Canada Fraud Landscape 2026: Identity Fraud, Regulation and Trusted Verification

In 2025, identity fraud was the most reported type of fraud in Canada. And AI-driven attacks target exactly those moments when an organization decides whether or not to trust that a person is who they claim to be.

Fraud in Canada in 2026: the numbers

Canadians reported more than C$704 million in fraud losses in 2025. In total, the Canadian Anti-Fraud Centre (CAFC) received more than 112,000 fraud reports, and identity fraud was the most reported type.

These figures, however, show only part of the problem. The Department of Finance Canada estimates that only 5 to 10 per cent of scams are reported, so the real impact is considerably higher.

For banks, the bill goes well beyond what is reported. Absorbed losses, manual reviews and a detection gap that weighs on day-to-day operations all add to the real cost of fraud for Canadian banks.

Table 1. Key fraud figures for Canada. Sources: CAFC (Feb 25, 2026), Department of Finance Canada (Mar 30, 2026), Nasdaq Verafin and Equifax Canada as cited in DIACC, From Registries to Reality (2026).

Figure 1. Most reported fraud types in Canada, 2025. Source: Canadian Anti-Fraud Centre. Chart: Facephi.

Bar chart of the most reported fraud types in Canada in 2025, led by identity fraud with 8,403 reports (CAFC)

Identity fraud: Canada’s most reported fraud

Identity fraud topped CAFC reports in 2025, with 8,403 cases, almost twice as many as investment fraud. It happens when someone uses another person’s details to open accounts, apply for credit or access their services.

The CAFC does not attribute dollar losses to identity fraud because, in most cases, the person whose identity was stolen is not responsible for them. Those losses are absorbed by the institution that granted the credit or opened the account in the victim’s name. That is why stolen identity in Canada is, above all, a problem for financial institutions.

Canadians are concerned too. In an Equifax Canada survey of 1,570 people, conducted in January and February 2026, 67 per cent named identity theft as the type of fraud that worries them most.

Deepfakes, injection attacks and synthetic identities

AI has given fraudsters far more powerful tools. Until recently, the most common form of biometric fraud was the presentation attack: holding a photo, video or mask up to the camera to pass as someone else. Today, two more sophisticated techniques are gaining ground.

Deepfakes use AI to generate images or videos of a person that look real. Injection attacks go a step further: they feed that fake content directly into the system, bypassing the camera, so that it looks as if the legitimate person is present.

Injection is also one of the fastest-growing techniques. Goode Intelligence forecasts that attempts will rise from 122 million in 2026 to more than 301 million a year by 2028.

In this landscape, identity cannot be treated as a one-time check at onboarding. It has to be understood as a continuous process that follows the customer throughout their relationship with the organization. DIACC points in the same direction in its report “From Registries to Reality”:

The risk has also reached Canadian lawmakers, as Canada’s proposed deepfake rules for banks show. And a synthetic identity that gets through onboarding can end up as a mule account, which is why detecting mule accounts and synthetic identities is part of the same defence.

Where fraud hits: banks, payments and crypto

The FATF’s Mutual Evaluation Report of Canada, published in September 2026, identifies the sectors most exposed to money laundering in the country. Drawing on Canada’s 2025 National Risk Assessment, it rates the inherent vulnerability of domestic systemically important banks (D-SIBs), money services businesses and virtual asset service providers as “very high”. It also warns that these sectors are not supervised as often as their risk level would require.

Payment speed adds to that risk. With instant payments, money moves in seconds and the window to detect fraud narrows. It is one of the challenges that come with open banking and real-time payments in Canada: identity has to be validated before a transaction is authorized.

The crypto sector, also among those the FATF considers most vulnerable, is starting to get its own rules through Canada’s stablecoin legislation.

Canada’s regulatory response to fraud

Canada is responding to fraud on two fronts. First, it is preparing its first National Anti-Fraud Strategy, whose public consultation closed on April 28, 2026. It has also amended the Bank Act through Bill C-15, which requires banks to do more to prevent fraud.

Second, there is the anti-money laundering regime. The FATF assessed it in 2026 and ranks fraud among its main threats: fraud accounted for 41.2 per cent of the information requests that FINTRAC, Canada’s financial intelligence unit, sent to its foreign counterparts between 2019 and 2025.

For financial institutions, this framework translates into specific customer identification obligations, which we cover in our overview of compliance requirements in Canada. Table 2 shows where each instrument stands.

Table 2. Canada’s regulatory response to fraud. Sources: Department of Finance Canada (2026), FATF, Mutual Evaluation Report of Canada (2026) and DIACC.

What is the Pan-Canadian Trust Framework (PCTF)?

The Pan-Canadian Trust Framework (PCTF) is Canada’s trust framework for digital identity. It is stewarded by the Digital ID and Authentication Council of Canada (DIACC), a non-profit organization that brings together the public and private sectors. The PCTF sets out the requirements a digital identity service must meet to be considered trustworthy.

Services that pass an independent audit are added to the DIACC Trusted List, a public registry that any organization can check before choosing a provider.

Why identity binding is the new fraud perimeter

A credential is only as reliable as the process that bound it to its holder. If that binding fails, everything built on top of it inherits the failure.

That is why we see identity as a continuous process rather than a one-off event. Maintaining trust means re-verifying identity throughout the customer lifecycle, especially at moments of higher risk.

This shift from isolated checks to continuous protection is the foundation for rethinking fraud prevention and responding to the rise of AI-driven fraud.

Assurance also has to be provable. A provider that claims to detect deepfakes should be able to explain what was audited, against which criteria and to what level.

How we approach anti-fraud in Canada

Our identity verification service holds Pan-Canadian Trust Framework certification for the Verified Person component at Level of Assurance 2 (LOA2), and is listed on the DIACC Trusted List. Certification details are available in our Trust Center.

We start from a clear idea: identity is not something you check once and file away. It is a signal that has to stay active throughout the customer relationship. That is why we connect verification at onboarding with everything that happens afterwards:

• At onboarding. During digital onboarding, we verify the document and biometrics with liveness detection, and we detect presentation and injection attacks, including deepfakes.
• After onboarding. The verified identity becomes the reference for re-authenticating the customer at moments of risk, such as a change of personal details or a high-value transfer, without starting the process from scratch.
• At every decision. Each verification leaves a traceable record, so the organization can justify it to its auditor.

This is how we approach our anti-fraud solutions: as protection that stays with the customer from day one, not just at the front door.

Checklist for Canadian financial institutions

Use this table to review your organization’s exposure and assess identity providers. To round out your fraud program with operational measures, see these practical actions to reduce fraud in Canadian banking.

Table 3. Identity and fraud checklist for financial institutions in Canada. Source: Facephi, based on DIACC (2026), Department of Finance Canada (2026) and FATF (2026).

Conclusion

Fraud in Canada increasingly starts with identity. Official figures reflect it, the government has responded with the National Anti-Fraud Strategy and Bill C-15, and the FATF is calling for closer supervision of the highest-risk sectors.

In this context, the PCTF aims to let any organization confirm, with audited evidence, that the identity service it relies on is trustworthy.

Talk to our team about PCTF-certified identity verification in Canada. 

FAQs