The Financial Consumer Agency of Canada (FCAC) has issued a compliance bulletin to remind federally regulated financial institutions that they must fully investigate allegations of unauthorized transactions on credit and debit cards.

In the bulletin released July 25, FCAC stated that financial institutions “must investigate whether the circumstances that lead to the unauthorized transactions were beyond the cardholder's control and must take into account all relevant factors before making a finding of liability against the consumer.” The agency added that financial institutions must not hold cardholders automatically responsible for unauthorized credit or debit transactions based solely on the fact that the transaction was completed using authentication technology, such as the correct PIN.

Advice for consumers

FCAC added that consumers also should be vigilant by keeping their devices secured and cards and PINs safe. The Agency urges consumers to select a PIN that someone cannot easily figure out (e.g. avoid using a birthday or telephone number). The agency also advises consumers to cover the keypad when entering their PIN and never share their debit or credit card PIN with anyone, “including a spouse or other family member.”

FCAC says it expects financial institutions to abide by their market conduct obligations with respect to unauthorized credit and debit card transactions. It warns that it will investigate cases of non-compliance.

Liability for unauthorized use of a credit card

The compliance bulletin highlighted the following facts regarding unauthorized transactions and liability:

  • “By law, a consumer's maximum liability for unauthorized use of a credit card issued by a federally regulated financial institution is $50.
  • Visa, MasterCard and American Express have zero liability policies that protect consumers beyond the legislated $50 maximum liability.
  • Under the Canadian Code of Practice for Debit Card Services, consumers are not liable for debit card losses resulting from circumstances beyond their reasonable control.
  • Interac has a zero liability policy that protects debit card users.”