How to Recover From Identity Theft in Canada: A Step-by-Step Recovery Plan

Recovering from identity theft in Canada requires a systematic, multi-front approach: immediately secure your accounts and place fraud alerts; file reports with police, the Canadian Anti-Fraud Centre, and the appropriate government agencies; dispute fraudulent items on your credit reports with documentation; work with each affected creditor to remove fraudulent accounts; and then rebuild your credit through consistent positive behaviour. Most victims who follow a structured recovery plan see significant credit score improvement within 12–24 months.
[/cr_takeaway]

Recognizing Identity Theft: Signs You’ve Been Victimized

Before diving into the recovery process, it’s important to understand how identity theft is discovered — because many victims don’t realize what’s happened until significant damage has already been done. Knowing the warning signs helps you act faster when the threat materializes.

Common Warning Signs of Identity Theft in Canada

The Complete Canadian Identity Theft Recovery Plan

The following step-by-step plan is organized in roughly chronological order, from the immediate actions you should take on Day 1 through to the longer-term work of credit rebuilding. Some steps will be ongoing for months or years. Others can be completed in a few hours.

Phase 1: Immediate Actions (Day 1–7)

1. Secure and Document Everything

   Before doing anything else, write down everything you know about the fraud: how you discovered it, what accounts or information appear to have been compromised, what documents or identifiers may have been stolen. Create a dedicated file (physical or digital, backed up) for all identity theft correspondence, reports, and evidence. This documentation will be essential throughout your recovery.



2. Change All Account Passwords and Enable Multi-Factor Authentication

   Immediately change the passwords on all financial accounts (banks, credit cards, investment accounts), government accounts (CRA My Account, My Service Canada Account), and email accounts. Use strong, unique passwords for each account — a password manager makes this practical. Enable multi-factor authentication (MFA) on every account that offers it. If your email was compromised, prioritize securing it first, as email is often used to reset other account passwords.



3. Contact Your Financial Institutions

   Call your bank, credit union, and credit card companies immediately. Report any fraudulent transactions and ask them to flag your accounts for unusual activity. Request new account numbers and new cards where accounts have been compromised. Ask each institution for their specific identity theft resolution process and get the names and direct contact information of the fraud department representatives you speak with.



4. Place Fraud Alerts with Both Credit Bureaus

   Contact Equifax Canada (1-800-465-7166) and TransUnion Canada (1-800-663-9980) to place a fraud alert on your credit file. A fraud alert notifies potential creditors that your identity may have been stolen and instructs them to take extra verification steps before approving any credit in your name. Fraud alerts at Canadian credit bureaus typically last for six years, though you can have them removed sooner.



5. Request a Security Freeze at Equifax

   In addition to a fraud alert, contact Equifax Canada to request a security freeze (credit freeze) on your account. This prevents anyone — including you — from opening new credit accounts until the freeze is lifted. TransUnion Canada’s equivalent service is called a “security alert.” A freeze is stronger protection than a fraud alert and is appropriate if you’re experiencing active fraud.



6. Get Copies of Your Full Credit Reports

   Request your complete credit reports from both Equifax and TransUnion immediately. Review them in their entirety. Create a list of every fraudulent account, inquiry, or item. You’ll need this list for the dispute process and for your police report. Note account numbers, lender names, dates opened, and reported balances for each fraudulent item.

Phase 2: Reporting and Official Documentation (Day 1–14)

1. File a Police Report

   Report the identity theft to your local police service. Bring your documentation — your list of fraudulent accounts, any fraudulent correspondence you’ve received, your credit reports with fraudulent items highlighted, and anything else you have. Obtain a copy of the police report and your police report number. This document is essential for working with creditors, credit bureaus, and government agencies. If local police refer you to the RCMP, follow up there as well.



2. Report to the Canadian Anti-Fraud Centre (CAFC)

   File a report with the Canadian Anti-Fraud Centre online at antifraudcentre-centreantifraude.ca or by calling 1-888-495-8501 (Monday to Friday, 9 a.m. to 4:45 p.m. ET). Include all details: what information was stolen, what fraudulent activity you’ve discovered, and how you believe the theft occurred (if known). The CAFC compiles this intelligence to help identify and investigate fraud networks. They will provide you with a reference number.



3. Report to Service Canada if Your SIN Was Compromised

   If you believe your Social Insurance Number has been used fraudulently, call Service Canada at 1-800-206-7218. They will take a report, flag your SIN, and advise you on next steps. In severe cases involving extensive fraudulent employment or benefits claims, they may assist with the process of obtaining a new SIN — though this is a complex process reserved for the most serious cases.



