Explore our latest insights
Budget 2026: Fraud becomes a shared responsibility
Fraud is now a shared duty. We’ve been building it since 2018
Our view
Budget 2026 (Masters of Our Destiny) was announced yesterday (November 5) and confirms what we have known for years: no institution can stop fraud alone. The government intends to make fraud prevention a duty across banks, telecoms and digital platforms, and to put the cost of unauthorized account access on the institution. Symcor has run shared fraud intelligence between financial services organizations since 2018.
Working together takes more than technology. It takes governance, agreed steps for when something goes wrong, the ability to move with speed, and infrastructure every party trusts.
These are intentions. Draft legislation will be consulted on first, and more on the National Anti-Fraud Strategy is due in 2027. But the direction is set, and it is the right one. Institutions that start now will not be building under deadline pressure later.
What changed
A cross-sector fraud duty. A legislated Multi-Sector Anti-Fraud Framework would require organizations to prevent, detect and respond to fraud and work together to resolve fraud complaints.
$0 consumer liability for unauthorized bank account access, absent gross negligence. In our experience, this is where strong authentication matters most and why banks have good reason to double down on blocking unauthorized access.
Payments get faster. Real-Time Rail is scheduled to launch November 9, with a consultation on the next phase of payments modernization expected in early 2027. When money moves in seconds, there is no overnight window to trace a bad payment.
The scale explains the urgency. Canadians reported more than $704 million in fraud losses in 2025, which the budget estimates is only 5% to 10% of the real total.
The harder case is the scam the customer authorizes
The $0 cap covers unauthorized access, where someone else got into the account. The harder case is the customer who is tricked into sending the money. In the UK, since October 2024, UK payment firms have had to reimburse victims of authorized push payment scams, up to £85,000 per claim, with the receiving firm included. Account-name checking, called Confirmation of Payee, is widely used there. Canada’s cap is narrower today, and that is a reason to prepare for both.
“The $0 liability cap makes one question urgent: what happens when the customer is deceived into authorizing the payment themselves? Institutions should plan for the harder case now and confirming the payee before a payment is authorized is one of the most practical places to start.”
— Sanjeev Chib, VP Product, Payment Fraud Solutions, Symcor
We built this before it was a policy
In 2018 we created a consortium so banks could see risk signals beyond their own walls. We started with cheques, because a cheque issued at one bank is usually deposited at another, so no single institution sees the whole picture. We added fraud models, including counterfeit detection, payee verification, and alert participating banks in near real time. It is the model the budget now points toward.
Years of running it taught us three things:
Start where the data already overlaps. Shared intelligence works when institutions begin with a signal they all hold.
Act before money moves. In real time, the only meaningful place to stop fraud is before the payment is sent. Once money moves there is no second chance.
Govern it like infrastructure. Clear rules, explainability and a plan for when something goes wrong are what allow institutions to act early and proportionately.
“No single institution sees the full picture. That is why we built a consortium in 2018 and why we said at the Payments Canada SUMMIT in May that fraud is not a competitive space. It has to be treated as shared intelligence, with protections in place before the Real-Time Rail goes live, not after. Budget 2026 confirms the direction. The time to act is now.”
— Holger Kormann, President & CEO, Symcor
What it means for your sector
Banking | What’s changing. The cost of unauthorized access moves to the institution, and instant payments leave less time to intervene. What it means for you. Stop the payment before it is sent: confirm who you are paying, and use signals from beyond your own walls. Payments Canada’s national Real-Time Rail fraud controls complement, not replace, each institution’s own. |
Insurance | What’s changing.. The budget proposes a CRA income verification service for mortgage lenders and insurers to deter fraud, funded by industry after a pilot. What it means for you. Verification is becoming a shared infrastructure. Decide now what you would verify and what you would rely on. |
Government | What’s changing. A voluntary digital credentials pilot in financial services to combat identity fraud developed by the Canadian Digital Service with Finance Canada. What it means for you. Identity is the new safety perimeter. A verified credential lets an institution or public service confirm who it is dealing with before it acts. |
Telecom | What’s changing. The CRTC would gain authority to set fraud-prevention obligations, telecoms are named in the Framework, and data portability would extend into telecommunications. What it means for you. Much fraud starts with a call or text before it reaches a bank. Telecoms will need to share what they see, and resolve complaints across sector lines. |
Across all four industries, the principle is the same.
“Whether the decision is a payment, a claim or a benefit, the common thread is verifying before acting. Our role is to build the shared infrastructure, identity, payee and intelligence, that lets institutions make that call in seconds, with the governance regulated environments require.”
— Saba Shariff, SVP & Chief Strategy, Product & Innovation Officer, Symcor
Don’t wait for open banking
Consumer-driven banking is moving through regulations and accreditation, and more data sharing will follow. You do not have to wait to learn how to share data safely. We know, because we built it. Our FDX-aligned open banking platform replaces bank-by-bank connections and screen-scraping with consented, API-based access: one integration model, managed consent and strong security, already operating in production. The lessons apply directly to fraud: agree the standard first, build consent and governance in, and run it as one shared service.
“Open banking will test every institution’s ability to share data and stay safe. The hard parts, governance standards and trust, take years, and we have done that work. Start now and you will be ready when the rules are finalized.”
— Sarah Gowdy, VP, Payments & Open Banking Products, Symcor
Also in the budget: the push to digital
Digital government. About $1 billion over five years for a Government Transformation Fund, with Digital Transformation Canada leading AI adoption and a planned Digital Transformation Canada Act. Eligibility and procurement are still to be defined.
Customer communications. Banks would issue a single annual statement of account fees, and the single stamp rises to $2.00 from 2027, with annual increases to follow.
Stablecoins. Federally regulated institutions would be barred from issuing stablecoins directly and would use separately regulated subsidiaries. Linking that activity to bank accounts and payment systems is a new operational question.
Together they point one way: government and regulated institutions are being asked to deliver more, more securely, and digitally.
What to do now
Quantify exposure. Model what a $0 liability standard would have cost last year.
Map your signals. Know what you can see, what you can share and what you can act on.
Verify before the transaction. Identity, payee and income checks work best upstream.
Be in the room. Consultations are coming on draft fraud legislation and payments.
Our role
Symcor is 100% Canadian-owned and operated, and for 30 years we have run critical infrastructure that Canada’s financial institutions depend on. Since 2018 we have run a multi-bank fraud intelligence consortium that alerts participating banks in near real time. Payee Verify, part of our suite of fraud solutions, confirms before authorization that a payment is going to the intended recipient and that debits come from legitimate accounts, across payment types.
Our open banking platform is operating in production. And for regulated clients, including government, we support document processing, secure communications and digital service delivery.
Budget 2026 does not change what institutions need to do. It makes the case for doing it together, and sooner.
Speak to our team today
Whether you are strengthening fraud defenses, preparing for open banking or moving documents and customer communications to digital, we can help you start now.
