If your credit card data was in a breach, here’s the headline: you’re almost certainly not going to pay for any fraud. Canadian law caps your liability for unauthorized charges at $50, and the zero-liability policies from Visa, Mastercard, Amex and Interac usually take that to $0. You may need to swap a card and update a few subscriptions, but the scenario where a criminal drains your account and you eat the bill is close to legally impossible in Canada. Here’s what’s actually worth doing.
Key Takeaways
- Canadian law caps your liability for unauthorized credit card charges at $50, and only if you showed gross negligence. Visa, Mastercard, Amex and Interac all offer zero-liability policies on top, so in practice you pay nothing.
- Most breaches leak only partial card data (first six and last four digits), which can’t be used to charge your card. PCI DSS rules limit what merchants can store outside secure systems.
- The biggest risk is phishing, not a fraudulent charge: scammers quote your card’s last four digits in fake emails to trick you into giving up the rest.
- Call your issuer to report the breach and get a new card (free at every major bank). Turn on per-transaction alerts in your banking app and watch your statements for a few months.
- If the same breach also exposed your SIN, date of birth or full address, that’s a different and more serious problem. See our guide on what to do if your SIN was leaked.
This article reflects Canadian consumer protection rules as of September 2026. Card network policies and FCAC guidance can change. Check each source for current details.
The Money Question First: You’re Protected
Start with the law. Under Canada’s federal consumer protection framework, your maximum liability for unauthorized credit card transactions is $50. Even that doesn’t apply unless you showed gross negligence in protecting the card, your PIN, or your passwords, and that’s a high bar. Having your number stolen in a retailer’s breach is the opposite of negligence on your part. Banks must also investigate disputed transactions, and they can’t hold you liable simply because a PIN was used. The Financial Consumer Agency of Canada explains these rules in plain language.
On top of the law, the card networks go further. Visa Canada and Mastercard Canada both publish zero-liability policies: you pay $0 for unauthorized transactions as long as you took reasonable care of the card and reported the problem promptly. FCAC notes that Visa, Mastercard, American Express and Interac have all made this commitment. There are exclusions, mainly some prepaid, gift and commercial cards. In practice: the law caps your exposure at $50, and the networks’ policies usually take it to zero. Fraudulent charges are the bank’s problem to absorb, not yours, provided you report them.
What Partial Card Data Actually Means
Breach notices often say “partial payment card information,” and the phrase is doing real work. In most cases it means the first six digits and the last four. The first six are the BIN (bank identification number), which identifies the issuer and card type; millions of Canadians share the same BIN. The last four are the digits printed on your receipts. The reason breaches so often stop there is PCI DSS, the security standard every card-accepting merchant must follow: it limits what merchants may display or keep outside secure systems to at most the first six and last four digits. The full number, handled properly, is either encrypted or not retained at all.
Two recent Canadian breaches from our breach tracker show the pattern. Canadian Tire’s October 2025 breach exposed 38,306,562 records, including partial card data alongside names, contact details, dates of birth and home addresses. Canada Goose’s July 2025 breach exposed 581,877 records with partial card data, names and contact details. In both cases the notices described the card fields as partial data: the middle digits, the ones that make a number chargeable, weren’t part of what leaked.
Why Partial Data Still Matters
Partial card data can’t, by itself, be used to charge your card. No merchant will accept a number with a gap in the middle. So why do breach notices mention it at all? Because of what it enables when paired with the rest of the stolen file. Your last four digits plus your name, email, home address or date of birth make a phishing message unusually convincing: “suspicious activity on your card ending in 4321” reads as legitimate when 4321 is actually your card. The same details help with social engineering against you or your bank’s phone agents, and can help someone take over your account with the breached retailer, where a full card may be stored for one-click checkout.
One important caveat: reread your notice carefully. If it says full card numbers, CVVs or track data were exposed, that’s a different situation. In that case, expect fraudulent charge attempts and get the card replaced immediately rather than waiting to see what happens.
See what your combination enables
The exact field sets from Canadian Tire, Canada Goose and other notable breaches are preloaded in our free data breach risk checker. Pick the breach that hit you, or tick what your notice listed, and see what someone can actually do with that mix.
What To Do After a Card Breach
Work through these in order. Most people are done in under an hour.
- Call your issuer. Tell them your card was in a breach. They’ll typically cancel it and reissue a new number at no charge; that’s standard issuer practice rather than a legal requirement, but nearly every issuer does it. If only partial data leaked, some issuers will suggest monitoring instead. Either choice is reasonable.
- Turn on transaction alerts. In your banking app, enable a notification for every card transaction. Per-transaction alerts are optional features (the only legally mandatory electronic alerts are low-balance warnings, which use a $100 default threshold), but they’re the fastest way to spot a bad charge.
- Check statements closely for a few months. Look for small “test” charges of a dollar or two, which fraudsters use to confirm a card works before making larger purchases.
- Report anything unauthorized immediately. Prompt reporting is what keeps you inside the zero-liability protections. Check your cardholder agreement for any dispute deadline and don’t sit on a charge you don’t recognize.
