The Canadian Centre for Cyber Security has published ITSAP.00.080, "How to use online banking securely," as part of its Awareness series. The document is dated October 2026 and is available on the Cyber Centre site in web form and as a PDF (810 KB). It is public guidance, not a regulation: there are no deadlines, no fines and no thresholds in it. Its audience is anyone who logs into a bank through a website or mobile app, which in Canada is most of the adult population and a decent share of their pets' social media accounts.

The publication opens by stating what online banking offers: real time access to financial information, with the ability to transfer money, pay bills and manage accounts at any time through a website or mobile app. It then names the trade off. The same convenience, the Cyber Centre says, "can also create opportunities for fraud and unauthorized access." Threat actors may try to steal login information, redirect payments or trick customers into approving transactions.

One point stands out for anyone who builds or runs identity systems. The Cyber Centre explicitly calls out artificial intelligence, both in banking itself and in online scams, as part of the evolving technology that changes how these risks reach customers. The bulletin does not go into detail on specific AI techniques in the material reviewed for this report, but the fact that a government awareness piece for the general public now mentions AI alongside phishing says something about how mainstream the concern has become.

The document is structured in four parts: common risks in online banking, how to protect your banking information, steps to take if fraud occurs, and a "learn more" section pointing to related resources. The full guidance is at the Canadian Centre for Cyber Security.

On risk, the Cyber Centre is measured. It states that online banking is "generally safe," then notes that threat actors may still try to get into accounts in several ways and may combine methods. The result of a successful combination is described as unauthorized bank account access or activity. That framing matters. The guidance doesn't treat a leaked password as the end of the story. It treats it as one step in a chain that also includes payment redirection and tricking the customer into approving a transaction they didn't intend.

The first risk category the bulletin covers is phishing and social engineering. The Cyber Centre describes these as attempts to manipulate the customer into sharing sensitive information or approving transactions, with contact arriving by text message, email and other channels. In other words, the attack isn't aimed at the bank's authentication stack. It's aimed at the person holding the phone, who is also, inconveniently, the one with the authority to click "approve."

The sections on protective steps and fraud response are listed in the publication but were not included in full in the material reviewed here, so this report doesn't summarize their specific recommendations. Readers should go to the source for those. What can be said is that the Cyber Centre frames the whole publication as explaining common risks and the steps a person can take to stay safe, which places it firmly in the consumer education category rather than the compliance category.

Why does a consumer awareness bulletin belong in an IAM publication? Because the person this document is written for is your customer, and every risk it describes lands in a flow your team owns. Credential theft hits login. Payment redirection hits payee management and transaction authorization. Tricking someone into approving a transaction hits your MFA and push notification design. A government body telling the public to be careful is welcome. It is also, read a certain way, a polite note that the controls on the bank's side should not depend on the public being careful.

The encouraging part: none of this is new ground for CIAM teams at financial institutions, and the Cyber Centre's own assessment is that online banking is generally safe. That is a compliment, earned over years of unglamorous work on fraud models and session handling. The acidic part: "generally" is doing some lifting in that sentence.

For identity and security teams, three things are worth checking against this bulletin. First, look at how transaction approvals are presented to customers in your app and whether the prompt shows enough context (amount, payee, channel) for a person to recognize a transaction they didn't start, since the guidance names tricked approvals as a distinct risk. Second, review the controls around adding or changing a payee and whether those events are logged, rate limited and confirmed out of band, because payment redirection is called out separately from credential theft. Third, confirm that your customer facing communications don't look like the phishing the Cyber Centre is warning about: no links in texts asking people to log in, consistent sender identities, and a published statement of what your institution will never ask for over email or text.