The bank investigator scam in Canada: what your bank and police will never ask you to do
The phone rings. A calm voice says there is fraud on your account, reads off the first digits of your card, and asks for your help with an "investigation". Everything about it is designed to feel official. This guide explains how the scam works, the requests that give it away, and exactly what to do if you are on the phone right now or already said yes.
On this page
Is this call a scam? Quick checker
Tick everything the caller asked or did
Every item comes from the Canadian Anti-Fraud Centre's bank investigator warning. No checker can clear a call as safe: if anything feels off, hang up and call the number on the back of your card yourself.
How the bank investigator scam works
The Canadian Anti-Fraud Centre (CAFC), run by the RCMP, describes the pattern this way:
- The call. You get a call, often automated, claiming to be your financial institution, law enforcement, a credit reporting agency or even Amazon, saying there are fraudulent transactions on your account.
- The "investigation". The caller asks for access to your computer or device. You may be shown a fake fraudulent transaction, then asked to help catch the criminals by sending funds.
- The payee trick. In some cases, they add a payee with a fraudulent email address and tell you to transfer a large amount to protect your account. They convince you they have added funds to your account, when the money actually came from your own line of credit or savings.
- The code. If they already have your card number and password but are blocked by multi-factor authentication, they ask you to read out the code you just received "to confirm your identity". That code gives them full access.
- The home visit. They say they need to collect your debit or credit card as evidence, may tell you to cut it in half without damaging the chip, and may threaten arrest if you refuse.
What real institutions never ask
From the CAFC's list of warning signs:
| A real bank or police officer | A bank investigator scammer |
|---|---|
| Never asks you to turn over your bank card or comes to your home to pick it up | Sends a "courier" or "officer" for your card |
| Never asks you to transfer funds to an external account for security reasons | Says moving your money keeps it safe |
| Never threatens you over the phone | Mentions arrest or charges if you hang up |
| A credit bureau does not randomly call you unless you asked for a call back | "This is Equifax" or "TransUnion fraud department" |
| The CAFC's rule: never share a code you received by text or email with anyone | Asks you to read the code out "to verify you" |
The CAFC also says never to give anyone remote access to your computer, and that turning on Autodeposit for Interac e-Transfers adds a layer of security. Our e-Transfer scams guide covers the other common e-Transfer tricks.
Why it feels real
- Spoofed caller ID. The CAFC warns that criminals use call spoofing, so the number on your screen can look exactly like your bank's. Do not trust caller ID.
- The first digits of your card. Fraudsters often recite the first 4 to 6 digits. The CAFC explains these are the Bank Identifier Number, shared by most cards from the same issuer, so knowing them proves nothing.
- Your real details. If your information leaked in a breach or a past phishing message, scammers use it to sound legitimate.
Card number, CVV and PIN questions
A common Reddit question is whether a bank would ever ask for the CVV on the back of your card over the phone. The CAFC's bank investigator page does not publish a rule about CVVs specifically, so we will not claim one. What it does give you is a method that works for every version of the question: if they called you, you call them back. Tell the caller you will call back, hang up, and dial the number on the back of your card, from a different phone if you can or after waiting 10 minutes. A real bank will be fine with that. Any caller who pushes back has answered your question.
The same applies to text messages. The CAFC's phishing guidance says not to click links in unsolicited messages and not to trust a message just because the sender's address looks legitimate.
Worked example: the line of credit switch
Priya gets a 6:40 a.m. call saying $1,200 of fraud is on her chequing account. The caller says the bank has moved $8,000 into her account as a temporary credit and asks her to send $8,000 to a "secure holding payee" they just set up.
- What really happened: with remote access, the scammers moved $8,000 from Priya's own line of credit into chequing. Nothing came from the bank.
- If she sends it: chequing is back where it started, and her line of credit now owes $8,000 she never meant to borrow, plus interest.
- The cost of that interest alone: at an illustrative 10% a year, $8,000 × 10% ÷ 12 = $66.67 a month while it stays unpaid.
This is the CAFC's payee scenario with numbers attached. The giveaway was the request to move money for security, which institutions never make.
