitimate business workflow or a fraudulent instruction. Messages that appear linked to a parcel, tariff or overdue bill can be particularly effective when they resemble current news. Interac’s March 2026 survey found 58% of respondents had encountered a tariff-related scam in the previous six months (a Burson survey of 1,500 adults, 17–20 February 2026).
Fake returns and second-stage recovery scams
Victims are shown fictitious gains or urgent opportunities and later asked for more money to release or recover funds. Investment scams supplied the largest reported CAFC loss category in both 2025 and H1 2026.
A customer can pass an identity check and still be following a criminal's instructions. Authentication alone cannot validate intent, invoice authenticity or the beneficiary's commercial relationship.
Canada Is Building a More Formal Fraud-Prevention Architecture
Regulatory supervision is already in force for payment service providers. Other protections, including broader anti-fraud rules and the Real-Time Rail, are moving through separate stages.
Since September 8, 2025, the Bank of Canada has supervised payment service providers under the Retail Payment Activities Act (RPAA), including requirements related to operational risk and safeguarding end-user funds. This is a framework for eligible PSPs, not a guarantee that a customer will be reimbursed whenever a scam succeeds, and not an across-the-board licensing claim about every merchant accepting cards.
The government consulted on a National Anti-Fraud Strategy from March 30 to April 28, 2026. Its focus included cross-sector prevention duties for banks, telecom providers and digital platforms, awareness and law-enforcement capabilities. Consultation proposals should not be written as implemented legal obligations.
On 26 June 2026, the Department of Finance pre-published proposed Bank Act fraud regulations for a 30-day comment period to operationalize statutory amendments. The proposals address express consent for certain electronic funds-transfer capabilities, changes to account limits and reporting of fraud. Their implementation depends on final regulations and commencement arrangements; the consulted measures were not all operative as of the publication date of this briefing.
For payments infrastructure, Payments Canada’s October 13, 2026 update says the Real-Time Rail (RTR) was still testing and scheduled to launch in Q4 2026. Its planned safeguards include confirmation of payee, a transaction risk score, shared risk indicators and fraud-intelligence reporting. These are design commitments, not evidence that those services are currently protecting every Canadian transaction.
The RTR should not be confused with already widespread Interac e-Transfer services or the traditional EFT system. Nor is Canada covered by the EU's PSD2 strong-customer-authentication timetable or the EU's instant-payment regulation. Canadian merchants operating internationally need to classify transactions and obligations by the relevant domestic payment service, not transplant European regulatory requirements to Canadian checkout.
Six Priorities for Merchants Accepting Canadian Payments
The goal is not more authentication everywhere. It is to apply the right control at the moment a payment could become irreversible, disputed or disconnected from a legitimate transaction.
Card-Not-Present Sellers
Priority: Examine authorization quality, 3-D Secure challenge strategy, device and account velocity, delivery proof and dispute reasons by channel. Use DMS's chargeback-prevention guidance alongside network rules. Separate unauthorized card use from refund disagreements and friendly-fraud allegations rather than treating all chargebacks as one population.
Supplier and Contractor Payments
Priority: Treat a new beneficiary or revised bank account as a high-risk event. Verify it through a known contact, preserve the call record, and require a second approval before a large payment. An authentic-looking invoice is not evidence of a verified beneficiary.
Interac e-Transfer Merchants
Priority: Reconcile payments with the bank or verified payment dashboard and a unique order reference. Avoid releasing goods, digital access or deposits solely after receiving a transfer screenshot or forwarded email claiming payment was sent.
Subscriptions and Digital Services
Priority: Keep billing disclosures, renewal consent, cancellation paths, refund service and transaction descriptors aligned. Monitor post-purchase disputes separately from account-takeover alerts so that commercial disputes do not obscure unauthorized activity.
Cross-Border and High-Risk Merchants
Priority: Prepare an underwriting package documenting customer geography, monthly volume, sales channels, billing intervals, fulfillment timing, chargebacks and prior processor treatment before pursuing high-risk merchant account approval. Controls should match the actual sales model.
Fintechs and Payment Service Providers
Priority: Confirm whether RPAA registration and safeguarding rules apply to the specific service. Document operational risk, incident response, access controls and beneficiary verification, while testing proposed RTR capabilities against the institution's actual launch and onboarding status.
Preventing payment fraud in Canada requires controlling identity, instructions, beneficiary risk and fulfillment—the full transaction chain, not merely the moment a card or account is authenticated.
Build a Defensible Processing and Fraud-Control Plan
Payments risk depends on the merchant's products, customers, settlement flow, dispute history and delivery obligations. Durango Merchant Services helps merchants assess underwriting concerns, organize their documentation and pursue payment-processing approval with a clearer operating profile.