Why TD Bank Is a Prime Phishing Target
TD Bank is Canada's second-largest bank by assets and one of the top ten banks in North America, serving approximately 27 million customers across Canada and the United States. This enormous, geographically distributed customer base makes TD one of the most valuable impersonation targets for phishing criminals. A single large-scale campaign impersonating TD has statistically high odds of reaching actual TD customers — and those customers, primed to trust TD's branding, are far more likely to interact with a convincing fake alert than they would with an unknown sender.
TD Bank scams have grown significantly in sophistication since 2022. Early campaigns used poorly formatted emails with obvious spelling errors. In 2026, TD phishing emails are often visually indistinguishable from authentic TD communications, with precise logo reproduction, correct font usage, accurate footer disclaimers, and personalized content sourced from data breach databases. The most advanced variants intercept real TD security notifications and relay them through fraudulent channels, making them virtually impossible to distinguish from legitimate messages without verification through official channels.
Financial losses from TD Bank-branded fraud run into the tens of millions of dollars annually across Canada and the US. The most common attacks — phishing emails, SMS fraud alerts, and OTP relay phone scams — are responsible for the vast majority of compromised accounts and unauthorized transfers. Understanding how each attack type works is the essential first step in protecting your TD account.
How TD Bank Scams Work
TD Bank scams generally follow one of three vectors. The first is credential phishing: a convincing email or text directs you to a fake TD EasyWeb login page. You enter your username and password, which are captured by the attacker, who then logs into your real account and performs unauthorized transfers. The second is OTP relay fraud: an attacker who already has your credentials calls you impersonating TD's fraud team, triggers a real 2FA code to be sent to your phone, and asks you to read it back. With the OTP they gain access despite 2FA. The third is authorized push payment fraud: the scammer convinces you that your money is at risk and you must transfer it to a "safe account" — which is under their control. This is the most financially devastating variant because the victim initiates the transfer themselves, making reversal much harder.
Real-Life TD Bank Scam Scenario
David, a 44-year-old teacher in Calgary, received a text appearing to come from TD with a message: "ALERT: Unusual sign-in detected from Toronto, ON. If this wasn't you, click here to secure your account." He tapped the link, which opened a page that looked exactly like TD EasyWeb. He entered his username and password. Within 90 seconds, he received a call from someone claiming to be "TD Security, Badge #7291" saying they'd detected the unauthorized sign-in and needed his 2FA code to stop an $8,000 transfer. He provided the code. The attacker completed the $8,000 transfer immediately. The link he clicked and the "TD Security" caller were both part of the same coordinated scam.
15 Real-World TD Bank Scam Examples
1. Fake TD Fraud Alert Text (Smishing)
An SMS reads: "TD ALERT: Suspicious transaction of $847.00 at Amazon. If not you, click to secure your account: [link]." The link goes to a fake TD EasyWeb page. These texts exploit the fact that TD does send legitimate fraud alerts via SMS, making recipients less skeptical.
2. OTP Relay Phone Call
A caller claiming to be from TD's fraud department says your account has been accessed from a new device. They ask you to log into TD Mobile — triggering a real 2FA code — and then request the code "to verify your identity." Providing the code grants them full account access.
3. Fake TD EasyWeb Login Page
An email or text link leads to a page at td-easyweb.com or easyweb-td.ca that is a pixel-for-pixel clone of TD's real login portal. Every visual element matches the real site — the difference is only in the URL, which is easy to miss on a mobile browser.
4. "Your Card Has Been Blocked" SMS
A text claims your TD Visa or Debit card has been blocked due to suspicious activity and you must verify your card details via a link. The link collects your full card number, expiry, and CVV — all the information needed for card-not-present fraud.
5. TD Business Banking Credential Phishing
Business owners receive emails claiming their TD Business Banking account requires re-authentication due to a security update. Business accounts typically have higher transaction limits and less-familiar security interfaces, making them particularly vulnerable to credential theft.