4. Report to the Canada Revenue Agency (CRA)

   If there is any possibility that your SIN was used for tax fraud — including fraudulent tax filings, fraudulent refund claims, or unauthorized employment — contact CRA’s Identity Protection Program at 1-800-959-8281. Inform them that your identity has been stolen and request a review of your tax account for fraudulent activity. CRA can place a flag on your account that requires additional verification for future filings and can help you sort out any fraudulent tax assessments.



5. Report to the Office of the Privacy Commissioner

   If your personal information was compromised due to a data breach or privacy violation by a business, consider filing a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca or by calling 1-800-282-1376. Businesses subject to PIPEDA are required to have reasonable data security safeguards and to report serious data breaches to the Privacy Commissioner. If a company’s negligence contributed to your identity theft, this is an important avenue.

Phase 3: Disputing Fraudulent Credit Items (Weeks 2–8)

Once you have your police report, CAFC reference number, and credit reports with fraudulent items documented, you can begin the formal dispute process with credit bureaus and creditors. This phase requires patience and persistence but is typically the most impactful for your credit score.

1. File Formal Disputes with Both Credit Bureaus

   Send formal written disputes to both Equifax Canada and TransUnion Canada for each fraudulent item on your respective reports. Your dispute package should include: a completed dispute form (available on each bureau’s website), a copy of your photo ID, a copy of your police report, your CAFC reference number, a clear written statement identifying each fraudulent item and explaining that you are a victim of identity theft, and any supporting documentation. Send by registered mail with delivery confirmation, or through the bureaus’ secure online dispute portals.



2. Contact Each Creditor Directly About Fraudulent Accounts

   At the same time as your credit bureau disputes, contact the fraud department of each creditor associated with a fraudulent account. For each institution, explain that you are an identity theft victim, that you never opened or authorized the account, and that you need them to close the account and report it as fraudulent to the credit bureaus. Provide your police report number and CAFC reference number. Document every call — date, time, representative name, and what was agreed.



3. Follow Up on Disputes Within 30 Days

   Credit bureaus in Canada are required to investigate and respond to disputes within 30 days. Follow up if you don’t receive a response within this period. If a bureau determines that a disputed item is indeed fraudulent, they should remove it from your credit file. If they leave it in place, ask for the specific reason in writing.



4. Request Verification of Investigation Results

   After each dispute is resolved, request a written confirmation from the credit bureau of what action was taken. If a fraudulent account was removed, request an updated credit report showing the removal. Keep all these confirmations in your identity theft file.



5. Escalate Unresolved Disputes

   If a credit bureau refuses to remove a verified fraudulent account, or if a creditor refuses to stop reporting a fraudulent account, escalate. Options include: filing a complaint with the Financial Consumer Agency of Canada (FCAC) if it involves a federally regulated bank; filing a complaint with your provincial consumer protection authority; consulting Legal Aid or a consumer lawyer; and considering small claims court for damages in clear-cut cases of fraud that institutions are refusing to resolve.

Phase 4: Resolving Government Account Fraud

Government identity fraud — fraudulent tax returns, EI claims, CPP applications, or other benefits — requires a separate track of recovery efforts alongside the credit dispute process. These are separate systems from the credit bureaus and require working directly with the relevant federal agencies.

CRA Tax Fraud Recovery

1. Review Your Complete CRA Tax History

   Log into CRA My Account and review your tax filing history for any years where a fraudulent return may have been filed. Check income reported, deductions claimed, refunds issued, and assessments received. Note any discrepancies.



2. File a Fraudulent Return Correction Request

   If a fraudulent tax return was filed using your SIN, you’ll need to work with CRA to correct the record. This typically involves filing a request for reassessment and providing documentation proving that the fraudulent return is not yours. CRA’s Identity Protection Program (1-800-959-8281) can guide you through this process.



3. Address Any Tax Debt Resulting from Fraud

   If the fraudulent tax activity resulted in a tax assessment or debt in your name, do not ignore it. Contact CRA and explain the situation with your police report documentation. CRA has processes for addressing taxes assessed as a result of identity theft and can place collection holds while the matter is investigated.

Employment Insurance and Benefits Fraud Recovery

1. Review Your My Service Canada Account

   Log into My Service Canada Account and review your EI claims history and CPP contribution record for fraudulent activity. If claims have been made using your SIN that you didn’t make, report them directly to ESDC (1-800-206-7218).



2. File a Fraudulent EI Claim Report

   If someone filed an EI claim using your SIN, file a formal report with Service Canada. They will investigate and, if fraud is confirmed, work to correct your EI record. This is important not just for recovering from the current fraud but for preserving your future EI entitlements based on your actual employment history.

