Identity Theft and Credit Fraud in Canada: Prevention & Recovery Guide 2026

Life Situations & Credit

Identity Theft and Credit Fraud in Canada: Prevention & Recovery Guide 2026

Mar 20, 202628 min read

Identity theft is the fastest-growing crime in Canada. In 2025 alone, the Canadian Anti-Fraud Centre (CAFC) received over 60,000 reports of fraud-related identity crimes, with losses exceeding $600 million — and those are only the cases that were reported. Experts estimate that fewer than 5% of fraud victims ever file a formal complaint.

For Canadians already navigating the challenges of bad credit or financial recovery, identity theft can be a devastating setback. A fraudster opening accounts in your name, maxing out credit cards, or taking out loans under your Social Insurance Number can obliterate years of hard-won credit rebuilding in a matter of days.

This guide covers everything you need to know: how identity theft happens in Canada, how to protect yourself, what to do the moment you suspect fraud, and how to recover your credit and your identity — step by step, using the specific Canadian agencies and tools available to you.

Unlike the United States, Canada does not have a federally mandated credit freeze option. This guide explains what Canadian alternatives exist, including fraud alerts and extended fraud alerts through Equifax Canada and TransUnion Canada, and how to use them effectively.

Types of Identity Theft Affecting Canadians

Identity theft is not a single crime — it’s an umbrella term covering dozens of distinct fraud types. Understanding which type you’re dealing with shapes every step of your response and recovery plan.

Financial Identity Theft

The most common form. A fraudster uses your personal information to open credit cards, apply for loans, access existing bank accounts, or make purchases on credit. This directly impacts your credit score and can result in collections, judgments, and wage garnishments — all under your name.

Social Insurance Number (SIN) Fraud

Your SIN is the master key to your financial life. When stolen, it can be used to file fraudulent tax returns to collect refunds from the CRA, apply for Employment Insurance or Canada Pension Plan benefits, open financial accounts, and obtain employment under your identity. SIN fraud is particularly damaging because it involves government systems that take significant time and bureaucracy to unwind.

Service Canada will never call you threatening arrest or demanding your SIN over the phone. If you receive such a call, hang up immediately. These are “SIN scam” calls — one of the top fraud types reported to the CAFC each year. Do not confirm, deny, or provide any information.

Medical Identity Theft

A fraudster uses your provincial health card number or personal information to obtain prescription drugs, medical devices, or healthcare services. This is less common than financial identity theft but carries serious consequences: fraudulent medical records could affect your own future healthcare and insurance coverage.

Tax Identity Theft

Using your SIN and personal details, a thief files a fraudulent tax return before you do, redirecting your refund. The CRA has strengthened its detection systems, but victims can face months of delays in receiving legitimate refunds while the fraud is investigated. Contact the CRA’s individual enquiries line (1-800-959-8281) immediately if you suspect your tax account has been compromised.

Account Takeover Fraud

Rather than creating new accounts, fraudsters gain access to your existing financial accounts — often by obtaining enough personal information to pass security questions or by working with a data breach. They then change contact information, drain funds, or use the accounts to conduct further fraud.

Synthetic Identity Fraud

A relatively new and growing threat, synthetic identity fraud combines real and fabricated information — often using a real SIN with a false name and date of birth. These “Frankenstein identities” are harder to detect and can spend months building a fraudulent credit profile before a bust-out occurs, leaving lenders and the true SIN holder to sort out the damage.

How Your Identity Gets Stolen: Tactics to Watch For

Understanding how thieves obtain your information is the first step toward preventing it. Modern identity theft is rarely a single act — it’s often a multi-step process that begins long before you notice anything wrong.

Phishing, Smishing, and Vishing

Phishing refers to fraudulent emails designed to look like they come from legitimate institutions — your bank, the CRA, Canada Post, or a telecom provider. These emails typically create urgency (“Your account will be suspended!”) and direct you to a fake website that harvests your credentials.

