If a stranger breaks into your house and walks off with your TV, your insurer will at least take your call. If a very charming stranger convinces you to carry the TV to his car yourself, that conversation gets much shorter.

That, roughly, is how Canadian banking law treats scam victims.

This weekend, reporting that built on a CBC Go Public investigation told the story of an 88-year-old B.C. man who lost more than $450,000 after a deepfake video appeared to show Prime Minister Mark Carney promoting an investment scheme. (It wasn’t him. It never is.) His bank questioned some payments and briefly restricted his account, but the money kept moving, and none has been refunded. Legally, that may well be allowed, because he approved the payments himself. I think that rule is out of date, and the fix Ottawa is proposing doesn’t go far enough.

According to the report, it started in May 2025. Over roughly ten months, the man sent more than $450,000 to the scammers through online transfers and repeated branch visits.

The bank did notice. It asked questions, warned him and temporarily restricted the account. It did not stop the transfers. His daughter’s view of the bank was blunt: “They knew this was unusual behaviour.” The bank declined to discuss the case, citing client confidentiality, so we don’t have its side.

This is not a one-off. Canadians reported $704 million in fraud losses in 2025, nearly 300 per cent more than in 2020, and the Canadian Anti-Fraud Centre estimates only 5 to 10 per cent of fraud is reported at all. Those figures come from the federal government’s own regulatory analysis of the problem.

Do Canadian banks have to refund scam victims?

Mostly, no. And the reason comes down to one word: authorized.

Canadian law draws a sharp line between fraud done to you and fraud done through you. The government’s own Gazette analysis lays it out:

• Credit cards: your liability for unauthorized charges is capped at $50 unless you were grossly negligent (and the big card issuers offer zero liability anyway).
• E-Transfers and wires: banks may hold you fully liable even when a fraudster got into your account.
• Payments you were tricked into making: romance scams, fake investments, phantom merchandise. You pressed “send”, so the loss is generally yours.

In other words, the law protects the TV that was stolen. It doesn’t protect the TV you carried to the car.

That logic made sense when a scam meant a badly spelled email. Deepfakes aren’t built to fool careless people. They’re built to fool careful ones.

What will Canada’s new anti-fraud rules change?

Some useful things. In June, the Department of Finance pre-published draft regulations under the Bank Act. As proposed, from July 1, 2027, banks would have to:

• get your express consent before switching on e-Transfers, wires or global money transfers;
• let you switch those features off;
• hold a transfer-limit increase until the next business day if they can’t validate it’s really you;
• keep policies on when to investigate suspicious transactions and when to tell the customer; and
• report fraud data, including how much they reimbursed victims, to the Financial Consumer Agency of Canada.

Notice what’s missing. Nothing in the draft requires a bank to pay a victim back. Reimbursement is something to report, not to pay. And features already switched on in existing accounts don’t need fresh consent, so long-standing customers get the least new friction.

It’s a seatbelt. Seatbelts are good. But nobody is talking about who pays for the car.

How does the UK handle scam reimbursement, and should Canada copy it?

Differently. Since 7 October 2024, the UK Payment Systems Regulator has required banks to reimburse victims of “authorised push payment” scams, the technical name for the carry-the-TV-yourself situation. Claims are covered up to £85,000, which the regulator says covers over 99 per cent of claims. The sending and receiving banks split the cost 50:50.

There are exceptions. You won’t be reimbursed if you were in on the fraud or grossly negligent, and the regulator describes gross negligence as a high bar. Even that exception doesn’t apply to vulnerable consumers.

That’s the shift I’d like here: “the system pays, unless you were reckless”, not “you pay, unless you’re lucky”.

To be fair, the Canadian Bankers Association has warned, according to the reporting, that shifting costs to banks could backfire on customers. Nobody wants higher fees for everyone. But making the receiving bank share the bill gives the institutions that open accounts for money mules a reason to care. Right now, the incentive sits mostly with the party least equipped to spot a deepfake.

Here’s where I land.

First, “authorized” should stop doing all the work. A payment made because a deepfake lied to you is authorized in the same way a confession under hypnosis is voluntary. The law can expect care without treating sophisticated deception and carelessness as the same thing.

Second, spotting red flags should count. A bank that notices something is off, warns the customer and keeps processing payments has done something. A reimbursement regime would force the question of whether it did enough.

Third, the referee needs a whistle. The Ombudsman for Banking Services and Investments (OBSI) opened 1,815 fraud investigations in 2025, nearly double the year before, according to its annual report. It can recommend up to $350,000 in compensation. But in its own words, its recommendations “are not binding on firms.” A referee with optional calls is a commentator.

Regular readers will spot a theme: I recently asked who pays when an AI agent misuses your banking password, and how a fake job interview opened the door to a crypto heist. The question keeps coming back: when AI makes deception cheap, who carries the loss?

So what should you do?

If you bank in Canada: treat any video of a politician, celebrity or bank boss promising returns as fake until proven otherwise. Lower your e-Transfer and wire limits if you never use the headroom. And call your parents this week, not to lecture, just to say “the Prime Minister is not selling investments online.”

If you’ve been scammed: report it to your bank right away, then to police and the Canadian Anti-Fraud Centre. File a written complaint with the bank. Under the FCAC’s complaint process, your bank must give you a detailed written response within 56 calendar days. If it doesn’t, or you’re unhappy with its answer, you can take it to OBSI.

If you’re a bank, lawyer or compliance lead: the draft regulations make your fraud data and policies visible to the regulator. Expect the numbers on reimbursement to become a public talking point, and expect pressure for a UK-style model to grow. Look hard now at how frontline staff escalate a customer who keeps returning to wire money “for an investment”.

FAQ

Will my bank refund me if I fall for a deepfake scam?

Usually not, under current Canadian rules. If you authorized the payment, even because you were deceived, banks can generally leave the loss with you. Card fraud is different: liability for unauthorized credit card charges is capped at $50 unless you were grossly negligent. Always report quickly and file a written complaint anyway.

When do Canada’s new bank anti-fraud rules take effect?

The draft regulations, pre-published in June 2026, are proposed to take effect on July 1, 2027. They require express consent for e-Transfers and wires, an option to switch them off, delays on unverified limit increases and fraud reporting to the FCAC. They do not require banks to reimburse scam victims.

What can I do if my bank refuses to reimburse me?

File a written complaint with your bank. It must give a detailed written response within 56 calendar days. After that, or once it closes your file, you can go to the Ombudsman for Banking Services and Investments. OBSI can recommend up to $350,000 in compensation, but banks aren’t legally bound to follow it.

---

This article is for general information and entertainment only. It isn’t legal advice and doesn’t represent the views of any organization I am affiliated to. If you need advice on your specific situation, talk to a qualified lawyer in your jurisdiction.