- For confirmed fraud, file reports. Report it to your local police and through the Report Cyber and Fraud portal at reportcyberandfraud.canada.ca, run by the Canadian Anti-Fraud Centre (1-888-495-8501, weekdays 10 a.m. to 4:45 p.m. Eastern). This gives you documentation if a dispute drags on.
The Real Risk Is the Follow-Up Phishing
Here’s the part that deserves most of your attention. After a retail breach, the main way partial card data turns into actual loss isn’t a fraudulent charge; it’s a phishing email or text that quotes your real card’s last four digits. Those messages arrive weeks or months later, dressed up as your bank or the breached retailer, asking you to “verify” your full card number or log in through a fake page. That verification step is where the missing middle digits get filled in, by you. Treat any message that references your card ending in specific digits with suspicion, no matter how official it looks. We cover how to tell a real breach notification from a fake one in Is This Breach Email Real?
Knowing what leaked before the phishing arrives is most of the defence, which is what a breach monitor is for: NotchUp Shield alerts you when your email address shows up in a newly verified breach, so you hear about it before the phishing starts.
When It’s More Than a Card Number
Everything above applies to card data, which is replaceable in a week. If the same breach exposed your Social Insurance Number, you’re in a different category, because a SIN can’t be swapped for a new one on request and identity fraud built on it can surface years later. That situation has its own playbook in what to do if your SIN was leaked. Not sure exactly what a given breach exposed? Our Canadian data breach list shows precisely which data types were in each incident, so you can match your response to what actually leaked rather than to the scariest headline.
Frequently Asked Questions
Am I liable if my leaked card is used?
Almost certainly not. Canadian law caps your liability for unauthorized credit card transactions at $50, and even that requires gross negligence on your part, which a retailer’s breach isn’t. Visa, Mastercard, Amex and Interac all add zero-liability commitments on top, so if you report promptly and took reasonable care, you pay nothing.
Should I cancel my card after a data breach?
If full card numbers or CVVs leaked, yes, immediately. If only partial data leaked (first six and last four digits), replacement is optional but cheap peace of mind: issuers reissue at no charge, and the main cost is updating subscriptions billed to the old number. Asking your issuer for their read on the specific breach is a reasonable middle path.
What can someone do with the last four digits of my card?
They can’t charge your card with it. What they can do is make phishing believable, quoting “your card ending in 4321” to pose as your bank, or use it alongside your name and address to social-engineer customer service lines or take over your account with the breached retailer. The digits are a credibility tool, not a payment tool.
How do I dispute a charge I didn’t make?
Contact your issuer as soon as you see the charge. Banks must investigate disputed transactions, and they can’t refuse simply because a PIN was used. Check your cardholder agreement for any reporting deadline, keep notes of when you called, and if fraud is confirmed, report it to the Canadian Anti-Fraud Centre as well.
Do I need credit monitoring after a card breach?
For a card-only breach, monitoring adds little, because card fraud shows up on your statement, not your credit report, and zero liability already protects you. If the breach also exposed your SIN or date of birth, monitoring becomes more useful. Either way, you can check your credit report free in Canada without paying for a subscription.
How long do I have to report a fraudulent charge in Canada?
There’s no single nationwide deadline. The FCAC says you must notify your card issuer “without delay,” and your cardholder agreement may set a specific window (often 30 to 90 days from the statement date). The sooner you report, the stronger your position under both the $50 liability cap and the network zero-liability policies. Don’t wait to see if a suspicious charge reverses on its own.
Can someone use my credit card with just the number and no CVV?
It depends on the merchant. Most online retailers require the CVV (the three or four digits on the back of your card) plus the expiry date. Some older or less secure merchants process transactions with just the card number and expiry. If your full card number leaked without the CVV, the risk of direct charges is lower but not zero, and a card replacement is still the safe move.
What’s the difference between a credit freeze and cancelling a card?
Cancelling replaces your card with a new number; the old number stops working entirely. A credit freeze (available in Quebec at both bureaus and Ontario through Equifax only, as of September 2026) blocks new credit accounts from being opened in your name, but doesn’t affect your existing cards. After a card breach, you want a card replacement. A credit freeze matters if the breach also exposed identity data like your SIN or date of birth, since that’s what someone would use to open new accounts. See our SIN leaked guide for details on credit freezes.
This article is for informational purposes only and doesn’t constitute professional legal, financial, or cybersecurity advice. If you believe you’re a victim of credit card fraud, contact your card issuer immediately, file a report with the Canadian Anti-Fraud Centre at 1-888-495-8501, and report to your local police.
Related Reading
- Notable Canadian Data Breaches: The Running List
- Is This Breach Email Real? How to Tell Notification From Phishing
- Your SIN Was Leaked: What That Means and What to Do
- How to Check Your Credit Report for Free in Canada
Card numbers change; the email address attached to them usually does not. You can check which breaches your own email address appears in, free, with no account, at NotchUp Shield, and catch the next exposure before the phishing arrives.
Breach figures from Have I Been Pwned, licensed CC BY 4.0.
