For family

My mother or father was scammed a while ago, and I don’t know if it is over.

Find what the scammer can still reach, and close each thing in turn.

Have ready:: the account holder, their phone and computer, each account’s statements since the scam began, and any police file number.
How long:: eight weeks by our estimate, a few calls at a time.

What the weeks after look like

List what the scammer can still get into

Go through our list together once, on a weekday, with the phone and the laptop in the room: about an hour, by our estimate.

Software installed on the computer. The Canadian Anti-Fraud Centre says a caller given access to the machine “may run programs or alter settings”, and sometimes asks the person to sign in to online banking while they watch. Whatever the caller installed or changed is still there.
The email account, and any rule inside it. A new password does nothing about a forwarding rule still copying each message to another address.
Saved cards. In shopping accounts, in the app store, in the browser.
Pre-authorized debits, including the ones set up years ago for something else.
Account numbers, statements and photographs of identification that were sent over, usually early on, and often without anyone mentioning it afterwards.
The Social Insurance Number, if it was given at all.
The phone number, and the calls. Some scammers keep calling, and every call with them is time not spent calling the bank.
The account holder’s name and number. They may now be on a list that scammers pass to each other.

the Canadian Anti-Fraud Centre where scams get reported nationally, which is not the same as being investigated

It gathers reports from across the country so that patterns can be seen. Your own case belongs to the local police force, and the Centre does not work it. It cannot move money either.

Work out how the money actually left

Each way money leaves has its own deadline.

Get every account’s statements for the whole period, not only the days you know about. Beside each debit, write the date, the amount, the name printed on the line, and how it left, such as an e‑Transfer, a card or a wire.

How it left decides what can still be done: Why some money can be pulled back, and some cannot.

Was the money taken, or did the account holder send it?

Tell the bank which of the two happened; what it can do depends on it. The rules that cap what a person owes cover payments made without their permission. One the account holder was talked into making is usually harder for the bank to help with.

An e‑Transfer

What can still be done. If it is not yet deposited, the person who sent it can cancel it from the transaction history in their own online banking. Once it has been deposited, Interac says it cannot be reversed.

The window. Until it is deposited. If the recipient has autodeposit on, there is no window at all.

autodeposit an e‑transfer setting that puts the money straight in, with nothing to accept

Without it a transfer waits to be picked up, and that wait is the only window in which the sending bank has something to pull back. Switched on at the receiving end, there is no wait and no window. It is the recipient who turns it on, not the sender.

A pre-authorized debit, the arrangement that lets a company take an amount out of the account on a schedule

What to ask for. Ask the bank for reimbursement. You sign a declaration saying which of five grounds applies.

The debit was not authorized.
It was not drawn in accordance with the agreement.
It came out on the wrong date.
It came out for the wrong amount.
It came out after the agreement had been cancelled.

The window. 90 calendar days from the date the money came out of the account. After that the institution does not have to reimburse anything.

Stopping the next one. Notify the biller in writing and keep a copy. Under Payments Canada’s rules the biller must cancel the agreement within 30 days of that notice.

What a stop payment does not settle. Asking the bank to stop a payment blocks a withdrawal. It does not end the agreement, and ending the agreement does not cancel the underlying contract or what is owed under it.

A credit card

The call. Telephone the issuer without delay and say which lines were not authorized. On the same call, ask how many days you have to dispute a charge.

Who sets the deadline. The card network, not your bank. Your issuer can tell you which network your card runs on.
Visa and Mastercard. Both publish 120 calendar days for a disputed charge, and each counts from its own starting day.
Whose deadline it is. Those 120 days are the limit for the dispute to have been processed, not for you to report it. Yours is earlier by however long your bank takes, so call now.

What you can be made to pay. For a card issued by a federally regulated institution, the most a cardholder can be held to for use without their permission is $50. The exception is gross negligence in safeguarding the card and its details, which Quebec calls gross fault.

a chargeback asking whoever issued your card to reverse a charge

It runs through the card network, so you raise it with the card issuer rather than with the merchant. There is a deadline, and it runs from the day the transaction went through, not from the day you noticed. Cards only, not transfers.

federally regulated a bank, rather than most credit unions

It decides which written rule your money falls under. Banks answer to a federal regulator and to the rules that come with it. Most credit unions are provincially regulated and set their own terms instead, which can be better or worse but are not the same rule.

gross negligence the exception that takes away the limit on what you can be made to pay

The cap on what a cardholder can be made to pay for use they did not permit has one way out, and this is it: not looking after the card and its details. Quebec calls the same thing gross fault. It is the institution that claims it, not you.

A debit card

The call. Tell the card issuer as soon as anybody becomes aware of it.

How long they have to answer. Under the Canadian Code of Practice for Consumer Debit Card Services, the institution that issued the personal identification number (PIN) must respond as soon as possible, and within 10 business days at most.

What the answer turns on. A cardholder who helped the loss happen without meaning to, and who cooperates with the investigation, is not liable. One who voluntarily disclosed the PIN, including writing it on the card, is.

