The charge you did not make, and how to get it back
A payment you never approved lands on your statement. In Canada the law caps what you can be forced to pay at $50, and zero-liability usually refunds the whole thing. But the protection has one condition most people never read: you have to report it in time. Here is exactly how, and the deadline that decides it.
You are scrolling your statement on a Tuesday night and a line stops you. A charge for $218.40 at a store you have never shopped at, in a city you have never been to. Your card is still in your wallet. You did not lend it to anyone. For a second your stomach drops, because it feels like the money is already gone.
It is almost certainly not gone. In Canada, the rules around an unauthorized card charge are unusually favourable to you, and the banks and card networks have made public commitments that go further than the law requires. But those protections are not automatic and they are not unconditional. They hinge on one thing you control: how fast you report it. Understand that, and the scary line on your statement becomes a form to fill out, not a loss to absorb.
Zero liability is real. It is also conditional, and the condition is you, reporting fast.
First, name which problem you actually have
Before you call anyone, work out which of two very different situations you are in, because they go through different doors and follow different rules.
Fraud, or an unauthorized transaction. Someone used your card, or your card number, without your permission. You did not make the purchase and you would never have. The Financial Consumer Agency of Canada defines this plainly: generally, any banking or credit card transaction that you did not make or approve. This is a fraud claim, and it is the one with the strongest protections.
A merchant dispute. You did make the purchase, but something went wrong. The goods never arrived, the item was not as described, a free trial quietly turned into a charge, a subscription you cancelled billed you anyway, or you were charged twice. You authorized the card; you are disputing the merchant. This goes through a different mechanism called a chargeback, and it has its own timeline.
People blur these two together and it costs them. Calling a billing mistake fraud can get your card cancelled and reissued for no reason. Calling fraud a billing dispute can send you back to argue with a merchant who is, in fact, a thief. Say the right word to the right department.
What zero liability actually promises
Start with the legal floor. When someone uses a bank-issued credit card without your permission, the Financial Consumer Agency of Canada states your maximum liability by law cannot be more than $50, unless you demonstrated gross negligence, which in Quebec is called gross fault, in safeguarding your card and your PIN or passwords. That $50 is the legal worst case, not the likely one.
On top of the law sit voluntary commitments from the card networks. Visa, Mastercard, American Express and Interac have all publicly committed to protect cardholders against financial loss when a card is used without permission, and in practice that usually means a full reimbursement, not a $50 deductible. Visa's Zero Liability Policy requires only that your card is in good standing and that you used reasonable care in safeguarding it. Mastercard's Zero Liability Protection asks that you took reasonable care, did not contribute to the unauthorized use, kept your PIN safe, and reported any loss or theft promptly. Interac extends the same zero-liability principle to debit through the Canadian Code of Practice for Consumer Debit Card Services.
Two honest catches. First, every one of those policies is conditional on reasonable care. If you wrote your PIN on the card, used your birth date as your PIN, or shared it with someone, the protection can fall away. Second, zero-liability commitments generally exclude some commercial cards and unregistered prepaid or gift cards, so read your own agreement rather than assuming.
The deadline that decides everything
Here is the part that quietly separates the people who get their money back from the people who do not. The reimbursement is conditional on you notifying your card issuer without delay. The FCAC is explicit: in some cases you must report the incident within a specific amount of time set by your account agreement, and if you do not, you may be held responsible for the transaction and you may not get the amount back.
For deposit accounts, like chequing or savings, the FCAC notes you usually have 30 days after the date of your statement to dispute a transaction, though this varies from one institution to another. Visa's policy is built on the same logic from the other side: it can withhold, delay or rescind a provisional refund based on a delay in reporting. The message is consistent everywhere you look. Speed is not a nicety here. It is the condition.
The bank does not decide whether you were defrauded before it decides whether you reported it in time. Report the day you see it, and you never have to find out where your window ended.
How to file a fraud claim, step by step
If the charge is one you did not make, work through this in order. It takes about fifteen minutes and most of it can be done from the banking app.
1. Lock the card first. Nearly every Canadian banking app has a freeze or lock toggle. Use it before you do anything else, so no further charges can land while you sort this out. If your physical card or phone was lost or stolen, report that as lost or stolen specifically, which is a stronger flag than a single disputed charge.
