Turn on Autodeposit and the part of an e-Transfer scammers attack disappears

Think about the last time you sent someone money by Interac e-Transfer. You typed the amount, you made up a security question, and then, more often than not, you sent the answer in the very next text message. "What's the password?" "It's maple, all lowercase." Millions of Canadians do exactly this every day without a second thought.

That security question is the entire lock on the transfer. And the habit of texting the answer beside it is like taping your house key to the front door. For most people the door never gets tried. But a rising number of fraud cases in 2026 come down to someone else reaching that lock first, and there is a free setting that removes the lock from the equation completely.

An e-Transfer is only as safe as its security question. Autodeposit deletes the question.

What actually happens when you send one

An Interac e-Transfer does not email money. It sends a notification, by email or text, that money is waiting, plus instructions to claim it. The recipient clicks the link, chooses their bank, and answers the security question you set. Answer correctly, and the funds move into their account. That is the whole mechanism, and it explains where the risk lives: whoever answers the question first gets the money. The system does not check that the person answering is the person you meant to pay. It checks that they know the answer.

Interac itself is clear on this. It tells senders to pick an answer that is not obvious and, critically, never to put the answer in the e-Transfer message or in the same channel. The reason is that the notification can be intercepted, and a question like "What city was I born in?" is often answerable from a quick look at someone's social media.

How interception fraud works

Interception fraud is not a hack of Interac. Interac's network is not broken. The attack is social. A fraudster gets access to a mailbox or phone, or gleans on personal details pulled from a data breach or a public profile, and uses that to guess or read the security answer on a pending transfer before the real recipient claims it. Answer first, and the money lands in the scammer's account instead. Because a claimed e-Transfer is generally treated as final, clawing it back afterward is difficult.

Canadian authorities have been flagging a fresh wave of this in 2026. New Brunswick's Financial and Consumer Services Commission has an active alert on phishing dressed up as e-Transfer notices, and RCMP in other provinces have warned the scams are becoming more common. The through-line is always the same weak point: the security question.

The network is not what gets broken. The security question is. Remove the question and there is nothing left for an interceptor to guess.

What Autodeposit actually does

Autodeposit is a free setting that links your email address or phone number directly to one of your bank accounts. Once it is on, any e-Transfer sent to that address lands in your account automatically. No link to click, no bank to choose, and, the whole point, no security question at all. There is nothing for a scammer to intercept because the transfer never pauses in a claimable state waiting for an answer.

It also quietly kills a second, more mundane problem: typos. Without Autodeposit, a transfer sent to a slightly wrong email address can sit in limbo or, worse, be claimed by whoever controls that address. With Autodeposit, an address that is not registered simply cannot auto-receive, so misdirected money is far less likely to vanish into a stranger's account.

The honest catches

Autodeposit is the single best move you can make here, but it is not a force field. Three things stay true, and pretending otherwise would do you a disservice.

The registration step is itself a scam target. Fraudsters send fake "register for Autodeposit" or "your Autodeposit needs re-verification" emails that link to a page designed to steal your online banking login. So set up Autodeposit only from inside your own bank's app or by typing your bank's address yourself, never by clicking a link in an email. A real setup never asks you to confirm your full banking password on some outside page.

A genuine e-Transfer notice has no attachment. Interac and the banks are consistent on this: a real e-Transfer notification never carries a file, not a PDF, not an HTML page, not a "receipt" to open. If a message asks you to open an attachment to claim money, it is phishing. Delete it.

Deposited money is hard to reverse. Autodeposit protects you as a receiver. It does nothing to undo a payment you send to the wrong person on purpose or by mistake. Once an e-Transfer is deposited, treat it like cash that has left your hand. Double-check the destination before you hit send, especially on a large amount.

The limits, and who really sets them

Here is a point that trips people up: Interac does not set your e-Transfer limits. Your bank does. Interac provides the rails, but each financial institution decides how much you can send per transfer, per day, per week, and per month, and those numbers vary a lot between banks and even between account types at the same bank.

As a rough shape of the landscape, many Canadian banks cap a single e-Transfer somewhere around one to three thousand dollars, with daily limits often in the range of a few thousand and rolling weekly and monthly ceilings above that. Those are illustrations, not promises. The only number that matters is yours, and it is printed in your own bank's e-Transfer terms or shown right in the send screen of the app.

Request Money, and one more soft spot

Many banks also offer Request Money, where you send someone a request and they approve the payment from their side. It is convenient for splitting a bill. It is also a channel scammers use, sending official-looking requests hoping you approve on reflex. The rule is simple: only approve a money request you were expecting, from a name you recognize, for an amount you agreed to. When in doubt, decline and message the person directly.

How to verify all of this yourself

You do not have to take this article's word for anything. Open your banking app and look for Interac e-Transfer settings; Autodeposit and your send limits are both there. For the fraud guidance, go to interac.ca directly, or read the plain-language e-Transfer fraud pages that most major Canadian banks publish, which describe interception fraud and the no-attachment rule in their own words. If a claim here does not match what your own bank tells you, trust your bank's current terms.

The rule worth keeping

An Interac e-Transfer is safe right up until the security question becomes a puzzle someone else can solve. The clean fix is to stop relying on the question at all. Turn on Autodeposit today, set it up only from inside your bank's app, and if you must send a transfer the old way, never text the answer alongside the notification. Do that and the most common e-Transfer scam in Canada simply has nothing to grab onto. For the everyday cost of moving money, our guides on what "no-fee" banking really means and how NSF fees work now pick up where this one leaves off.