The bank-fraud-line call, the CAFC report at 1-888-495-8501, local police complaints, the Criminal Code sections that apply, the OBSI ombudsman path up to $350,000, the provincial securities commissions for investment scams, and the honest gap in Canada's reimbursement framework compared with the UK.
Published 13 May 2026 · ScamSupport research · ~15 minute read
2025 was Canada's worst year on record for fraud. The Canadian Anti-Fraud Centre (CAFC) recorded $704 million in losses, with investment fraud alone accounting for $351 million — roughly half. Statistics Canada estimates that only 5 to 10 percent of fraud victims ever report, which means the actual loss figure is somewhere between $7 billion and $14 billion. Most of the increase has been concentrated in three categories: AI-built fake investment platforms (often promoted via Telegram, WhatsApp and Facebook ads), pig-butchering crypto schemes, and impersonation fraud. Reddit threads from victims in Alberta, BC and Ontario this year describe the same pattern repeatedly: a polished website with fake regulatory certificates, weeks of artificial "gains", and then a wall of fees that prevent any withdrawal.
This guide covers what actually works for recovery in Canada, in the order the steps need to happen. The first 48 hours determine most of what's recoverable; after that, the work shifts to a longer process of complaint, escalation and prevention. We cover the bank-side first call, the CAFC report, the local police statement, the Criminal Code provisions that apply, the OBSI ombudsman path up to $350,000, the provincial securities commissions for investment-specific complaints, and where the Canadian framework has a real gap relative to the UK's mandatory APP reimbursement scheme. Sources are linked throughout and gathered at the bottom.
If money has just left your account, jump to Call Your Bank's Fraud Line First. If you're working through next steps, the rest of this guide moves through reporting, escalation, and the longer-term recovery options.
Unlike the UK and India, where centralised infrastructure (the UK's mandatory APP reimbursement scheme, India's 1930 helpline coordinating across 85+ banks) does some of the time-sensitive work, Canada's fraud-recovery system runs through the banks first and a national reporting body second. This makes the bank-fraud-line call the highest-leverage action in the first hour after a fraud.
Use the number printed on the back of your card or in your bank's app, never any number from the scam message. When you reach the fraud team, ask three things explicitly:
Canada's federal Financial Consumer Protection Framework, which came into effect on 30 June 2022, governs how federally regulated banks must handle unauthorised credit and debit transactions. The protections are real but limited:
The framework does not include a UK-style mandatory reimbursement scheme for authorised push payment (APP) fraud — the cases where you, the customer, sent the money under deception. This is the central gap in Canadian consumer protection, and the area most under discussion at federal and provincial levels in 2025-2026. For now, an APP-fraud claim depends on the bank's discretion, the OBSI escalation route covered later, and any criminal-justice or civil-court action.
Within 24 hours of the fraud, file a report with the Canadian Anti-Fraud Centre. The CAFC is the national fraud-data repository, jointly operated by the Royal Canadian Mounted Police (RCMP), the Ontario Provincial Police (OPP), and the Competition Bureau. It does not investigate individual cases, but it does feed pattern-matching across police services nationwide and supplies the data that triggers larger investigations.
You receive a CAFC reference number when the report is logged. Save it — you'll attach it to your bank's case, your local police complaint, and any provincial securities commission filing.
The CAFC report is the federal data input. The investigation, if one happens, runs through the police service in the jurisdiction where you live. The Government of Canada's position is explicit: report to local police as well as the CAFC. Most large municipal forces — Toronto Police Service, Calgary Police Service, Edmonton Police Service, Vancouver Police Department, the OPP, the Sûreté du Québec, and the RCMP detachments — have dedicated fraud or cybercrime units.
Two practical points. First, the police complaint is what the bank will sometimes ask for as supporting evidence in a reimbursement assessment, particularly for higher-value cases. Second, the local police filing creates the formal record that may be needed for any subsequent civil action or for an Adjudicating-style adjudication via the provincial securities commission's enforcement division.
For online-only fraud, some forces offer online reporting; otherwise it's a phone call to the non-emergency line and a request to file a fraud complaint. Reference your CAFC case number. Expect to be asked the same evidence questions covered in the CAFC list above.
The two Criminal Code sections that cover the great majority of online fraud cases in Canada are:
The general fraud provision under the Criminal Code (R.S.C. 1985, c. C-46). It applies to anyone who, by deceit, falsehood or other fraudulent means, defrauds another person of property, money, valuable security or service. The penalty splits at $5,000:
Section 380 captures the substantive harm in any investment scam, romance scam, marketplace scam, advance-fee scam, or impersonation fraud where money was extracted by deception.