2. Change the exposed credentials. Change your online banking password and, if the same PIN or password is used elsewhere, change it there too. The FCAC lists this as a first step for a reason: the charge you can see may not be the only attempt.
3. Call the number on the back of your card, or use the app's dispute flow. Tell them clearly this is an unauthorized transaction you did not make, not a dispute with a merchant. Give the date, amount and merchant name exactly as they appear. Ask them to open a fraud claim, cancel the compromised card, and issue a new one.
4. Get a reference number and the reporting date in writing. The date you reported is the single most important fact in your file. Note the claim or case number, the name of the agent, and the time. If you started in the app, screenshot the confirmation.
5. Keep watching, and check your credit report. The FCAC advises continuing to monitor your accounts after you report, and checking your credit report for any credit you did not apply for, in case the same information was used to open something in your name. Both credit bureaus in Canada let you pull your report at no cost.
By law, once you report it, a federally regulated institution must always investigate, and must take all relevant factors into account before finding you at fault, regardless of how the transaction was processed, whether by PIN, magnetic swipe, tap or any other technology. A bank cannot simply say the correct PIN was entered and close the door.
When it is the merchant, not a thief: the chargeback
If you did authorize the purchase but the merchant let you down, the path is different and the order matters.
Contact the merchant first. This is not just politeness, it is strategy. Many problems, a double charge, an undelivered order, a trial that should have been cancelled, get fixed in one email or call. It is also faster than a chargeback, and your card issuer will generally expect to see that you tried. Keep the receipts, the order confirmation and any messages.
If the merchant will not fix it, ask your card issuer for a chargeback. A chargeback is the card network's formal mechanism for reversing a charge. Your issuer files it, usually credits you provisionally, and the merchant's bank can push back with evidence. The card networks set a window for these disputes, commonly measured from the transaction date or the date you expected delivery, and it is shorter than most people assume. Do not sit on it for months. Confirm the exact deadline with your issuer, because your cardholder agreement can be stricter than the network minimum.
One useful instinct that carries over from the rest of banking: the terms that govern all of this live in your cardholder agreement, and that document is public. The same habit that helps you spot a fee helps you spot your dispute window. We wrote a full guide on reading a bank account's fine print without falling asleep, and the unauthorized-transaction and dispute clauses are among the highest-value paragraphs in it.
Realistic timelines, so you know when to worry
Fraud claims do not resolve instantly, and knowing the rhythm keeps you from panicking on day three.
For a clear-cut fraud claim, expect a provisional credit fairly quickly. Visa's Zero Liability Policy requires issuers to replace funds taken by an unauthorized transaction within five business days of notification, though that credit is provisional and can be adjusted while the investigation runs. A new card typically arrives within a week or so. The formal investigation itself can take longer, and complicated cases longer still.
If the bank's answer disappoints you, there is a defined escalation path with real deadlines. Federally regulated banks are required to deal with a complaint within 56 calendar days. If they have not resolved it by then, or if they close your file with a final written response sooner, you can take it to the Ombudsman for Banking Services and Investments, which since November 1, 2024 is the single external complaints body for Canadian banks. OBSI's review is free and impartial, and it must give you and the bank a final written recommendation within 120 calendar days. Knowing this exists changes how you talk to the first agent: you are not at the mercy of one no.
The rule worth keeping
Card fraud feels like a violation, and it is, but financially it is one of the most recoverable problems in Canadian banking, precisely because the protections are strong and the process is defined. The law caps you at $50, the networks usually take you to zero, and the bank is legally required to investigate rather than shrug.
All of that rests on one small act you fully control. Report it the day you see it. Do not wait for the "real" statement, do not decide to deal with it on the weekend, do not assume a small charge is not worth the call. The protection is built around prompt notice, so give prompt notice, get the reference number and the date in writing, and let the machinery do its job. Pair that reflex with the everyday habit of actually reading your statements, the same habit that helps you catch a quiet NSF fee or an unexpected foreign transaction markup, and the charge you did not make stops being a fear and becomes a fifteen-minute errand.