A wire, or a bank draft

The call. Telephone your own bank as soon as you know and ask them to attempt a recall. Payments Canada says a wire is final once the money is in the other account.

A bank draft. Once it has been handed over, it cannot be cancelled, National Bank says. One still in your hands can go back to the branch, with its copy, for a refund.

Where it goes as well. Local police, and a report to the Canadian Anti-Fraud Centre.

a recall the sending bank trying to pull a payment back before it is collected

You ask your own institution to attempt it; you cannot do it yourself. Whether it works depends on how the money went and whether it has already been collected. An Interac e-Transfer not yet deposited is not recalled but cancelled, which the sender can do directly.

Cash handed over

There is nothing to reverse. Nothing at the bank or anywhere else can undo it.

Where it goes instead. Local police. The Anti-Fraud Centre says to contact them as soon as possible, because investigating is their job, not its own. A courier at the door, or an envelope handed over, gives the police a description, a vehicle and an address.

Gift cards

The call. Tell the company named on the card, through its own website, not on a number from whoever asked for the cards.

How to reach them. Apple asks you to contact Apple Support online. Amazon.ca asks you to log in and contact Customer Service. Google has a report form that only the person scammed can file, and says it cannot issue a new card for one a scammer has used.

A card nobody has the numbers for yet. Steam says it can go back to the shop that sold it. For one already read out, it says to keep the card and the receipt, and report it to police.

Where it goes as well. Local police, and a report to the Canadian Anti-Fraud Centre.

Cryptocurrency, sometimes called crypto

What can be done. The Centre says a completed transaction is very unlikely to be reversed.

The call, all the same. Straight away, tell the trading site or wallet the money went through, and the bank it came from. The British Columbia Securities Commission asks for both.

Where it goes as well. Local police, the same as cash handed over.

What is coming in 2027, not yet law

Today you can ask your bank to switch off e‑Transfers, wires or global money transfers on an account. It is a request, not a right.

Proposed rules would make it a right from 1 July 2027, if they are made as drafted.

Change the email and phone passwords first, then the bank’s

Our order, not the order they occur to you.

Email and phone first. Whoever controls the email or the phone can reset every password you change after that.

The email account and the cell number. A new password you have not used anywhere else, and two-step verification turned on, so signing in also needs a code sent to you. Then look for:
- A forwarding rule, a setting that sends a copy of each email to another address.
- An added recovery address, a second email address that can reset the password.
- A divert on the phone line, which sends the calls on to another number.
Remote access removed. Remove anything that lets somebody else see or control the screen, or have a repair shop you found yourself do it.
Banking sign-in. A new password used nowhere else, two-step verification on, new answers to the security questions, and a look at which devices are still trusted.
Account and card numbers. Ask for all of them to be reissued in one request.
Pre-authorized debits, one at a time. A separate letter to each biller. The 90 calendar days to claim a debit back count from the date each debit came out.
The credit bureaus. Both of them.
The Social Insurance Number, only sometimes. A new number is almost never the answer: why a new one usually does not help.

a credit bureau the two companies that keep the credit file lenders check

In Canada they are Equifax and TransUnion. They hold the file that says what credit is open in your name and how it has been paid. They are private companies rather than a government office, and each keeps its own file.

Ask both credit bureaus to flag the file, or freeze it

A fraud alert tells lenders that a person may have been defrauded, and asks them to contact you and confirm who they are talking to before approving any credit. The bureaus may ask for identification. Equifax’s Fraud Alert is free. TransUnion’s is free for now, and lasts six years.

Equifax also has an Identity Alert, which goes further in two provinces. With Equifax’s Identity Alert, a lender in Manitoba or Ontario must check it is you. With its other alert, or in any other province, a lender is asked to check but does not have to.

a credit freeze a block that stops a credit bureau sharing your file with a new lender

Ontario and Quebec law let you ask Equifax and TransUnion not to give your file to a lender who would open new credit. Neither bureau charges for it, and each has to be asked separately. Equifax calls it Credit Lock. Everywhere else, the option is a fraud alert instead.

A freeze is available in two provinces

Quebec and Ontario oblige both credit bureaus to freeze a file on request, and neither charges for it: Quebec since 1 February 2023, Ontario since 1 July 2026.

How fast. Online or by telephone it is immediate at Equifax. In Ontario the outside limits the law allows are two business days for a request made electronically, five by telephone and fifteen by post.
What it does. That bureau may not hand your file or your score to a business opening new credit, raising a limit, writing a mortgage or leasing a car. It tells them the file is frozen instead.
What it does not do. A freeze at one bureau does nothing at the other, so place both. It has no effect on the credit score, and none on a collection agency telephoning.
Taking it off for a while. Equifax lets you suspend a lock for a set period, after which it goes back on by itself. Ontario’s law does not oblige either bureau to offer that until 1 July 2027, so at TransUnion you may have to take the freeze off and put it back.
Everywhere else in the country. The option is the fraud alert. British Columbia’s own freeze is due in August 2027.

