Online Fraud in Canada — Recovery Steps & Legal Remedies

The bank-fraud-line call, the CAFC report at 1-888-495-8501, local police complaints, the Criminal Code sections that apply, the OBSI ombudsman path up to $350,000, the provincial securities commissions for investment scams, and the honest gap in Canada's reimbursement framework compared with the UK.

Published 13 May 2026 · ScamSupport research · ~15 minute read

2025 was Canada's worst year on record for fraud. The Canadian Anti-Fraud Centre (CAFC) recorded $704 million in losses, with investment fraud alone accounting for $351 million — roughly half. Statistics Canada estimates that only 5 to 10 percent of fraud victims ever report, which means the actual loss figure is somewhere between $7 billion and $14 billion. Most of the increase has been concentrated in three categories: AI-built fake investment platforms (often promoted via Telegram, WhatsApp and Facebook ads), pig-butchering crypto schemes, and impersonation fraud. Reddit threads from victims in Alberta, BC and Ontario this year describe the same pattern repeatedly: a polished website with fake regulatory certificates, weeks of artificial "gains", and then a wall of fees that prevent any withdrawal.

This guide covers what actually works for recovery in Canada, in the order the steps need to happen. The first 48 hours determine most of what's recoverable; after that, the work shifts to a longer process of complaint, escalation and prevention. We cover the bank-side first call, the CAFC report, the local police statement, the Criminal Code provisions that apply, the OBSI ombudsman path up to $350,000, the provincial securities commissions for investment-specific complaints, and where the Canadian framework has a real gap relative to the UK's mandatory APP reimbursement scheme. Sources are linked throughout and gathered at the bottom.

If money has just left your account, jump to Call Your Bank's Fraud Line First. If you're working through next steps, the rest of this guide moves through reporting, escalation, and the longer-term recovery options.

Call Your Bank's Fraud Line First

Unlike the UK and India, where centralised infrastructure (the UK's mandatory APP reimbursement scheme, India's 1930 helpline coordinating across 85+ banks) does some of the time-sensitive work, Canada's fraud-recovery system runs through the banks first and a national reporting body second. This makes the bank-fraud-line call the highest-leverage action in the first hour after a fraud.

Use the number printed on the back of your card or in your bank's app, never any number from the scam message. When you reach the fraud team, ask three things explicitly:

  • Recall the payment if it's still in flight. Interac e-Transfer and many wire transfers can sometimes be recalled within minutes if the receiving institution cooperates. The window closes once funds clear out of the receiving account.
  • Freeze further outbound transfers. Lower the daily limit, pause online transfers, or block the account for outbound payments while the case is investigated.
  • Log it as fraud, not a complaint. The two categories trigger different bank workflows. Fraud opens an investigation, allocates a case number, and starts the clock for any reimbursement assessment.

The Canadian liability framework

Canada's federal Financial Consumer Protection Framework, which came into effect on 30 June 2022, governs how federally regulated banks must handle unauthorised credit and debit transactions. The protections are real but limited:

  • Credit card unauthorised transactions: $50 maximum cardholder liability for transactions made without your consent, provided you reported promptly.
  • Debit transactions: zero liability for losses arising "in circumstances beyond your control" — but contested where the bank argues the customer fell short.
  • Reporting window: typically 30 days from the issuance of the monthly statement showing the unauthorised transaction. Account terms vary; check yours. Past the window, the bank can hold you liable.
  • Investigation requirement: federally regulated banks must conduct an investigation that weighs all relevant factors before finding the consumer liable. They cannot rely solely on authentication technology to refuse.

The framework does not include a UK-style mandatory reimbursement scheme for authorised push payment (APP) fraud — the cases where you, the customer, sent the money under deception. This is the central gap in Canadian consumer protection, and the area most under discussion at federal and provincial levels in 2025-2026. For now, an APP-fraud claim depends on the bank's discretion, the OBSI escalation route covered later, and any criminal-justice or civil-court action.

Report to the CAFC at 1-888-495-8501

Within 24 hours of the fraud, file a report with the Canadian Anti-Fraud Centre. The CAFC is the national fraud-data repository, jointly operated by the Royal Canadian Mounted Police (RCMP), the Ontario Provincial Police (OPP), and the Competition Bureau. It does not investigate individual cases, but it does feed pattern-matching across police services nationwide and supplies the data that triggers larger investigations.