The cybercrime-specific provision. It applies where a person fraudulently and without colour of right obtains a computer service, intercepts a computer function, uses a computer to commit a related offence, or uses or possesses a computer password to enable such offences. Penalty: up to 10 years (indictable) or summary conviction. Most account-takeover, phishing, and credential-theft cases cite Section 342.1 alongside Section 380.
Depending on the case, charges may also include Section 342 (theft of credit card or use of unauthorised credit card data), Section 403 (identity fraud), Section 402.2 (identity theft), Section 322 (theft) and Section 362 (false pretences). Charge-stacking is normal: a single online fraud incident often produces two to four counts under different sections.
Distinct from criminal charges, civil action under common-law fraud or breach-of-contract can be pursued where the wrongdoer is identifiable and within reach of Canadian courts. For most online fraud cases, the wrongdoer is offshore and the civil route is impractical. Where a Canadian intermediary (a bank, an exchange, a payment processor) is alleged to have failed in its duty, a civil claim against the intermediary can sometimes recover the loss — this is currently the most likely path to compensation in Canada.
If your bank refuses to reimburse a disputed transaction or is delaying without explanation, your free escalation route is the Ombudsman for Banking Services and Investments (OBSI). As of 1 November 2024, OBSI is the sole designated external complaints body for federally regulated banks in Canada. The compensation limit was raised to $350,000 in the 2025 reform package, the most significant strengthening of the role since OBSI was founded in 1996.
OBSI's remit is broad: unauthorised credit and debit card transactions, banking and loan disputes, investment-suitability complaints, mutual fund and scholarship trust disputes, fee disclosure issues, and service complaints. For online fraud cases, the most common category is unauthorised transaction disputes where the bank has refused to reimburse or has offered only partial reimbursement.
OBSI is the single most important escalation lever for Canadian fraud victims who have been refused by their bank. Use it.
Investment-specific complaints in Canada are handled by the provincial and territorial securities regulators, coordinated through the Canadian Securities Administrators (CSA). There is no federal securities regulator equivalent to the SEC; instead, each province runs its own. The major players:
Each commission has its own complaint form. The information you assembled for the CAFC report applies here, plus the platform's name, any registration claims they made (e.g. "regulated in Cyprus by CySEC"), and screenshots of the marketing material. Where the platform claimed to be registered with a Canadian regulator, mention it specifically — impersonating a regulator triggers an immediate enforcement interest. The CSA has issued multiple investor alerts warning about fraudsters impersonating provincial regulators.
Before any future investment, run the platform name through the CSA's National Registration Search. Real Canadian-regulated dealers, advisers and investment fund managers all appear there. The Disciplined List and the Cease Trade Orders database on SEDAR+ flag firms that have already been sanctioned. Five minutes of checking against these tools defeats the great majority of impostor pitches.
For comparison: the UK introduced a mandatory APP-scam reimbursement scheme in October 2024, requiring banks to refund victims of authorised push payment fraud up to £85,000 in most cases. Canadian consumers don't have an equivalent. Where you authorised the payment under deception, your reimbursement depends on the bank's individual policy, your account terms, the strength of your case, and ultimately the OBSI escalation. The Financial Consumer Protection Framework that came into effect in 2022 explicitly leaves APP fraud outside its mandatory protections.
Canadian commentators including the Canadian Private Lenders Association and the House of Commons Standing Committee on Finance have flagged this gap repeatedly. Reform is on the policy agenda but no mandatory scheme has been enacted at federal level as of mid-2026. Practically, this means:
Where the receiving end of a fraud is a Canadian bank account or a Canadian-registered Money Service Business, the receiving institution may be obligated to file a Suspicious Transaction Report (STR) with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act. STRs feed AML investigations and can result in account freezes against suspected mule accounts.
You don't file a FINTRAC report yourself — that's the financial institution's obligation — but raising the STR question with the receiving bank's compliance team via your own bank's fraud line creates a paper trail that can move the case forward. The phrasing to use: "Has a Suspicious Transaction Report been filed with FINTRAC for the receiving account in this case?" Banks are constrained by "tipping off" rules and may not confirm directly, but the question puts the issue on the record.
