This guide sets out the liability rules for credit and debit cards, the deadlines banks must meet, and the cases where you may not get your money back.

The short answer

If someone uses your bank-issued credit card without permission, the most you can owe by law is $50, unless you were grossly negligent. If it is your debit card, you are not liable for losses beyond your control, but you can be held responsible if you shared your PIN, kept it with the card or reported a lost card late. In both cases you need to tell your bank as soon as you notice.

The credit card cap is in section 627.33 of the federal Bank Act. The debit card rules come from the Canadian Code of Practice for Consumer Debit Card Services, which the Financial Consumer Agency of Canada (FCAC) publishes. These protections apply to federally regulated institutions such as banks and federal credit unions.

Who pays: credit card vs debit card vs a payment you made

Sources: Bank Act s. 627.33, current to September 30, 2026; Debit Card Code sections 5 and 6; FCAC guidance modified 2025-09-02 and 2025-10-15. Debit losses can exceed your account balance if a line of credit or overdraft is linked.

Credit cards: the $50 cap and what gross negligence means

For a credit card a bank issued to you in Canada, the Bank Act sets your maximum liability for unauthorized use at $50. The exception is gross negligence, or gross fault in Quebec, in protecting the card, the account details or your PIN and passwords.

The Act does not list examples of gross negligence. FCAC’s guidance focuses on the basics: keep your card, account details and PIN safe, and never share your PIN, even with family.

On top of the legal cap, FCAC notes that Visa, Mastercard, American Express and Interac have publicly committed to protect cardholders from losses when a card is used without permission. If you took reasonable care, the issuer usually reimburses you in full.

Debit cards: when you are covered and when you are not

Section 5 of the debit card code says you are responsible for all authorized use of your card, and you are not liable for losses from circumstances beyond your control. FCAC gives examples such as technical problems and use of a card you already reported lost or stolen.

The code then lists the ways you can contribute to unauthorized use and become liable:

• Voluntarily disclosing your PIN, including writing it on the card.
• Keeping a poorly disguised written record of the PIN near the card.
• Not telling the issuer within a reasonable time that the card was lost, stolen or misused.
• Not telling the issuer that someone else may know your PIN.

Even then, your loss cannot exceed the card’s withdrawal limits. FCAC warns that it can exceed your account balance if the account is linked to overdraft protection, a line of credit or other accounts.

A correct PIN is not proof you did it

FCAC says a federally regulated institution cannot hold you responsible just because the correct chip and PIN or another authentication method was used. It must fully investigate and consider things beyond your control, such as being forced to use the card, card theft, a system malfunction or someone watching you enter your PIN. Under the code, the issuer has to show, on the balance of probabilities, that you contributed to the loss.

When the protection may not apply

FCAC describes an unauthorized transaction as one you did not make or approve. That leaves a gap for scams where you send the money yourself, such as an Interac e-Transfer to a fake buyer or a payment to someone posing as your bank. In FCAC’s 2024 briefing to the House finance committee, it called liability for fund transfers a complex area. A refund in those cases is not guaranteed.

Two other limits matter. Provincially regulated credit unions and caisses follow their own rules, so check your member agreement. And for chequing and savings accounts, FCAC says you usually have 30 days after your statement date to dispute a transaction, though this varies by institution.

A worked example: a skimmed debit card

Say you check your account on Monday, November 2, 2026, and find $1,140 in debit purchases you did not make. Your card was copied at a tampered terminal, you never shared your PIN, and you report it to your bank that day. Here is how the deadlines could fall:

Hypothetical example. Days were counted by script from the day after the report, skipping weekends. If your bank treats November 11 as a holiday, the last day moves to November 17.

Because skimming is beyond your control, you should not be liable for any of the $1,140. If the bank asks for a signed statement, the 10-day clock can pause until you return it, so send it quickly.

If the bank refuses and you file a written complaint on November 18, it has 56 days to resolve it, which runs to January 13, 2027. If its final written response arrives on December 15, 2026, you have 180 days, until June 13, 2027, to take the case to the Ombudsman for Banking Services and Investments (OBSI).

Had the same $1,140 been charged to a bank-issued credit card, the legal cap means you would owe at most $50, so at least $1,090, or 95.6% of the charges, would be protected. In practice the network commitments often cover the full amount.

What to do if you see a transaction you did not make

1. Lock things down. Change your passwords and PINs, and freeze or lock the card in your app if it lets you.
2. Call your bank or card issuer immediately. List every transaction you did not make or approve, and write down the date, time and reference number of the call.
3. Send anything the bank asks for promptly. A requested signed statement can pause the debit card investigation clock.
4. Check your credit report. FCAC suggests looking for credit you did not apply for. If it was a scam or identity theft, also report it to the police and the Canadian Anti-Fraud Centre.
5. Complain in writing if the answer is no. Use the bank’s complaint process and keep a copy. After a final response, or once 56 days pass, you can go to OBSI, which can recommend up to $350,000 per complaint.

If fraud empties your account and a payment then bounces, see the $10 NSF fee cap. For how deposits are protected if a bank itself fails, read our guide to CDIC coverage.

Frequently asked questions

• Sources, checked October 25, 2026: Bank Act, s. 627.33, current to 2026-09-30; Canadian Code of Practice for Consumer Debit Card Services, sections 5 to 7 (FCAC, modified 2025-09-24); FCAC: Unauthorized credit and debit transactions (modified 2025-10-15); FCAC: Resolving an unauthorized transaction (modified 2025-09-02); FCAC briefing to the House finance committee, May 31, 2024 (modified 2025-09-02); FCAC: Single external complaints body for banking (November 1, 2024); OBSI: FAQs; Interac Debit: Zero Liability Policy.
• Method: Business days in the example were counted by script from Monday, November 2, 2026, skipping weekends, and cross-checked with a second business-day function. The 56-day and 180-day dates are calendar days, checked two ways. The 95.6% figure is ($1,140 minus $50) divided by $1,140.

Important: This guide is general information, not legal or financial advice. Your account and cardholder agreements set specific reporting deadlines, and provincially regulated credit unions follow their own rules. Gizly is not paid by any institution mentioned here. See our affiliate disclosure.