The two reporting paths

  • Phone: 1-888-495-8501 (toll-free, Monday to Friday). Best for vulnerable victims, urgent cases, and where you want a human to walk through the form with you.
  • Online: the Fraud Reporting System (FRS). Best for detailed cases where you have screenshots and documentation to upload.

What to have ready

  • Date, time and amount of the fraudulent transaction(s).
  • Your bank, account number (last 4 digits), and the payment method used (Interac, wire, credit card, e-transfer, crypto).
  • The receiving party's name (as shown on your statement), receiving bank or wallet, transaction reference numbers.
  • The platform involved (Telegram, WhatsApp, Facebook, dating app, e-commerce site, Telegram channel name, fake broker URL).
  • Full content of the original scam communication — copied, not paraphrased.
  • Sender phone numbers, email addresses, usernames.
  • Any URLs, even if you didn't click them.
  • Screenshots of messages, payment confirmations, and the scam website.

You receive a CAFC reference number when the report is logged. Save it — you'll attach it to your bank's case, your local police complaint, and any provincial securities commission filing.

File a Local Police Complaint

The CAFC report is the federal data input. The investigation, if one happens, runs through the police service in the jurisdiction where you live. The Government of Canada's position is explicit: report to local police as well as the CAFC. Most large municipal forces — Toronto Police Service, Calgary Police Service, Edmonton Police Service, Vancouver Police Department, the OPP, the Sûreté du Québec, and the RCMP detachments — have dedicated fraud or cybercrime units.

Two practical points. First, the police complaint is what the bank will sometimes ask for as supporting evidence in a reimbursement assessment, particularly for higher-value cases. Second, the local police filing creates the formal record that may be needed for any subsequent civil action or for an Adjudicating-style adjudication via the provincial securities commission's enforcement division.

For online-only fraud, some forces offer online reporting; otherwise it's a phone call to the non-emergency line and a request to file a fraud complaint. Reference your CAFC case number. Expect to be asked the same evidence questions covered in the CAFC list above.

The Criminal Code Provisions That Apply

The two Criminal Code sections that cover the great majority of online fraud cases in Canada are:

Section 380 — Fraud

The general fraud provision under the Criminal Code (R.S.C. 1985, c. C-46). It applies to anyone who, by deceit, falsehood or other fraudulent means, defrauds another person of property, money, valuable security or service. The penalty splits at $5,000:

  • Value over $5,000: indictable offence, maximum 14 years imprisonment.
  • Value $5,000 or less: hybrid offence, maximum two years imprisonment if prosecuted by indictment.

Section 380 captures the substantive harm in any investment scam, romance scam, marketplace scam, advance-fee scam, or impersonation fraud where money was extracted by deception.

Section 342.1 — Unauthorised use of a computer

The cybercrime-specific provision. It applies where a person fraudulently and without colour of right obtains a computer service, intercepts a computer function, uses a computer to commit a related offence, or uses or possesses a computer password to enable such offences. Penalty: up to 10 years (indictable) or summary conviction. Most account-takeover, phishing, and credential-theft cases cite Section 342.1 alongside Section 380.

Other relevant sections

Depending on the case, charges may also include Section 342 (theft of credit card or use of unauthorised credit card data), Section 403 (identity fraud), Section 402.2 (identity theft), Section 322 (theft) and Section 362 (false pretences). Charge-stacking is normal: a single online fraud incident often produces two to four counts under different sections.

The civil route

Distinct from criminal charges, civil action under common-law fraud or breach-of-contract can be pursued where the wrongdoer is identifiable and within reach of Canadian courts. For most online fraud cases, the wrongdoer is offshore and the civil route is impractical. Where a Canadian intermediary (a bank, an exchange, a payment processor) is alleged to have failed in its duty, a civil claim against the intermediary can sometimes recover the loss — this is currently the most likely path to compensation in Canada.