6. "Safe Account" Transfer Fraud
A caller claiming to be from TD's fraud team says scammers have gained access to your account and your only protection is to transfer your balance to a "secure temporary account." The "secure account" belongs entirely to the scammer. This is the TD bank variant of bank account phishing.
7. Fake TD E-Transfer Notification
An email mimicking an Interac e-Transfer notification claims someone sent you money and you must click to deposit it. The link goes to a credential harvesting page. The scam exploits the visual similarity of TD's e-Transfer emails to these fakes. See our e-transfer scam guide.
8. TD Direct Investing / TD Wealth Phishing
Investors receive emails claiming their TD Direct Investing account requires verification due to a regulatory update. Investment account holders may be particularly motivated to act quickly to protect market positions, increasing the effectiveness of urgency-based tactics.
9. Fake TD Security Certificate Email
An email with a PDF attachment claims to be a "security certificate" or "account verification form" from TD that must be completed and returned. The PDF contains links to phishing pages or may itself be malware-laden.
10. TD Mobile App Update Phishing
An SMS or email claims your TD Mobile app requires a security update and provides a download link. The link installs a fake TD app that captures your credentials and may intercept SMS messages — including 2FA codes — from your real bank.
11. Fake TD Customer Survey with Gift Reward
A message claims TD is rewarding loyal customers with a $200 credit for completing a short survey. The survey harvests personal and financial information. Victims are then charged a "processing fee" to receive their "reward." TD does not offer cash rewards via unsolicited survey emails or texts.
12. TD Mortgage Pre-Approval Phishing
A targeted phishing email claims a mortgage or loan pre-approval is ready for review and asks you to log in to view it. This attack is particularly effective in active real estate markets where victims may be genuinely awaiting financing decisions.
13. Social Media Fake TD Support Account
A fake @TDHelpCA or similar account on X (Twitter) or Facebook responds to customers who post complaints about TD, offering "direct support." The conversation moves to DMs where credentials are requested. See our bank text scam guide for more on social channel impersonation.
14. Caller ID Spoofed to TD's Official Number
A call appears on the recipient's phone as 1-866-222-3456 — TD's actual fraud line — but is in fact a scammer using caller ID spoofing. The displayed number's accuracy increases compliance dramatically. Never use a callback number from within a call; always dial TD independently.
15. Post-Breach Account Verification Campaign
Following major data breaches, scammers send targeted emails to breach victims claiming TD needs to verify their account information as a precaution. These campaigns use actual breach data — including names and partial account numbers — to make the verification request seem legitimate and urgent.
15 Warning Signs of TD Bank Phishing
- 1)The email sender domain is not @td.com — check the full address, not just the display name; td-secure.ca, td-verify.net, td-alerts.com are all fraudulent.
- 2)A link in the message goes to any domain other than td.com — hover over links to see the destination URL before clicking.
- 3)The message asks you to enter your TD username and password via a link — always log in by typing td.com directly in your browser.
- 4)A caller asks for your one-time password (OTP) — TD will never call you and ask for your 2FA code.
- 5)You're told to move money to a "safe" or "temporary holding" account — this is always fraud, regardless of how convincing the explanation sounds.
- 6)The message creates an extreme urgency deadline — "account suspended in 2 hours," "card blocked immediately" — real bank alerts allow time for verification.
- 7)The message greets you as "Dear TD Customer" rather than your name — real TD messages use your registered name.
- 8)The text message contains a shortened URL — bit.ly, tinyurl, or similar short links in bank alerts are a reliable fraud indicator.
- 9)You're asked to download a TD app from outside the App Store or Google Play — only install TD apps from official app stores.
- 10)A caller insists you must not hang up — legitimate bank staff support customer verification through any channel and welcome callbacks.
- 11)The email references a transaction you don't recognize but directs you to a login link rather than your actual TD app to verify it.
- 12)The message asks for your full card number, expiry, or CVV — TD already has this information and will never ask you to provide it.
- 13)The call came from TD's official number but immediately asks for credentials — caller ID can be spoofed; always hang up and redial independently.
- 14)You're asked to verify your account because of a "system migration" or "security upgrade" — these are generic pretexts used across most banking phishing campaigns.
