Interac e-Transfer is one of the most familiar ways to move money between Canadian bank accounts, but its convenience can make people assume the email or text message itself carries the money. It does not. Interac says the funds move between participating financial institutions over secure payment networks; email and SMS are used to notify the recipient and, when needed, provide deposit instructions.
That distinction explains both the strength and the main weakness of the system. The bank-to-bank payment rail can be secure while a fake notification, compromised email account or social-engineering scam still tricks a person into sending or accepting the wrong transaction.
Does money travel through email or text?
No. Interac states that the actual money moves from the sender’s financial institution to the recipient’s financial institution through secure payment networks. A notification can arrive by email or SMS, but that message is not the money itself.
This matters because phishing messages often imitate the look of a real e-Transfer notification. If you receive a transfer you were not expecting, confirm with the sender using a different communication method before opening links.
Why Autodeposit can reduce phishing risk
Autodeposit links an email address or mobile number to a chosen Canadian bank account. Once it is set up, eligible incoming e-Transfers are deposited directly after the financial institution’s fraud checks, without requiring a security question or a deposit link.
That removes a common opportunity for attackers: if you do not need to click a deposit link, a fake “accept your transfer” message becomes easier to ignore. Interac specifically recommends Autodeposit as an added security measure.
Check the recipient name before sending
When the recipient has Autodeposit enabled, Interac says the sender can see the recipient’s legal name before confirming the transfer. Stop at that screen and verify the name carefully. A familiar email address is not enough if the name shown does not match the person or business you intended to pay.
If a marketplace seller, contractor or stranger asks you to ignore a name mismatch because of an “account issue,” treat that as a warning sign and verify independently.
What if Autodeposit is not enabled?
The recipient generally needs to sign in to online banking and answer the security question set by the sender. A weak question such as a pet name, birthday or information visible on social media can be guessed. Use a question and answer that cannot easily be discovered online, and send the answer through a separate channel when possible.
What information does Interac collect?
Interac’s privacy information says e-Transfer processing can involve sender and recipient names, email addresses or phone numbers, account information, IP addresses, device identifiers, payment amount, expiry date, originating financial institution, payment status and messages associated with the transfer.
The existence of this data does not mean the other person in the transfer sees your banking details. Interac states that the sender and recipient do not see each other’s sensitive banking information. The data is used to operate the service, manage transactions, reduce fraud and meet legal obligations.
How to spot a fake Interac notification
- You were not expecting money from the named sender.
- The message creates urgency or threatens that the transfer will disappear immediately.
- The domain or sender address contains a subtle spelling change.
- The page asks for banking passwords, card PINs or information that your bank would normally collect inside its own authenticated app or website.
- A stranger asks you to return part of an “overpayment.”
Overpayment scams deserve special caution
Interac warns about situations where someone sends more than the agreed amount and asks you to send the difference back. The original payment may later prove fraudulent or disputed, leaving you out the money you returned. Do not treat an unexpected overpayment as a windfall or routine correction.
What should you do with an unexpected transfer?
Do not click the notification immediately. Contact the supposed sender using a phone number or conversation thread you already trust. If you do not know the sender, avoid interacting with the message and report suspicious notifications through the channels recommended by Interac.
If you believe money has been stolen or your account credentials have been exposed, contact your financial institution promptly. Interac also directs Canadians to the Canadian Anti-Fraud Centre when fraud is suspected.
Keep your banking login separate from the transfer message
A real e-Transfer may eventually take you to your bank, but your strongest habit is to open your bank app or type the financial institution’s address yourself whenever you are uncertain. Interac says it will never ask for your online-banking password by email or text.
What changed in 2026?
Interac’s support information says the e-Transfer Gateway began requiring TLS 1.2 or higher from September 16, 2026. Most users with current browsers should not notice a difference. People using older browsers or operating systems may see display issues and should update their software rather than weakening security settings.
Seven habits that make e-Transfers safer
- Enable Autodeposit for an email address or phone number you control.
- Verify the displayed legal recipient name before sending.
- Use strong, non-public security questions when a question is required.
- Do not accept or send money solely because a stranger pressures you in a marketplace chat.
- Keep your phone, browser and banking app updated.
- Use multi-factor authentication on your email and banking accounts where available.
- Contact your financial institution quickly if a transfer or login looks suspicious.
Is Interac e-Transfer safe overall?
The payment system has bank-grade controls, encryption and fraud monitoring, but a secure rail cannot prevent every scam in which a person is convinced to send money voluntarily. The safest approach is to combine the technical protections with recipient verification, Autodeposit and a strict rule against entering banking credentials through unsolicited links.
For current guidance, see Interac’s payment-safety guidance and its privacy information.
More Canadian app and digital-security guides are available in our Canada technology section.
