Unauthorized Debit Card Transaction in Canada: What to Do

Recognize the transaction before you report it

FCAC generally describes an unauthorized transaction as a banking or card transaction you did not make or approve. It may be a purchase, cash withdrawal, or online debit-card payment. A stolen card or card details, a lost mobile device, or identity theft can be involved. Financial institutions may define the term in their agreements, so read your debit-card and account terms as well.

Check the date, amount, and merchant description against your receipts and other household purchases. A label you do not recognize may still be a transaction you approved under a different business name. If you cannot match it, report the concern promptly; your financial institution can tell you how it will investigate.

Protect the account right away

FCAC says to notify the financial institution immediately when you suspect someone used your card or account without permission, or when there is a risk of that happening. Change your passwords and personal identification number (PIN) promptly. Follow the institution’s instructions about the card, access to online banking, and any other account protection it offers.

Use contact details from the card, a statement, or the institution’s official app or website. A text message claiming to be from the bank may be part of the same problem. Review recent transactions for anything else you did not approve, and keep monitoring after the first report. FCAC also advises checking your credit report for unfamiliar credit accounts or activity if your information may have been misused.

Give the institution a precise report

Identify the date, amount, account, and description of every transaction you dispute. Explain what you know about your card or device: whether you still have it, when you last used it, and when you first noticed the charge. The institution may ask for more information during its investigation. Tell it what you know and keep a copy of anything you submit.

Write down when you contacted the institution, whom you spoke with, any case number, and what it asked you to do next. FCAC’s debit-fraud guidance recommends noting who you spoke to and when. These notes help you compare the institution’s eventual explanation with your original report.

Check the reporting period in your account agreement

FCAC says deposit-account customers usually have 30 days after the statement date to dispute a transaction. The exact period can differ by institution. Check your own agreement and report the issue as soon as you discover it. This 30-day figure describes a usual reporting window; it is not a deadline for the institution to finish investigating.

If you noticed the issue late, still contact the institution and explain when you became aware of it. Ask it which account-agreement term applies and record the answer. This guide cannot decide whether a particular late claim will be accepted.

What the investigation should consider

When you report an unauthorized transaction, a federally regulated financial institution must investigate it. FCAC says it must consider all relevant factors before finding you at fault, regardless of the technology used for the transaction. A transaction appearing in an app, at an automated teller machine, or through contactless payment does not by itself settle responsibility.

FCAC explains that debit-card users are protected against unauthorized transactions in stores, at payment terminals, at ATMs, and online. It also describes situations where a person may be responsible for a loss, such as sharing a PIN, using an easily guessed PIN, keeping a written PIN beside the card, failing to report a lost card within the agreement’s period, or refusing to cooperate with an investigation. The facts of your case and the institution’s agreement matter.

Ask the institution for its written explanation if it says you are responsible. Compare the explanation with what you reported and with FCAC’s rights and responsibilities summary. A PIN having been used is one fact to investigate; FCAC says the institution must consider the full circumstances.

If you suspect debit-card fraud

FCAC’s debit-fraud guide suggests writing down what happened, keeping relevant documents, and contacting your local police service. You can also report fraud or cybercrime to Canada’s National Fraud Reporting System. These steps help document the incident and support broader fraud reporting; your financial institution still needs the direct transaction report.

For example, suppose you still have your card but see an unfamiliar cash withdrawal. Record the entry, contact the institution immediately, follow its security instructions, and preserve the statement and case number. The card being in your possession is relevant information for the investigation. This example does not determine the outcome or promise reimbursement.

If the response does not address your concern

Ask for the financial institution’s complaint-handling process if its explanation leaves a material question unresolved. Explain the transaction you reported, the evidence you provided, the institution’s response, and the correction you are seeking. Keep the date when you first made a formal complaint; it starts a separate complaint timeline.

For a bank complaint, FCAC says the bank must give a detailed written response within 56 calendar days after you first complained. You can generally contact the Ombudsman for Banking Services and Investments (OBSI) after the bank closes the file with a detailed written response, or when more than 56 days have passed. OBSI’s review is free and impartial. The 56-day rule concerns a bank complaint; it is not a fixed time for completing every fraud investigation. FCAC explains the route but does not decide individual complaints.