- 15)The claimed alert cannot be found in your TD app's notification history — real TD alerts appear in your app; anything that doesn't is fraudulent.
Real TD Bank Message vs. TD Bank Scam: Comparison Table
| Feature | ✓ Real TD Bank Message | ✗ TD Bank Scam / Phishing |
|---|---|---|
| Sender / caller ID | Official TD short codes for texts; td.com domain for emails | Spoofed TD numbers; email domains like td-secure.ca or td-verify.net |
| Link destination | Directs you to td.com — type it manually, never click | Links to td-easyweb.ca, td-login-verify.com, or similar lookalike domains |
| Password / PIN request | Never asks for your password, PIN, or full card number | Creates urgency to enter credentials on a linked page |
| OTP codes | Never calls you and asks for your one-time password | Calls claiming to be TD fraud team and asks you to read back your OTP |
| Tone and urgency | Informational; directs you to check your account yourself | "Your account will be suspended in 24 hours", "act now to prevent loss" |
| Verification option | Encourages you to log in via official app or call 1-866-222-3456 | Discourages verification; insists you must act on this message only |
| Transaction alerts | Alerts reference specific partial transaction amounts and merchant names | Vague "suspicious activity detected" with no specific transaction details |
| Personal greeting | Addresses you by your registered name | Uses "Dear TD Customer" or "Dear Valued Client" |
| Request type | Never asks you to move money "to protect it" to another account | Instructs you to transfer funds to a "safe account" controlled by the scammer |
| Attachments | Does not send unsolicited attachments requiring you to open them | Sends PDF "security notices" or account statements as phishing vectors |
Latest TD Bank Scam Tactics in 2026
Real-time phishing proxy kits: The most sophisticated TD bank scam operations now deploy adversarial proxy servers that relay traffic between the victim and TD's real website in real time. The victim sees TD's actual current page — because it's being proxied live. Every credential entered is intercepted. These kits bypass visual verification entirely; only URL verification in the browser address bar catches them.
Push payment scam escalation: Authorized push payment fraud — convincing victims to willingly transfer funds to "safe accounts" — has grown substantially. These scams are more difficult to recover from because the victim initiated the transfer themselves. TD and other banks have implemented additional friction for large same-day transfers, but attackers have adapted by structuring amounts below detection thresholds.
TD-branded QR codes in physical mail: Scammers have begun mailing physical letters with TD branding to addresses sourced from data brokers, containing QR codes linking to phishing sites. Physical mail receives implicit trust that digital messages do not, and QR codes bypass email security filters entirely.
Voice-cloned "TD fraud specialist" calls: AI voice synthesis tools allow attackers to generate convincing Canadian-accented professional voices for automated fraud calls. Combined with spoofed caller ID, these calls can be extremely convincing at scale.
How to Report TD Bank Phishing
Forward suspicious emails claiming to be from TD to phishing@td.com. For suspicious texts, forward to 7726 (SPAM) via your carrier and then report to TD directly. Call TD's official fraud line at 1-866-222-3456 to report suspected account compromise. Report to the Canadian Anti-Fraud Centre at 1-888-495-8501 or the FTC at reportfraud.ftc.gov for US-based incidents.
If your TD account was compromised, change your online banking password immediately through the official TD Mobile app or by typing td.com directly in your browser. Enable enhanced security settings in your TD account. Contact TD's fraud department to review and reverse any unauthorized transactions. Consider placing a fraud alert with Equifax Canada and TransUnion Canada to protect against follow-on identity theft. For related concerns, see our guides on fake bank texts, credit card phishing, and bank account phishing.
Other Scams to Watch For
People researching this scam also check these related pages.
CIBC Scam
Recognize fake CIBC messages and account phishing attacks.
Check NowBMO Phishing
Spot fraudulent BMO Bank of Montreal phishing emails.
Check NowScotiabank Phishing
Identify Scotiabank phishing messages and spoofed emails.
Check NowRoyal Bank Phishing
Detect fake RBC Royal Bank phishing attempts.