Phase 5: Protecting Your Identity Going Forward

After the immediate crisis is managed and disputes are filed, you need to put permanent protective measures in place to prevent future identity theft and to catch any new fraud quickly if your information continues to be circulated on criminal networks.

1. Set Up Ongoing Credit Monitoring

   Enrol in free credit monitoring through Borrowell (Equifax data) and Credit Karma (TransUnion data), or invest in a paid monitoring service from one of the credit bureaus. Set up alerts for new accounts opened, new inquiries, address changes, and any other account changes. After identity theft, real-time monitoring is essential.



2. Enable Notifications on All Financial Accounts

   Set up transaction alerts on all your bank accounts, credit cards, and investment accounts. Most Canadian financial institutions offer email or SMS alerts for any transaction above a threshold you set, any new payee added, any change to your contact information, or any login from a new device. These real-time alerts are your early warning system.



3. Use a Dedicated Email Address for Financial Accounts

   Create a dedicated email address used only for financial and government accounts — not for shopping, social media, or general communications. This significantly reduces the risk of that address being exposed in a data breach or targeted phishing campaign. Use a strong, unique password and MFA on this email.



4. Review Your Mail and Consider Mail Forwarding Notifications

   If you believe your mail was tampered with or diverted (a method some identity thieves use to intercept financial statements and account cards), contact Canada Post about mail forwarding alerts. Some provinces offer mail monitoring services. Consider switching to paperless statements for all financial accounts to eliminate the physical mail vulnerability.



5. Shred All Financial Documents

   Purchase a cross-cut shredder and shred all financial documents before disposal — credit card statements, bank statements, pre-approved credit offers, tax documents, and anything else containing your personal or financial information. “Dumpster diving” remains a surprisingly common method of identity theft in Canada.

Phase 6: Rebuilding Your Credit After Identity Theft

Once fraudulent accounts have been removed from your credit reports and your legitimate credit history is restored, you can focus on rebuilding any remaining credit damage. Even with all fraudulent items removed, identity theft victims often have other credit damage — legitimate accounts that fell behind during the crisis, or a thin credit file if the fraud resulted in accounts being closed.

Credit Rebuilding Timeline After Identity Theft

1. Open a Secured Credit Card

   Once your immediate fraud crisis is managed, apply for a secured credit card. This is the most accessible credit-rebuilding tool for Canadians with damaged credit. A secured card requires a cash deposit (typically $200–$500) as collateral and reports your payment history to the credit bureaus exactly like a regular credit card. Options include Capital One Secured Mastercard, Home Trust Secured Visa, and Refresh Financial. Use it for small, regular purchases and pay the full balance each month.



2. Consider a Credit-Builder Loan

   Some Canadian credit unions offer credit-builder products where your loan payments are made into a locked savings account. The payment history is reported to credit bureaus, helping rebuild your score. At the end of the term, you receive the savings. This is a low-risk way to establish positive credit history without taking on real debt risk.



3. Maintain Low Credit Utilization

   Keep balances below 30% of your credit limit on each card — aim for under 10% for the best score impact. If your secured card has a $300 limit, keep your balance below $90 at statement time. Request a credit limit increase after 6 months of on-time payments to further reduce your utilization ratio.



4. Make Every Payment on Time, Every Time

   Payment history is the single most important factor in your credit score — typically 35% of the calculation under most Canadian scoring models. Set up automatic minimum payments at the absolute minimum, and ideally automatic full payments. One missed payment can undo months of progress.



5. Diversify Your Credit Mix Over Time

   After 12–18 months of strong payment history on your secured card, consider adding a second type of credit product — perhaps a credit-builder loan or a retail store card with a low limit. A mix of credit types (revolving credit, instalment loans) modestly improves your credit score over time.



6. Apply for Unsecured Credit When Ready

   After establishing a solid 12–18 month payment history, you may qualify for an unsecured credit card or a small personal loan from your bank or credit union. Upgrading from a secured to an unsecured product is a milestone in your recovery. When you graduate, your deposit is returned and your credit limit may increase.

Working with Creditors Who Won’t Cooperate

One of the most frustrating aspects of identity theft recovery in Canada is dealing with creditors who are slow to acknowledge fraud or remove fraudulent accounts. Here is a systematic escalation path:

1. Document Every Communication with Creditors

   Keep a log of every phone call, email, and letter — including dates, names of representatives, reference numbers, and what was promised or decided. This documentation is essential if you need to escalate.



2. Escalate Within the Institution

   Ask to speak with a supervisor or the dedicated fraud resolution team. Standard customer service representatives may have limited authority to resolve complex identity theft cases. Fraud department supervisors or “account specialists” typically have more tools and authority.



