Credit card fraud protection in Canada: your liability and what to do

Credit card fraud protection in Canada works in two layers. By law, if a bank issued your credit card, the most you can be held liable for unauthorized use is $50, and on top of that the major networks add zero-liability policies that usually bring your cost down to $0. This guide explains how those layers fit together, how to protect yourself, and exactly what to do if your card is used without your permission.

Nothing here is financial advice. Always confirm the specific terms and conditions on your own issuer's official page before acting.

The $50 cap and zero liability: how the two layers work

The first layer is set in Canadian law and explained by the Financial Consumer Agency of Canada (FCAC). If a bank issued your credit card, your maximum liability for unauthorized transactions is $50, unless you demonstrated gross negligence in safeguarding your personal authentication information, including your PIN, passwords, or other details used to verify your identity. That $50 ceiling is the statutory floor of protection that applies regardless of which card you carry.

The second layer sits on top. Visa, Mastercard, and American Express each operate a zero-liability policy that protects you beyond the legislated $50 maximum. In practice this means that when you meet the network's conditions, your liability for unauthorized transactions is $0 and you pay nothing.

Layer	Source	Your liability
Legal cap (bank-issued card)	FCAC / Canadian law	$50 maximum
Visa Zero Liability	Visa Canada	$0 when conditions met
Mastercard Zero Liability	Mastercard Canada	$0 when conditions met
Amex Fraud Protection Guarantee	American Express Canada	$0 when conditions met

The conditions are similar across all three networks. You must have used reasonable care in safeguarding your card and PIN, you must not have contributed to the unauthorized use, and you must report the loss, theft, or unauthorized transaction to your financial institution immediately. Visa applies its $0 protection to Canada-issued cards but excludes things like anonymous prepaid cards, commercial cards, and certain ABM PIN transactions. Mastercard's zero liability covers purchases made in store, by phone, online, on a mobile device, and at ATMs, while excluding commercial cards and unregistered prepaid or gift cards. Amex states you will not be held responsible for fraudulent charges as long as you took reasonable care to protect your account details, PIN, and any device, and you notify them immediately.

How to protect yourself

Most fraud protection is automatic, but a few habits keep you firmly inside the zero-liability conditions:

• Guard your PIN and passwords. Never write your PIN on your card, never share it, and avoid obvious choices. Failing to safeguard this information is what FCAC describes as gross negligence, and it can void the $50 cap.
• Use tap and EMV chip payments. Chip-and-PIN (EMV) and contactless tap transactions are far harder to clone than the old magnetic stripe, because the chip generates a unique code for each transaction.
• Lean on tokenization. When you add a card to a mobile wallet, the real number is replaced by a device-specific token, so the merchant never sees your actual card number.
• Check statements regularly. Review transactions often, ideally through your issuer's app, so you catch anything unfamiliar quickly. Prompt detection feeds directly into the report-immediately condition.
• Set up transaction alerts. Most Canadian issuers can text or push a notification for each charge, turning you into a real-time monitor of your own account.

Phishing and skimming: the two most common attacks

Fraudsters most often try to trick you into handing over your details (phishing) or quietly capture your card data at a compromised terminal (skimming).

Phishing arrives as fake emails, texts, or calls that imitate your bank and ask you to confirm card numbers, passwords, or one-time codes. Your issuer will never ask you to reveal your full PIN or password, so treat any such request as fraud and contact your bank using the number on the back of your card, not a number from the message.

Skimming involves a hidden device on an ATM, gas pump, or payment terminal that reads your card. EMV chip and tap payments dramatically reduce skimming risk because they do not expose a reusable static number the way a swipe does. Cover the keypad when entering a PIN, and inspect terminals that look tampered with.

What to do if you are defrauded

If you spot an unauthorized transaction or your card is lost or stolen, FCAC's guidance and every network's policy point to the same priority: report it immediately. Acting fast both limits losses and satisfies the conditions for zero-liability protection.

1. Call your issuer right away. Use the phone number on the back of your card or in your banking app to report the loss, theft, or unauthorized charge. For American Express cardholders the fraud line is 1-800-869-3016.
2. Ask them to freeze or cancel the card. This stops further charges and the issuer will arrange a replacement.
3. Document the details. Note the date, amount, and merchant for each transaction you did not authorize, plus the date and time you reported it.
4. Confirm the dispute is opened. Ask your issuer to flag the charges as unauthorized and walk you through their resolution process for an unauthorized transaction.
5. Watch for the credit. Once the issuer resolves the matter under the $50 cap or its zero-liability policy, the fraudulent charges should be reversed.
6. Change exposed credentials. If phishing was involved, update any passwords or banking login details that may have been compromised.

Note that an unauthorized-transaction claim (fraud) is different from a billing dispute over a charge you made yourself. If you recognize the merchant but disagree with the amount or never received the goods, that is a dispute, not fraud. See our guide on how to dispute a credit card charge in Canada and the difference between a chargeback and a refund.

When fraud is suspected on your card

Sometimes the issuer detects the fraud first and locks your card as a precaution. If that happens, your card may be declined or frozen until you confirm recent activity. Our guide on what to do if your card is declined or frozen covers how to get it working again.

The bottom line

In Canada you are well protected against credit card fraud. The law caps your liability on a bank-issued card at $50, and the Visa, Mastercard, and Amex zero-liability policies layer on top to bring most consumers to $0. The protection holds as long as you safeguard your PIN and passwords and report any loss, theft, or unauthorized transaction immediately. Build the habit of checking statements and using chip, tap, and tokenized payments, and you keep yourself firmly inside that protection. If you are choosing a new card, compare your options across all major networks on our cards page.