Check NowEQ Bank Scam Checker
Verify EQ Bank messages and spot digital banking scams.
Check NowSimplii Financial Scam Checker
Check suspicious Simplii Financial messages for fraud.
Check NowTangerine Scam Checker
Detect fake Tangerine bank messages and phishing scams.
Check NowPC Financial Scam Checker
Identify PC Financial fraud attempts and spoofed messages.
Check NowFrequently Asked Questions
Will TD Bank ever ask for my PIN or password via email or text?
Never. TD Bank will never ask you to provide your PIN, password, full card number, or OTP via unsolicited email, text, or phone call. If you receive such a request, it is a phishing or social engineering attack. TD staff already have access to your account information and do not need you to provide these credentials for any legitimate purpose.
What should I do if I receive a fake TD fraud alert text?
Do not click any link in the message. Open the TD Mobile app directly or type td.com in your browser to check your account for legitimate alerts. If something seems genuinely wrong, call TD's fraud line at 1-866-222-3456 using the number you've dialed before or found from your bank statement — not from a number within the suspicious text.
What is an OTP relay scam and how do I protect against it?
An OTP relay scam occurs when an attacker who has your banking credentials calls you impersonating TD and asks you to read back the one-time password your bank sends you. By providing the OTP, you enable the attacker to complete the login they couldn't finish without it. Protect yourself by never providing an OTP to anyone — not even someone claiming to be your bank. TD will never call and ask for your OTP for any reason.
How can I verify if a TD message is real?
Log in to TD EasyWeb by typing td.com directly in your browser, or open the official TD Mobile app. Any legitimate alerts will appear in your account dashboard. Do not use any link, phone number, or QR code from the message you're trying to verify. Call TD at 1-866-222-3456 using a number from your bank statement or card back — not from within the message.
What are the most common TD Bank scam types in 2026?
The most common TD bank scam types in 2026 are: OTP relay phone scams (attackers call impersonating TD fraud team), real-time proxy phishing pages (fake TD EasyWeb that proxies the real site), authorized push payment fraud (convincing victims to transfer funds to "safe accounts"), and SMS smishing alerts with malicious links. All of these can be defeated by the core rule: never use contact information, links, or payment instructions from an unsolicited message.
What is TD Bank's official fraud reporting email?
Forward suspicious TD phishing emails to phishing@td.com. For phone call scams, report to TD's fraud line at 1-866-222-3456 and to the Canadian Anti-Fraud Centre at 1-888-495-8501. If you experienced financial loss, file a police report and contact TD's fraud team to initiate a dispute or recovery process for unauthorized transactions.
Can caller ID spoofing make a scam call appear to come from TD's real number?
Yes. Caller ID spoofing is a freely available technique that allows anyone to display any phone number as the caller. Scammers routinely display TD's official fraud number (1-866-222-3456) to increase compliance. The displayed number is not a reliable indicator of who is actually calling. Always hang up and redial TD independently if you want to verify a call's legitimacy.
What happens if I entered my TD credentials on a phishing site?
Change your TD online banking password immediately through the official TD app or by typing td.com in a new browser window. Call TD's fraud line at 1-866-222-3456 to report the compromise and request fraud monitoring on your account. Review your transaction history for unauthorized activity. If transfers have occurred, report them to TD immediately — the sooner you report, the higher the chance of recovery. Enable enhanced authentication settings.
Does TD Bank send text message alerts about transactions?
Yes, TD does send legitimate SMS alerts for transactions — but only if you've enrolled in TD's Alert service through your online banking settings. Legitimate TD transaction alerts identify specific merchant names and amounts. They do not contain links asking you to log in. If you receive a TD transaction alert with a login link and you haven't enrolled in TD Alerts, it is a phishing attempt.
How do I protect my TD account from phishing going forward?
Never click links in unsolicited TD messages — always navigate to td.com directly. Enable TD's transaction alerts through official online banking settings so you recognize what real TD alerts look like. Use a strong, unique password. Never share your OTP with anyone. Regularly review your account for unrecognized transactions. See our debit card fraud guide and Interac scam guide for additional protection strategies.