The Canadian Anti-Fraud Centre (CAFC) said Canadians reported approximately $351 million in fraud losses in the first six months of 2026.
The first-half 2026 total should not be treated as a full-year forecast, since fraud reporting and losses can shift during the year. Even so, it shows reported losses have remained high after the CAFC received over 112,000 fraud reports involving more than $704 million in 2025. The centre estimates that only 5% to 10% of fraud is reported.
Investment fraud remained the largest reported loss category in the first six months of 2026, at approximately $139.6 million. Spear phishing accounted for approximately $57.7 million, followed by bank investigator fraud at approximately $28.6 million, extortion at approximately $25.5 million, and recovery fraud at approximately $13.7 million.
Two categories stand out in year-over-year context. The CAFC said extortion losses in the first half of 2026 had already exceeded the approximately $23 million reported during all of 2025. Spear-phishing losses were also nearing the more than $68 million reported for all of 2025 after just six months.
Cyber research shows scams in the day-to-day mix
CSE’s 2026 Get Cyber Safe Awareness Tracking Survey, conducted with 2,330 online Canadians aged 18 and older from Jan. 9 to Jan. 29, found that email scams were the most common reported cyber incident, at 31%. Text scams, malware attacks and phishing scams each followed at 26%.
The survey also found more online Canadians reporting exposure to at least one listed cyber incident. The share reporting none of the listed incidents fell to 37% in 2026, down from 41% in 2024 and 50% in 2022. Phishing increased from 18% in 2022 to 26% in 2026.
CIRA’s 2026 Canadian Internet Trends survey, based on input from 2,000 adult Canadian internet users, points in the same direction. CIRA reported that 60% of Canadians frequently or occasionally received suspicious or fraudulent messages online in the past 12 months, while 53% said they encountered AI-generated fake content.
These sources measure different things and not every suspicious message leads to a loss. Together, though, they show that scam contact has become routine, while deceptive content is blending more easily into normal digital activity.
Awareness is rising, but old warning signs are losing power
The research does not point to public unawareness alone. CSE reported that 84% of online Canadians take precautions to protect online accounts, social media accounts, devices or networks. It also found that 94% have heard of multi-factor authentication, and among those aware of it, 86% know how to use it and do so regularly.
At the same time, scam cues are becoming less reliable. In a March 2026 Interac survey of 1,500 adult residents across Canada, 79% of respondents said they believe AI is enabling fraudsters to create convincing scams faster by capitalizing on breaking news and current events. Interac also reported that 66% said traditional warning signs such as spelling mistakes or poor formatting are no longer dependable indicators of fraud, and 53% said they had doubted legitimate messages from trusted organizations because scam attempts had become so convincing.
The Canadian Centre for Cyber Security’s National Cyber Threat Assessment 2025-2026, published in October 2024, gives a technical reason for that shift. The Cyber Centre assessed that fraud and scams were almost certainly the most common form of cybercrime affecting Canadians. It projected growth through 2026, citing phishing-as-a-service kits and AI chatbots that can craft convincing phishing emails.
The risk reaches businesses through payment workflows
The CAFC’s data shows spear phishing is already one of the highest-loss fraud types. The centre says these cases may involve compromised or spoofed communications and may target businesses by impersonating executives, suppliers, contractors or other trusted contacts to redirect payments or change banking information.
That makes scams an operational risk, not only a consumer-protection issue. A convincing invoice change, supplier email or executive request can bypass technical controls if payment approval depends on a single message thread.
CSE’s survey included 300 Canadians who own or manage a small-to-medium business. Among that group, 77% said their company had taken some steps against cyber threats, but about a third said their organization would benefit from guidelines for reacting to a cyberattack or a list of threat types and clues to watch for. That suggests some organizations still need practical response procedures, not only general awareness.
Ottawa’s response is expanding beyond public awareness
The federal response is also moving toward broader obligations for institutions that sit between scammers and victims. On March 30, 2026, the Department of Finance Canada launched consultations on Canada’s first-ever whole-of-government National Anti-Fraud Strategy, developed with 11 other federal departments and agencies.
The consultation focused on law enforcement capacity, public awareness and a proposed Multi-Sector Anti-Fraud Framework. Finance Canada said the framework would introduce new or enhanced obligations for federally regulated financial institutions, telecommunications service providers and digital platforms. Examples included warnings for large transfer payments, blocking or flagging spoofed calls, screening fraudulent profiles and pages, and blocking malicious ads.
On June 26, Finance Canada also said proposed regulations had been pre-published to operationalize Bill C-15 amendments to the Bank Act. Once brought into force, those amendments will require banks to have policies and procedures to detect and prevent consumer-targeted fraud and mitigate its impacts. The department said the proposed rules would cover express consent before enabling electronic funds transfer capabilities such as wire transfers, consumer options to disable certain account capabilities or adjust transaction limits, and fraud-related data reporting to the Financial Consumer Agency of Canada.
Verification has to move outside the original message
Requests involving payment changes, urgent transfers, investment opportunities or recovery offers need confirmation through a known contact method, especially inside small organizations where one person may handle both email and payment approval. Unsolicited requests for login or verification codes or remote access should be rejected, not simply verified.
I can suggest related Tech Help Canada articles based on the topic you’re reading now.
Tech Help Canada Staff researches, writes, and reviews practical content for business owners and professionals. Our coverage spans business, marketing, SEO, technology, and the tools and systems people use to grow and operate online. We focus on clear, useful information backed by research, hands-on experience, and editorial review. Learn more about our team and editorial standards. Need help with something? Contact Us