Smishing is the SMS version: text messages containing fraudulent links. Common Canadian smishing scams include fake package delivery notifications from “Canada Post,” CRA refund texts, and fake Interac e-Transfer alerts.

Vishing involves phone calls from fraudsters posing as bank representatives, government officials, or technical support staff. The “CRA scam” — where callers threaten arrest for unpaid taxes — has cost Canadians tens of millions of dollars. The real CRA communicates primarily by mail; they will not demand payment by gift card or cryptocurrency over the phone.

Your bank will NEVER ask for your full PIN, password, or one-time passcode over the phone or by email. The CRA will NEVER demand immediate payment by Interac e-Transfer, cryptocurrency, or gift cards. Canada Post will NEVER ask for credit card details to release a package via text message. When in doubt, hang up and call the organization directly using the number on their official website.

Data Breaches

Millions of Canadians have had personal information exposed through corporate and government data breaches. Major breaches affecting Canadians in recent years have included financial institutions, retailers, healthcare providers, and even government databases. You can check if your email address has appeared in known data breaches using HaveIBeenPwned.com.

Mail Theft and Dumpster Diving

Old-fashioned physical theft remains effective. Mail containing pre-approved credit offers, bank statements, T4 slips, or government benefit notices provides everything a fraudster needs. Consider a locked mailbox, and shred — don’t simply discard — any documents containing personal information.

Social Engineering and Oversharing

Fraudsters research potential victims on social media. Your birthday, hometown, employer, and mother’s maiden name — all commonly shared online — are frequently the answers to security questions. Be thoughtful about what personal details you share publicly, even on platforms like LinkedIn.

Skimming and Point-of-Sale Fraud

Physical card skimmers attached to ATMs and payment terminals capture card data. Always cover the keypad when entering your PIN, use chip-and-PIN rather than tap where possible at unfamiliar terminals, and check card readers for anything that seems loose or out of place before inserting your card.

Protecting Your Social Insurance Number (SIN)

Your SIN is a nine-digit number issued by Service Canada for tax and benefits purposes. It is one of the most sensitive pieces of personal information you possess, and the damage from SIN theft can persist for years.

Who Actually Needs Your SIN?

Most people are surprised to learn how few organizations are legally entitled to request your SIN. Only provide your SIN to:

• Your employer (required for tax reporting)
• Financial institutions for interest-bearing accounts, investments, and credit applications
• Government agencies (CRA, Service Canada, ESDC)
• Some pension plan administrators

You are NOT required to provide your SIN to landlords (they can request it, but you can refuse), medical providers, retailers, insurance companies for non-financial matters, or most businesses collecting personal information for marketing purposes.

Your physical SIN card (or the confirmation letter, if you were issued the newer format) should be kept in a secure location — not your wallet. Memorize your SIN and store the physical document in a locked safe or safety deposit box. Never photograph your SIN card and store it in cloud services or messaging apps.

What to Do If Your SIN Is Compromised

Service Canada’s official position is that SINs are generally not reissued — they are permanent identifiers. However, in cases of confirmed fraud or identity theft, Service Canada can issue a new SIN under strict circumstances. You’ll need to provide extensive documentation including police reports, identity documents, and evidence of misuse.

Contact Service Canada at 1-800-206-7218 to report a compromised SIN and inquire about next steps specific to your situation.

Fraud Alerts in Canada: Your Primary Credit Protection Tool

Since Canada does not offer a true credit freeze — a tool available in the United States that completely blocks new credit applications — fraud alerts are the most powerful credit protection mechanism available to Canadians.

What Is a Fraud Alert?

A fraud alert is a notation placed on your credit file that instructs lenders to take extra verification steps before extending credit in your name. When a fraud alert is active, any lender checking your credit is notified that they should verify your identity through additional means — typically by calling you at a phone number you specify — before approving any new credit.

