Fraudulent Interac E-Transfer: Prevention and Next Steps
Choose a security question that does not reveal the answer and verify the recipient’s details separately.
In this article
Transfer fraud forces no safe. It imitates a legitimate message at the right moment (new number, new payment address) and lets the victim make the transfer themselves. Once accepted by the fraudster's recipient, a transfer is rarely recovered. Everything therefore rests on prevention, which comes down to three rules. For the security question, when a send requires one, choose an answer that cannot be guessed, is never contained in the question and travels through a channel other than email. For changes, confirm any change in payment details through the old channel: a call to the number already known, not the one in the message announcing the change. This rule blocks most fraud. For evidence, keep send confirmations and deposit notices, time-stamped. If fraud strikes, reporting immediately to the institution and then the authorities is the only factor that improves your odds. This article details the three rules and the hour-by-hour procedure after a transfer has gone to the wrong place.
Choose a security question that cannot be guessed
An Interac e-Transfer protected by a security question rests entirely on that question's quality. The common ones (the dog's name, the city of birth, the rent amount) are often guessable from social media or from the transaction's context, and an intercepted email supplies the rest. A good question turns on a fact known only to the two parties and absent from all correspondence: a detail from a past conversation, something that appears neither in the listing nor in the written exchanges. Send the answer through a channel other than email, ideally spoken aloud.
Verify the recipient through an independent channel
The costliest fraud does not attack the transfer itself, it changes the recipient. An email impersonating a notary, a contractor or a supplier announces a change of banking details and diverts a significant payment. The defence stays the same: before sending, confirm any change of details by phone, at a number known in advance rather than the one in the email. The check takes two minutes. It is the only real protection, since a transfer once deposited is in practice unrecoverable. The same principle applies to a first payment to any new payee.
Keep proof of the sending and the deposit
The deposit notice is the only confirmation that the money reached the right account. Keep it as you would a receipt. The sending email, the deposit notice and the statement line together form the file you need in a dispute with the payee. That file matters most for payments without an invoice, such as a deposit to a contractor or a purchase between individuals, where nothing else attests to the payment. Also keep screenshots of the listing and the exchanges, since an online listing often disappears as soon as the transaction closes.
Report fast, to the institution and the authorities
After a fraud, the useful window is measured in hours. Contact the institution immediately: a transfer not yet deposited can sometimes be cancelled, a compromised account can be frozen, and prompt reporting affects how the file is examined. Then file a police report, with its file number, and a report to the anti-fraud centre, which feeds investigations even without individual recovery. Assemble the file in parallel: chronology, original emails with their headers, transfer notices, file numbers obtained. The outcome stays uncertain, liability depending on the circumstances, but a late report almost always closes the door.
Quebec scenario
The message is a near-perfect imitation of her landlady's: new number, rent transfer to a new email address. A tenant in Farnham complies. Three days later the real landlady asks for the rent, and the fraud comes to light. The transfer, auto-deposited through a hijacked address, is gone. She reports it right away, to her institution and then the authorities, which opens a file. The outcome stays uncertain: a transfer accepted by the fraudster's recipient is rarely recovered. The experience changes her whole transfer practice. First the security question, for sends that still require one: never a guessable answer, never the answer inside the question, and the answer delivered through a different channel than email. Then verification: any change in payment details gets confirmed by calling the number already known, never the number supplied in the message announcing the change. That rule would have prevented everything. Finally evidence: she now keeps the send confirmation and deposit notice of every transfer, time-stamped. Her landlady, once informed, discovers her email had been compromised for weeks. The advisor points out that auto-deposit protects in one direction only: it removes the security question, but not the need to verify the recipient.
Checklist
- Choose unguessable security questions
- Send the answer through a separate channel
- Verify any detail change through the old channel
- Call the number already known, never the new one
- Keep send confirmations and deposit notices
- Enable auto-deposit knowing its limits
- Report to the institution immediately in fraud
- File with the authorities next
- Document every step with dates
The questions we get
A question about your situation?
A Quebec broker answers, with no commitment.
Read next
// Banking
Bank Draft or Certified Cheque for a Large Payment
Know whether the funds are withdrawn or set aside, and how the recipient will verify the payment’s authenticity.
// Banking
Joint Account at Death: Access, Estate and Evidence
The agreement sets the holders’ rights, but the institution may freeze the account: prepare the required evidence.
// Banking
Choose a Chequing Account for Your Actual Transactions
Count your actual debits, transfers and withdrawals in a typical month before choosing a chequing package.