The OBSI Ombudsman Path — Up to $350,000

If your bank refuses to reimburse a disputed transaction or is delaying without explanation, your free escalation route is the Ombudsman for Banking Services and Investments (OBSI). As of 1 November 2024, OBSI is the sole designated external complaints body for federally regulated banks in Canada. The compensation limit was raised to $350,000 in the 2025 reform package, the most significant strengthening of the role since OBSI was founded in 1996.

The complaint process

  1. Internal complaint first. File a written complaint with your bank's grievance team, referencing your CAFC case number, your local police case number, and any payment authorisation evidence. Banks have 56 days to give you a final response.
  2. OBSI escalation. If you're not satisfied with the bank's final response (or if the bank doesn't respond within 56 days), you have 180 days from that point to bring the complaint to OBSI. Filing is free.
  3. OBSI investigation. OBSI talks to you and the bank, reviews the documentation, and either makes a recommendation or, where appropriate, a binding decision under the new framework. Most cases resolve within months rather than years.
  4. Compensation. Where OBSI finds in your favour, the bank is required to comply with its decision under the designated-body framework introduced in 2024.

What OBSI covers

OBSI's remit is broad: unauthorised credit and debit card transactions, banking and loan disputes, investment-suitability complaints, mutual fund and scholarship trust disputes, fee disclosure issues, and service complaints. For online fraud cases, the most common category is unauthorised transaction disputes where the bank has refused to reimburse or has offered only partial reimbursement.

OBSI is the single most important escalation lever for Canadian fraud victims who have been refused by their bank. Use it.

For Investment Scams — The Provincial Securities Commissions

Investment-specific complaints in Canada are handled by the provincial and territorial securities regulators, coordinated through the Canadian Securities Administrators (CSA). There is no federal securities regulator equivalent to the SEC; instead, each province runs its own. The major players:

What to file

Each commission has its own complaint form. The information you assembled for the CAFC report applies here, plus the platform's name, any registration claims they made (e.g. "regulated in Cyprus by CySEC"), and screenshots of the marketing material. Where the platform claimed to be registered with a Canadian regulator, mention it specifically — impersonating a regulator triggers an immediate enforcement interest. The CSA has issued multiple investor alerts warning about fraudsters impersonating provincial regulators.

The CSA pre-investment check

Before any future investment, run the platform name through the CSA's National Registration Search. Real Canadian-regulated dealers, advisers and investment fund managers all appear there. The Disciplined List and the Cease Trade Orders database on SEDAR+ flag firms that have already been sanctioned. Five minutes of checking against these tools defeats the great majority of impostor pitches.

The Honest Gap — Canada vs the UK Reimbursement Framework

For comparison: the UK introduced a mandatory APP-scam reimbursement scheme in October 2024, requiring banks to refund victims of authorised push payment fraud up to £85,000 in most cases. Canadian consumers don't have an equivalent. Where you authorised the payment under deception, your reimbursement depends on the bank's individual policy, your account terms, the strength of your case, and ultimately the OBSI escalation. The Financial Consumer Protection Framework that came into effect in 2022 explicitly leaves APP fraud outside its mandatory protections.

Canadian commentators including the Canadian Private Lenders Association and the House of Commons Standing Committee on Finance have flagged this gap repeatedly. Reform is on the policy agenda but no mandatory scheme has been enacted at federal level as of mid-2026. Practically, this means:

  • The bank's fraud-line call is even more important in Canada than in the UK because the bank's discretion is doing more work.
  • The OBSI route is the most reliable escalation when the bank refuses, and the recent compensation-limit increase to $350,000 makes OBSI materially more useful for high-value cases.
  • Civil action against intermediaries that arguably failed in their duty (banks, exchanges, payment processors) is the most likely path to compensation in larger cases — particularly cases involving allegedly inadequate customer-due-diligence on the receiving account.

FINTRAC and the Anti-Money-Laundering Layer

Where the receiving end of a fraud is a Canadian bank account or a Canadian-registered Money Service Business, the receiving institution may be obligated to file a Suspicious Transaction Report (STR) with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act. STRs feed AML investigations and can result in account freezes against suspected mule accounts.

You don't file a FINTRAC report yourself — that's the financial institution's obligation — but raising the STR question with the receiving bank's compliance team via your own bank's fraud line creates a paper trail that can move the case forward. The phrasing to use: "Has a Suspicious Transaction Report been filed with FINTRAC for the receiving account in this case?" Banks are constrained by "tipping off" rules and may not confirm directly, but the question puts the issue on the record.