Telegram is the dominant cross-border channel for the 2025-2026 wave of investment scams targeting Canadians, particularly via fake broker pitches in Alberta, BC and Ontario. The reporting paths inside Telegram itself are limited but worth using; we cover them in detail in our Telegram P2P safety guide.
If a Telegram contact is pitching you an investment platform, run the platform name through three checks before sending any money:
Five minutes of checking defeats the majority of fake-platform pitches.
Canadian criminal evidence requirements for digital records sit under common-law authentication rules and the Canada Evidence Act. The practical bar: an unedited, well-documented evidence trail with a clear chain of custody. The list below is what police and the CAFC will ask for, in roughly the order they'll ask.
Keep two copies: the originating device, plus an external drive or a cloud account that maintains version history. Don't edit or annotate originals; if you need notes, keep them in a separate document.
The hardest cases in Canadian online fraud are the ones where the operator sits outside Canadian jurisdiction. Most of the 2025-2026 investment-platform scams targeting Canadians are run from compounds in Cambodia, Myanmar, Laos, the Philippines and the UAE, with infrastructure registered in jurisdictions that don't cooperate with Canadian Mutual Legal Assistance Treaty (MLAT) requests on a useful timeline.
For most individual cases, the realistic recovery comes from action while funds are still inside the Canadian banking system — which loops back to the urgency of the bank-fraud-line call within the first hour. For cases where the funds have already moved offshore, the path that has worked in 2024-2026 is:
The honest summary: a sub-$10,000 individual loss to an offshore operator is unlikely to be recovered through individual action. That's not a reason not to file — reports feed the larger pattern-matching — but it is a reason to keep expectations calibrated and to be especially alert to recovery scams (covered next).
Within hours, days or weeks of a Canadian fraud, most victims receive at least one approach from a "recovery service" offering to help get their money back. The FCA's data on the UK equivalent shows that more than 60% of investment-fraud victims are subsequently approached by recovery scammers; the Canadian pattern is similar. Two-thirds of recovery-scam victims globally are 56 or older.
The legitimate routes are: your bank, OBSI, the relevant provincial securities commission, and law-society-regulated solicitors verified through the provincial law society directory. Our full recovery-scam section in the UK guide covers the pattern in greater depth; the structure is the same in Canada.
Three places, in this order: your bank's fraud line (immediately), the CAFC at 1-888-495-8501 or its online portal (within 24 hours), and your local police service (within a few days). For investment-specific scams, also file with the Alberta Securities Commission (ASC). All four can run in parallel; none of them substitutes for the others.
Being a fraud victim doesn't affect your credit score directly. What can affect it: if a scammer used your details to open credit in your name (identity fraud), the unpaid debt may appear on your file. Place a fraud alert with both Equifax Canada and TransUnion Canada — the alert is free and remains on file for six years (one-year alerts are renewable). It requires lenders to verify your identity before extending new credit.
Generally, no — for individual sub-$10,000 cases. Once funds leave a Canadian-regulated exchange to a wallet, the trail moves through tumblers and chains of fresh wallets that recovery services can't reach. The exception: cases where the receiving wallet is later flagged in a larger investigation (Chainalysis and TRM Labs work directly with law enforcement on these). Filing the CAFC report puts your data in the pool that triggers those investigations.
This happens when funds you've received turn out to be from a fraud, even if you weren't complicit. Don't move money out before talking to the bank's compliance team. Provide your CAFC reference, the police case number, and the original transaction context. Most freezes lift within 7-14 days once the bank confirms the victim relationship; longer freezes may require a solicitor specialising in proceeds-of-crime law.
OBSI's typical case timeline is three to nine months from intake to final outcome. Complex cases involving disputed reasonable-caution can run longer. Filing is free; you don't need a lawyer though some victims engage one for high-value cases.
In practice, no. The platforms' terms of service place liability on users, and Section 230-equivalent protections in their host jurisdictions make consumer suits impractical. The realistic targets in any civil action are Canadian intermediaries (banks, exchanges, payment processors) where you can argue they failed in their know-your-customer or anti-money-laundering duties.
Yes. The Canadian Resource Centre for Victims of Crime offers free, confidential support. Most provinces also operate Victim Services through the provincial Ministry of the Attorney General — in Ontario this is the Victim/Witness Assistance Programme; in BC, Victim Services BC; in Alberta, Alberta Victim Services. None of these provide direct financial recovery, but they offer trauma-informed counselling, court accompaniment, and practical help with paperwork.