TL;DR: Scammers impersonate Canadian banks like RBC, BMO, CIBC, TD and Scotiabank to steal logins and one-time codes. Verify through the official app or the number on your card, and report scams to the Canadian Anti-Fraud Centre.
👉 Check my digital footprint — free 30-second check →
How bank impersonation scams work
These scams usually reach Canadians as a text, email or phone call posing as the bank's security team. The message talks about unusual activity, a frozen card or an account that must be verified, and pushes you to respond at once. It sends you to a fake login page or asks for the passcode that was just sent to your phone.
Red flags
Canadian banks follow consistent rules that scam messages routinely break:
- Pressure to act now: a warning that your account closes shortly is a standard scare tactic.
- Passcode requests: an OTP is meant for you only, and no bank agent needs it read out.
- Suspicious links: check the address before tapping, because scam sites often copy a bank's name with small changes.
- Requests for a PIN or full password: a real bank never needs these.
- Spoofed caller ID: a call can display a genuine bank number and still be fake.
What to do if you get a suspicious message
Do not follow the link or ring the number in the message. Use the bank's official app, type its website yourself, or call the number on the back of your card. If you have already clicked, entered details or shared a code, change your password in the official app, contact the bank's fraud line and check the account for transactions you did not make. The sooner you move, the better the chance of stopping a transfer.
Reporting contacts by bank
These details come from each bank's own security pages. Always start from the official app or website, not a message.
BMO
BMO lists 1-888-340-2265 for fraud and asks you to forward phishing emails to phishing@bmo.com.
CIBC
CIBC lists 1-800-465-2422 for identity fraud and debit card fraud, and fraud@cibc.com for phishing and fraud reports.
Scotiabank
Scotiabank asks you to call 1-866-625-0561 to report fraud or suspicious activity on your account.
RBC
RBC has an official page for reporting email and website fraud, linked in the sources. Contact RBC through its official app or the number on your card.
TD Bank
Contact TD through its official app or the number on the back of your card.
Reporting to Canadian authorities
The Canadian Anti-Fraud Centre collects information on fraud and identity theft affecting Canadians. Report the scam there, and tell your bank at once if money has left your account.
More guides on this topic
Banking in another country? See the US bank scams guide or the UK bank scams guide. If a scammer used your details, read the Canadian identity theft guide.
Impersonation scams often start from leaked contact details. A free digital footprint check shows whether your email or number appears in exposed data.
Frequently Asked Questions
How do I know if a message from my bank is real?
Do not trust the message itself. Open the bank's official app or type its web address yourself, or call the number on your card. A real bank does not need your full password, PIN or one-time passcode.
What should I do if I gave a scammer my one-time passcode?
Change your password through the official app, call the bank's fraud line straight away and review recent transactions. Speed matters.
Where can I forward a phishing email?
BMO asks for phishing emails at phishing@bmo.com and CIBC lists fraud@cibc.com. For other banks, follow the instructions on the bank's own security page.
Where do I report a bank scam in Canada?
Report it to the Canadian Anti-Fraud Centre and tell your bank. Keep screenshots of the message.
Can a call showing my bank's real number still be a scam?
Yes. Caller ID can be spoofed. Hang up and call the number printed on your card.
Sources
- BMO – Report fraud
- CIBC – Report fraud
- Scotiabank – Security
- RBC – Report email and website fraud
- Canadian Anti-Fraud Centre