Telegram-Specific Reporting in the Canadian Context

Telegram is the dominant cross-border channel for the 2025-2026 wave of investment scams targeting Canadians, particularly via fake broker pitches in Alberta, BC and Ontario. The reporting paths inside Telegram itself are limited but worth using; we cover them in detail in our Telegram P2P safety guide.

The Canadian-specific points

  • In-app report: profile → three-dot menu → Report → Scam. Telegram blocked over 43.5 million channels and groups globally in 2025; reports feed the takedown pipeline.
  • abuse@telegram.org: for higher-impact cases, email with a one-page summary, usernames, screenshots, and your CAFC reference number. Telegram's response to Canadian law-enforcement requests has historically been faster than to Indian requests, in part because of the post-2024 cooperation reforms following the regulatory action against Telegram's leadership in France.
  • RCMP National Cybercrime Coordination Unit (NC3): for higher-value cases or where multiple Canadian victims are involved in the same operation, the RCMP's NC3 can be the appropriate escalation. NC3 doesn't take direct individual reports — the path is through your local police complaint, which then routes upward when the case profile warrants.

The platform's name — check it before paying anyone

If a Telegram contact is pitching you an investment platform, run the platform name through three checks before sending any money:

  1. The CSA National Registration Search. Not registered = not regulated to sell investments to Canadians.
  2. The CSA Disciplined List and SEDAR+ Cease Trade Orders. Already sanctioned = walk away.
  3. The international warning lists (the FCA Warning List, the SEC PAUSE list, ASIC banned list, the California DFPI Crypto Scam Tracker). Many fake platforms targeting Canadians have already been flagged abroad.

Five minutes of checking defeats the majority of fake-platform pitches.

Evidence Preservation Checklist

Canadian criminal evidence requirements for digital records sit under common-law authentication rules and the Canada Evidence Act. The practical bar: an unedited, well-documented evidence trail with a clear chain of custody. The list below is what police and the CAFC will ask for, in roughly the order they'll ask.

  • Full screenshots of every message thread — including sender details, timestamps, and any media. Don't crop; capture the full screen so the platform UI is visible.
  • Sender phone numbers, email addresses and platform usernames — recorded with a date.
  • Transaction details — Interac references, wire confirmation numbers, screenshots of bank statements showing the disputed transactions.
  • For crypto transactions: the receiving wallet address and the transaction hash. Paste them into a blockchain explorer (etherscan.io for ETH/USDT-ERC20, blockchain.com for BTC) and screenshot the transaction page.
  • The original scam URL or website — capture the full address bar and the page; if possible save the page as a single PDF.
  • Call recordings, if the scam involved phone calls and you have recordings, preserved in original format on at least two separate storage devices.
  • Any documents, photos or files the scammer sent — including hashes where you can compute them.
  • A written timeline of events in your own words — what happened, when, in what order. Useful for the police statement and for any civil filing later.

Keep two copies: the originating device, plus an external drive or a cloud account that maintains version history. Don't edit or annotate originals; if you need notes, keep them in a separate document.

The Jurisdictional Reality — Foreign Operators

The hardest cases in Canadian online fraud are the ones where the operator sits outside Canadian jurisdiction. Most of the 2025-2026 investment-platform scams targeting Canadians are run from compounds in Cambodia, Myanmar, Laos, the Philippines and the UAE, with infrastructure registered in jurisdictions that don't cooperate with Canadian Mutual Legal Assistance Treaty (MLAT) requests on a useful timeline.

For most individual cases, the realistic recovery comes from action while funds are still inside the Canadian banking system — which loops back to the urgency of the bank-fraud-line call within the first hour. For cases where the funds have already moved offshore, the path that has worked in 2024-2026 is:

  • The CAFC report contributes to pattern-matching that triggers cross-border investigations.
  • The RCMP's NC3 coordinates with the FBI's IC3, the UK's NCA and Europol on cluster-investigations of pig-butchering compounds.
  • Where a cluster cracks open (as happened with several large Cambodian-compound prosecutions in 2024-2025), restitution to identified victims is sometimes possible via court-ordered asset distributions.