If you already said yes: the first hour
The CAFC's steps for victims of fraud:
- Stay calm and gather everything: call times, numbers, texts, emails and receipts.
- Call your financial institution using the number on your card and report the incident to the institution that sent the money. If your identity was used, ask for flags on your accounts and change all your passwords.
- Report it to both credit bureaus, Equifax and TransUnion, if your identity was compromised.
- Report to your local police and get a file number.
- Report to the CAFC online through Report Cybercrime and Fraud, or by phone at 1-888-495-8501, Monday to Friday, 10 a.m. to 4:45 p.m. Eastern.
- Watch for a second call. The CAFC warns fraudsters often target victims again with offers to recover the money. Never pay recovery fees.
For card charges you did not authorize, our guide to unauthorized transactions explains how to dispute them, and if you sent an e-Transfer to the wrong person by mistake, see what to do after a wrong e-Transfer.
Options people use to protect themselves
| Option | What it does |
|---|---|
| A call-back rule at home | Everyone agrees: no money moves on an incoming call, ever |
| Interac Autodeposit | The CAFC calls it an extra layer of security for e-Transfers |
| Account and low balance alerts | Banks must alert you when your balance or available credit falls below $100 or an amount you set |
| Multi-factor authentication | Blocks login without your code, as long as you never share the code |
| Regular credit report checks | FCAC says checking your report helps detect fraud and identity theft |
More money tools are on the tools page.
What to do when someone calls claiming to be your bank
- Do not confirm any details, codes or card numbers to the caller.
- Tell the caller you will call back, then hang up.
- Wait 10 minutes or use a different phone, because caller ID can be spoofed.
- Call the number on the back of your bank card and ask if there is a real problem.
- If you already shared a code, sent money or gave remote access, report it to your bank right away.
- Report the call to the Canadian Anti-Fraud Centre at 1-888-495-8501 or online.
- Ignore anyone who later offers to recover your money for a fee.
Questions people ask
Will my bank ever call me and ask me to move money to keep it safe?
No. The Canadian Anti-Fraud Centre says institutions or online merchants will never ask you to transfer funds to an external account for security reasons. Treat that request as a scam.
Would police or my bank come to my house to pick up my card?
No. The CAFC says institutions or police will never ask you to turn over your bank card or come to your residence to pick it up, and they will never threaten you over the phone.
Is it safe to read out the code my bank texted me?
No. The CAFC says not to share codes received by text message or email with anyone, because in most cases they are multi-factor authentication codes that give fraudsters access to your account.
The caller knew the first digits of my card. Does that prove it is my bank?
No. The CAFC explains that the first 4 to 6 digits identify the card issuer and are shared by most cards from that issuer, so scammers can recite them easily.
Can my bank ask for my CVV over the phone?
The CAFC does not publish a specific rule on CVVs. The safe method is the same for any request: tell the caller you will call back, hang up, and call the number on the back of your card yourself.
The call came from my bank's real number. Is it legitimate?
Not necessarily. The CAFC warns criminals use call spoofing, so the number on your display may not be accurate. Hang up and call your bank, ideally from a different phone or after 10 minutes.
Who do I report a bank investigator scam to?
Your financial institution first, then your local police for a file number, and the Canadian Anti-Fraud Centre online or at 1-888-495-8501. If your identity was used, also contact Equifax and TransUnion.
Looni reads your statements and highlights new payees, unusual transfers and charges you did not expect, with the exact line as proof. Read-only: it cannot move money, so it cannot be tricked into moving it.
Sources
Canadian Anti-Fraud Centre (RCMP), Bank investigator (how it works, payee and line of credit trick, MFA codes, residence visits, call spoofing, 10-minute call back, BIN digits, credit bureaus do not call randomly, no remote access, no transfers for security, no card pickups, Autodeposit; modified January 15, 2026), What to do if you're a victim of fraud (steps, 1-888-495-8501 and hours, recovery pitch warning) and Phishing; Financial Consumer Agency of Canada, Getting a credit card: know your rights ($100 electronic alerts) and Credit report and score basics (checking your report to detect fraud). The worked example and the 10% rate are illustrative.