3. Use the Institution's Formal Complaints Process

   Every federally regulated financial institution in Canada is required to have a formal complaints process, including an internal ombudsman or complaints office. File a formal written complaint if frontline resolution fails. This typically triggers a more thorough review and a written response.



4. Contact the External Ombudsman

   If the institution’s internal complaints process doesn’t resolve the issue, escalate to the external ombudsman. For banks, this is the Ombudsman for Banking Services and Investments (OBSI) at 1-888-451-4519 or obsi.ca. OBSI provides free, independent dispute resolution.



5. File a Complaint with the FCAC

   For federally regulated financial institutions, file a complaint with the Financial Consumer Agency of Canada (FCAC) at 1-866-461-3222. The FCAC has the authority to investigate and can require institutions to comply with their legal obligations.



6. Consult a Consumer Law Lawyer

   For significant, unresolved identity theft cases — particularly where you can prove that a creditor’s negligence contributed to the fraud (e.g., approving credit without proper verification in a fraud alert situation) — consulting a consumer lawyer or filing in small claims court may be appropriate. Legal Aid Canada and provincial Legal Aid offices may be able to assist with representation.

The Emotional Impact of Identity Theft and How to Cope

Identity theft is not just a financial crime — it’s a personal violation that many victims describe as similar to being physically robbed. Feelings of anger, anxiety, violation, helplessness, and overwhelm are all normal responses. Acknowledging these feelings and getting appropriate support is part of a complete recovery.

Practical Strategies for Managing the Recovery Process

• Break the process into manageable steps: The recovery plan in this guide is organized as discrete, achievable steps. Focus on completing one step at a time rather than trying to tackle everything at once.
• Keep a dedicated file: Organization reduces anxiety. Having all your documentation, correspondence, and notes in one place gives you a sense of control.
• Set aside specific “recovery time” each week: Rather than having the identity theft crisis follow you everywhere, set dedicated time each week to work on recovery tasks. Outside of that time, try to limit the mental bandwidth devoted to the problem.
• Lean on support: Tell trusted family members or friends what’s happening. Their support can be practically helpful (helping you organize or research) and emotionally invaluable.
• Celebrate milestones: When a fraudulent account is removed, when your credit score improves, when a dispute is resolved — recognize these as real victories. Recovery is a marathon, not a sprint, and acknowledging progress helps sustain momentum.

Special Situations in Canadian Identity Theft Recovery

Identity Theft Affecting Tax Refunds

One of the most common forms of identity theft in Canada involves filing a fraudulent tax return to claim the victim’s refund. If you file your return and are told one has already been filed for your SIN, here are the specific steps:

• Call CRA immediately at 1-800-959-8281 and explain the situation
• CRA will ask you to complete a T1 General (your legitimate return) and include a note explaining the fraudulent filing
• You will need to mail a paper return with supporting documents — electronic filing will not be available until the fraud is resolved
• CRA will investigate and, once the fraud is confirmed, will reassess your account based on your legitimate return and issue any refund you’re entitled to
• This process can take several months — follow up regularly

Identity Theft Involving Mortgage Fraud

In some cases, sophisticated identity thieves have fraudulently obtained mortgages using victims’ identities — typically by stealing sufficient personal information to pass as the victim with a mortgage lender. This is among the most serious forms of identity theft and requires additional steps:

• Contact the mortgage lender immediately with your police report
• Contact the provincial land registry where the fraudulent mortgage is registered (each province has its own process)
• Engage a lawyer who specializes in real property and identity fraud — this is complex enough to warrant professional legal representation
• Report to OSFI (Office of the Superintendent of Financial Institutions) if the mortgage was with a federally regulated lender: 1-800-385-8647
• Contact the Law Society in your province if a notary or lawyer was involved in the fraudulent transaction

Identity Theft Involving Children

Children are particularly vulnerable to identity theft because their SINs are rarely monitored. Fraud involving a child’s SIN may go undetected for years, only surfacing when the child applies for their first job, student loan, or credit card. If you discover your child’s identity has been stolen:

• File a police report on your child’s behalf
• Contact Service Canada to report SIN fraud (1-800-206-7218)
• Request credit reports from Equifax and TransUnion for your child — this is normally possible with documentation establishing parentage or legal guardianship
• Dispute all fraudulent items following the same process as for adults
• Contact CRA if the child’s SIN was used for fraudulent tax filings
• Consider whether a new SIN is warranted given the child’s age and the extent of the fraud

Key Canadian Resources for Identity Theft Recovery