The honest summary: a sub-$10,000 individual loss to an offshore operator is unlikely to be recovered through individual action. That's not a reason not to file — reports feed the larger pattern-matching — but it is a reason to keep expectations calibrated and to be especially alert to recovery scams (covered next).

Avoiding the Recovery Scam Follow-Up

Within hours, days or weeks of a Canadian fraud, most victims receive at least one approach from a "recovery service" offering to help get their money back. The FCA's data on the UK equivalent shows that more than 60% of investment-fraud victims are subsequently approached by recovery scammers; the Canadian pattern is similar. Two-thirds of recovery-scam victims globally are 56 or older.

The unambiguous red flags

  • Any upfront fee. Police, the RCMP, the CAFC, and OBSI never charge fees. Legitimate solicitors regulated by their provincial law society either work on contingency or charge after a recovery.
  • Cryptocurrency payment requests. No legitimate Canadian firm bills clients in crypto.
  • Web-based email addresses (Gmail, Hotmail, Outlook, ProtonMail). Real solicitors and government agencies use their own domains.
  • Claims of inside information about the original scam ring. Information from your CAFC report cannot be shared with private operators — it stays inside law enforcement.
  • Pressure to act fast or keep the engagement secret. Real legal action moves on weeks-to-months timelines and would actively encourage you to seek second opinions.

The legitimate routes are: your bank, OBSI, the relevant provincial securities commission, and law-society-regulated solicitors verified through the provincial law society directory. Our full recovery-scam section in the UK guide covers the pattern in greater depth; the structure is the same in Canada.

Frequently Asked Questions

I'm in Alberta. Where do I file first?

Three places, in this order: your bank's fraud line (immediately), the CAFC at 1-888-495-8501 or its online portal (within 24 hours), and your local police service (within a few days). For investment-specific scams, also file with the Alberta Securities Commission (ASC). All four can run in parallel; none of them substitutes for the others.

Will my credit score be affected?

Being a fraud victim doesn't affect your credit score directly. What can affect it: if a scammer used your details to open credit in your name (identity fraud), the unpaid debt may appear on your file. Place a fraud alert with both Equifax Canada and TransUnion Canada — the alert is free and remains on file for six years (one-year alerts are renewable). It requires lenders to verify your identity before extending new credit.

I sent crypto to the scammer. Is recovery realistic?

Generally, no — for individual sub-$10,000 cases. Once funds leave a Canadian-regulated exchange to a wallet, the trail moves through tumblers and chains of fresh wallets that recovery services can't reach. The exception: cases where the receiving wallet is later flagged in a larger investigation (Chainalysis and TRM Labs work directly with law enforcement on these). Filing the CAFC report puts your data in the pool that triggers those investigations.

What if my own bank account is frozen because of suspicious receiving funds?

This happens when funds you've received turn out to be from a fraud, even if you weren't complicit. Don't move money out before talking to the bank's compliance team. Provide your CAFC reference, the police case number, and the original transaction context. Most freezes lift within 7-14 days once the bank confirms the victim relationship; longer freezes may require a solicitor specialising in proceeds-of-crime law.

How long does the OBSI process take?

OBSI's typical case timeline is three to nine months from intake to final outcome. Complex cases involving disputed reasonable-caution can run longer. Filing is free; you don't need a lawyer though some victims engage one for high-value cases.

Can I sue Telegram or Facebook for hosting the scam?

In practice, no. The platforms' terms of service place liability on users, and Section 230-equivalent protections in their host jurisdictions make consumer suits impractical. The realistic targets in any civil action are Canadian intermediaries (banks, exchanges, payment processors) where you can argue they failed in their know-your-customer or anti-money-laundering duties.

Is there a Canadian helpline for the emotional aftermath?

Yes. The Canadian Resource Centre for Victims of Crime offers free, confidential support. Most provinces also operate Victim Services through the provincial Ministry of the Attorney General — in Ontario this is the Victim/Witness Assistance Programme; in BC, Victim Services BC; in Alberta, Alberta Victim Services. None of these provide direct financial recovery, but they offer trauma-informed counselling, court accompaniment, and practical help with paperwork.

Sources Cited

Use the Scam Message Scanner →

Related Reading