Report fraud to your bank and the losses are supposed to stop there.
Once the bank receives the report, later unauthorized credit-card charges are supposed to be the bank’s problem, not the customer’s. That is federal law, not customer service. Debit-card users receive similar protection under an industry code signed by most banks — a voluntary commitment, not a statute.
Yet the Ombudsman for Banking Services and Investments (OBSI) found banks doing the opposite: holding customers liable for fraudulent transactions that occurred while they were trying to report the fraud. OBSI identified the practice as one of two systemic banking issues in its 2025 annual report.
This is not a quarrel over an obscure technical rule. The Bank Act says a customer is not liable for unauthorized credit-card use after the bank receives the report. It also says that use of the correct personal identification number does not, by itself, prove gross negligence. Yet the PIN is often the bank’s answer: it was entered, so the customer must have failed to protect it. The law rejects that shortcut. OBSI found that some banks used it anyway.
OBSI, which must report systemic issues to the Financial Consumer Agency of Canada (FCAC), the banks’ supervisor, did its job. It investigated the complaints, recognized a market-wide problem and referred it to the regulator.
That’s where the public trail ends.
FCAC may be investigating. It may have required repayment or other corrective action. It may have decided none was warranted. Its supervisory work is confidential, so consumers cannot tell whether the practice has stopped, how widespread it is or whether anyone was repaid.
That is not merely an information gap. It is the absence of visible regulatory consequence.
Ottawa’s proposed fraud regulations, published for comment on June 27, do not answer the problem. They would take effect on July 1, 2027. Banks would collect their first full year of data in 2028 and report it to FCAC in May 2029. FCAC would then prepare a report for the finance minister. The law protects bank- and victim-identifying information, but does not require the consolidated report to be made public.
Consumers therefore face a systemic problem now while Ottawa builds a reporting system that will produce nothing until 2029 and even then, may tell the public nothing.
Cost to complaining
OBSI’s second banking finding shows the same imbalance in a different form. The Bank Act requires a bank to tell dissatisfied customers that they can take a complaint to OBSI. Some banks apparently attach a price to using that right.
How? A bank makes a settlement or goodwill offer. The customer remains dissatisfied and asks OBSI for an independent review. The bank then withdraws the offer — or threatens to — because the customer went to the ombudsman.
The choice is empty. Accept the bank’s offer, or exercise their right to review and risk losing the offer altogether.
That is not complaint resolution. It is an offer converted into leverage.
A bank may have the legal right to withdraw an unaccepted offer, and OBSI cannot force the bank to keep it open. But that doesn’t mean the practice is fair.
Independent review exists because the bank controls the internal process and the customer does not. Withdrawing an offer when the customer seeks outside review renders that safeguard useless.
The economics make the tactic effective. The amount at stake may be too small to justify a lawyer but too large for the customer to absorb. OBSI can recommend compensation but cannot compel payment. The regulator is therefore the only institution positioned to stop the practice across the market.
That is why silence matters. A regulator’s authority has little deterrent value when the market cannot see whether it was used. FCAC need not reveal confidential supervisory details to show that the system works. It can identify these practices as supervisory and enforcement priorities. It can report, in aggregate, whether they have stopped and whether affected customers received redress. It can enforce the credit-card liability rule already in law instead of waiting for a data regime that starts reporting in 2029.
FCAC should also state that withdrawing an offer to deter independent review is inconsistent with fair complaint resolution. If it believes it lacks the authority to impose that expectation, it should say so and seek the authority.
Two systemic banking problems have been identified. In the first, the bank charges the customer for fraud reported in real time. In the second, it penalizes the customer for seeking the review it was required to offer. Both strike when the customer is most exposed. Both have been formally identified. Neither requires another study.
The rules exist. OBSI has produced the evidence. FCAC has the file.
What remains missing is a public answer — and, for the customers still out the money, redress.