Initial Fraud Alert vs. Extended Fraud Alert

How to Place a Fraud Alert with Equifax Canada

Equifax Canada operates separately from Equifax US — you must contact the Canadian office directly. To place a fraud alert:

• Online: equifax.ca — log in or create a myEquifax account and navigate to fraud services
• Phone: 1-800-465-7166
• Mail: Equifax Canada, Box 190, Jean-Talon Station, Montreal, QC H1S 2Z2

You will need to provide government-issued ID, your full name, address history, date of birth, and SIN (last four digits in some cases). For an extended alert, include a copy of your police report.

How to Place a Fraud Alert with TransUnion Canada

TransUnion Canada also operates independently and must be contacted separately:

• Online: transunion.ca — create an account and use the fraud section
• Phone: 1-800-663-9980 (English) / 1-877-713-3393 (French)
• Mail: TransUnion Consumer Relations Centre, Box 338, LCD1, Hamilton, ON L8L 7W2

Equifax and TransUnion are separate companies with separate databases. A fraud alert placed with one bureau is NOT automatically shared with the other. You must contact both bureaus individually to ensure full protection. This is one of the most common mistakes Canadians make when responding to suspected identity theft.

Why Canada Doesn’t Have a Credit Freeze

In the United States, federal law mandates that credit bureaus offer free, permanent credit freezes. Canada’s credit reporting system is governed by a patchwork of provincial consumer protection laws and federal privacy legislation (PIPEDA), with no equivalent national mandate. Consumer advocacy groups including the Public Interest Advocacy Centre have repeatedly called for Canada to implement a credit freeze option, but as of 2026, no such legislation has been passed.

The practical difference: a fraud alert asks lenders to verify your identity before extending credit, but a sufficiently convincing fraudster with your documents can still potentially pass that verification. A credit freeze would outright block new credit inquiries. This gap in Canadian consumer protection is meaningful, which is why active credit monitoring is particularly important for Canadians at risk.

Credit Monitoring in Canada: What’s Available and What’s Free

Credit monitoring means regularly checking your credit report and credit score for changes — particularly unexpected inquiries, new accounts, or changes to your personal information on file. In Canada, you have several options ranging from completely free to paid subscription services.

Free Credit Reports (Your Legal Right)

Under provincial consumer protection legislation and PIPEDA, every Canadian is entitled to request a free copy of their credit report from both Equifax and TransUnion at any time. This is your statutory right — and it includes a full report with your complete credit history, all accounts, inquiries, and personal information on file.

• Equifax Canada free report: equifax.ca/personal/credit-report-score/free-equifax-credit-report/
• TransUnion Canada free report: transunion.ca/products/credit-report

Important distinction: the free statutory report may take 7–10 business days to arrive by mail (in some cases), while instant online access is typically available through a free account with each bureau. Do not confuse the free credit report with paid credit score monitoring services — the score itself is not legally required to be provided free of charge, though both bureaus offer free score access as well.

Free Monitoring Options

For Canadians who have experienced or are at risk of identity theft, using both Borrowell (Equifax data) and Credit Karma (TransUnion data) together provides monitoring of both bureaus at no cost.

Reporting Identity Theft in Canada: Who to Contact and When

When identity theft occurs, time is critical. The faster you report, the more effectively authorities can act — and the stronger your paper trail for credit disputes and potential legal proceedings. Here is the order of operations.

1. Contact Your Financial Institutions Immediately

   Call your bank, credit card company, and any affected lender the moment you suspect fraud. Ask them to flag your accounts, freeze affected cards, and initiate their fraud investigation process. Request a fraud case number — you will need this for subsequent reports. Most major Canadian banks have 24/7 fraud lines: RBC (1-800-769-2512), TD (1-866-222-3456), Scotiabank (1-800-4-SCOTIA), BMO (1-877-225-5266), CIBC (1-800-663-4575).

2. Place Fraud Alerts with Both Credit Bureaus

   Contact Equifax Canada (1-800-465-7166) and TransUnion Canada (1-800-663-9980) to place fraud alerts on your files. Request copies of your current credit reports to identify all fraudulent accounts. Ask each bureau for a list of all recent inquiries — this tells you which lenders a fraudster has already approached in your name.

