If a fraudster gets into your bank account and drains it, your bank would have to cover the loss under a change the federal government proposed in Thursday’s budget. Budget 2026 says Ottawa will amend the Bank Act “to cap maximum consumer liability at $0 for any form of transaction resulting from unauthorised access to a consumer’s bank account, in the absence of gross negligence on their part.”

The budget’s list of planned legislation gives an example of what counts: “a payment made by a fraudster who gains access to a consumer’s account.” It says the cap would apply “across all account types held with a bank.”

Part of a bigger anti-fraud plan

The $0 cap is one piece of what the budget calls a Multi-Sector Anti-Fraud Framework, the centre of Canada’s first National Anti-Fraud Strategy. Under it:

  • Banks, telecom companies and digital platforms would be legally required to “prevent, detect, disrupt, and respond to fraud,” and to work together to resolve fraud complaints.
  • The CRTC would get power to impose fraud-prevention rules on phone and internet providers, and to collect and publish data on how much fraud runs through their networks.
  • Canada’s anti-spam law would let the CRTC share information with police proactively.

The budget says the Canadian Anti-Fraud Centre recorded more than $704 million in fraud losses in 2025, which it estimates is only 5 to 10 per cent of the real total. It also notes that Canada’s largest banks and telecom companies launched a shared Cross-Sector Anti-Fraud Exchange in October to spot repeat fraud.

When would it take effect?

Not soon. The government says it will consult on draft legislation and amendments before introducing them, and that more details on the strategy will come in 2027. The budget sets aside about $6 million in total for the strategy.

What to watch

This is our analysis of the open questions:

  • What “gross negligence” means. The protection doesn’t apply if you were grossly negligent, and the budget doesn’t define it. Whether sharing a one-time passcode with a scammer on the phone counts will decide how useful this is for victims of common phone scams.
  • Who it covers. The change is to the Bank Act, so it targets banks. The budget doesn’t say whether provincially regulated credit unions or caisses would follow.
  • Scams where you send the money yourself. The cap covers “unauthorised” access. Scams where victims are tricked into making a payment themselves may fall outside it, though the wider framework would require banks and carriers to work on preventing those too.

Why it matters: A legal $0 cap would put the cost of account takeovers on banks, which gives them more reason to stop them. But until Parliament passes it, nothing changes, so keep your passwords and one-time codes to yourself.