What Service Canada says about a new Social Insurance Number (SIN):

You do not need to tell the SIN Program that you think a number is being used by somebody else.
A replacement is issued only where there is proof the old number was used to commit fraud.
A replacement does not erase the old number, and does not stop it being misused later.
Holding more than one can raise the risk rather than lower it.
Service Canada cannot correct a credit file.

For most families, watch the credit file and the tax account instead of applying for a new number.

To ask for a new number, Service Canada wants:

A police report.
A letter from a creditor confirming the fraudulent use.
Valid identity documents.

Where employment is involved it also wants:

A Canada Revenue Agency printout of every employer that issued a T4 under the number.
A photograph.
An address history.

Call the bank, the police and the credit bureaus on numbers you looked up

If someone calls saying they are from the bank, the police or a bureau, hang up. Call back on the number on the card, on a statement, or in this list.

The bank or credit union the money left from, today. The bank’s number is on your card or a statement. No card? Type your bank’s web address in yourself. Do not follow a link in a message.
Local police, as soon as possible, the Anti-Fraud Centre says. Ask for a file number. If money left a bank account, call the bank first.
The Canadian Anti-Fraud Centre, on 1-888-495-8501 or online through Report Cybercrime and Fraud. We would report it the same day. Phone hours: Monday to Friday, 10am to 4:45pm Eastern. Closed on holidays.
Equifax Canada on 1-800-465-7166, and TransUnion Canada on 1-800-663-9980, for the fraud alert. Call both; we would do it the same day you find out.
A credit freeze at Equifax, Ontario and Quebec only (Equifax calls it Credit Lock), on 1-866-828-5961, or through myEquifax.
A credit freeze at TransUnion, Ontario and Quebec only, on 1-800-663-9980, or at ocs.transunion.ca.
The Canada Revenue Agency on 1-800-959-8281, for a list of the employers who have issued T4 pay slips under the Social Insurance Number, if someone may be working under it.
A Service Canada Centre, in person, only to ask for a new Social Insurance Number, and only with proof that the old one was misused.
If the bank says no, complain to the bank in writing, then to the Ombudsman for Banking Services and Investments. The order and the deadlines are in the directory: Your bank won’t pay you back, or hasn’t answered.

The part that catches families out

Make most of these calls with the account holder on the line, on speaker. As far as we have found, a bank will not discuss an account with a family member who has no authority on it.

The account holder can also name a trusted contact person on each investment account. That person gets no authority, but the firm can call them when something looks wrong. The steps are in Nothing has happened yet, and I want to get my parents’ accounts ready.

a trusted contact person a name on an investment account that the firm is allowed to telephone

It hands over no power at all: a trusted contact cannot trade, cannot see balances and cannot move money. The firm decides whether to call, and it may only call if a name and a written consent are already on file. This is not a power of attorney.

Hang up on anyone who offers to return what you lost

A first loss can bring a second approach, about the same money.

“He’d never fall for it again.”

Hang up, then report the call to the Anti-Fraud Centre on 1-888-495-8501. The Centre says neither it nor the police will ever ask anybody to transfer funds or make any payment, and never to pay an advance fee to get a refund.

The Anti-Fraud Centre calls this a recovery pitch: someone scammed once is approached again about the money they lost, by telephone, fax, email or text.

The pitch asks for an advance fee to release the funds, or for access to the computer and a sign-in to online banking. Sometimes it is presented as an investigation the person is asked to help with.

How much recovery pitches take

Losses to recovery pitches reported to the Anti-Fraud Centre more than doubled in 2023, to over $1.6 million.

The Centre estimates that only 5 to 10 of every hundred frauds are reported at all, so the real figure is well above that, by an amount nobody knows.

Our rule for any call in these weeks: if it came to you, hang up and call back on a number you looked up.

What comes before this is on two pages: How the money leaves, and the last person who can stop it and What happens after the money is gone, and who calls next.

Common questions

They are still talking to the scammers. Do I make them stop?

You cannot, and trying tends to move the conversation somewhere you cannot see it. Stopping the calls is theirs to do.

What you can do with them now is List what the scammer can still get into and close each thing on it. That works whether the calls continue or not.

Is there any chance the money comes back?

Usually not. The calls can still stop money that has not left yet and get the passwords and card numbers changed. They also get you a police file number, which the bank and both credit bureaus will ask for.

Anybody who contacts you offering to return the money is running a second scam: Hang up on anyone who offers to return what you lost.

Do I have to tell my brother and sister?

Ask your parent; it is their decision, not yours. Eight weeks of phone calls is a lot for one person, and most of them can be shared out.

But every extra person is another person who knows, and your parent may want as few people as possible to know.

He wants to leave it and never speak about it again.

Many people want that. Offer to do the paperwork yourself, with him signing what has to be signed, and no conversation about what happened.

The paperwork is what closes the ways in. The talking can wait a year, or never happen.

Am I going to be doing this every year now?

No. Steps one to five are done once. What repeats is a check once a year, about twenty minutes by our estimate, of the limits, any new accounts and the pre-authorized debits.