3. File a Report with Your Local Police

   Visit your local police station (or use an online reporting portal if available in your jurisdiction) to file an identity theft report. Obtain a copy of the police report or at minimum the report number — this is required for extended fraud alerts, Service Canada SIN investigations, and formal credit bureau dispute processes.

4. Report to the Canadian Anti-Fraud Centre (CAFC)

   The CAFC is Canada’s central repository for fraud and cybercrime complaints. Report online at antifraudcentre-centreantifraude.ca or by phone at 1-888-495-8501. The CAFC compiles intelligence used by the RCMP and other law enforcement agencies — your report contributes to investigations that may stop ongoing fraud operations.

5. Contact the CRA If Tax Fraud Is Involved

   If you suspect your SIN has been used for tax fraud, call the CRA’s individual enquiries line at 1-800-959-8281. Request that your My Account be reviewed and that additional security measures be placed on your file. You may also need to contact Service Canada (1-800-206-7218) regarding Employment Insurance or pension-related fraud.

6. File a Complaint with Your Provincial Privacy Commissioner

   If your personal information was compromised by a business or organization, you can file a privacy complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or your provincial privacy commissioner. Provinces with their own commissioners include Alberta (OIPC), British Columbia (OIPC BC), and Quebec (Commission d’accès à l’information).

7. Document Everything

   Create a fraud documentation file: copies of all police reports, case numbers from financial institutions and credit bureaus, records of every call made (date, time, name of representative), copies of disputed accounts, and all correspondence. This file is your lifeline throughout the recovery process, which can span months or years.

The Canadian Anti-Fraud Centre (CAFC): Your Primary Reporting Hub

The Canadian Anti-Fraud Centre is a joint operation of the RCMP, the Competition Bureau of Canada, and the Ontario Provincial Police. It serves as the national hub for collecting fraud and cybercrime intelligence in Canada.

Unlike the RCMP or local police, the CAFC does not investigate individual cases — its role is intelligence gathering and dissemination. However, filing a CAFC report is important for three reasons:

1. Pattern detection: Your report may be the piece that triggers an investigation into a fraud ring targeting many Canadians
2. Documentation: CAFC reports are accepted as supporting documentation by credit bureaus in dispute processes
3. Statistics: CAFC data informs government policy on consumer protection and fraud prevention

Report to the CAFC at: antifraudcentre-centreantifraude.ca or 1-888-495-8501 (Monday to Friday, 9 a.m. to 4:45 p.m. ET)

Disputing Fraudulent Accounts on Your Canadian Credit Report

Removing fraudulent accounts from your credit report requires a formal dispute process with each credit bureau. Unlike some consumer advocacy myths suggest, legitimate fraud disputes are generally resolved — but they require persistence, documentation, and follow-through.

How to Dispute with Equifax Canada

Equifax Canada’s dispute process accepts submissions online (equifax.ca), by phone (1-800-465-7166), or by mail. You will need to:

1. Identify the specific account(s) you are disputing, including account numbers and creditor names
2. State clearly that the account was opened fraudulently without your knowledge or consent
3. Provide supporting documentation: government ID, police report, CAFC report number
4. Request that all related inquiries be removed as well

Equifax has up to 30 days to investigate and respond. If the dispute is upheld, the account is removed and Equifax must notify you in writing. If denied, you have the right to add a 100-word consumer statement to your credit file and to escalate to the provincial or federal privacy commissioner.

How to Dispute with TransUnion Canada

TransUnion’s process is similar. Submit disputes online (transunion.ca), by phone (1-800-663-9980), or by mail to their Hamilton, Ontario address. Provide the same documentation as required by Equifax. TransUnion also has a 30-day investigation window.

Working Directly with Lenders

Credit bureaus do not have the authority to simply delete accounts — they must verify with the original creditor. In addition to disputing with the bureaus, contact the lender that holds the fraudulent account directly. Most financial institutions have dedicated fraud departments with the authority to close fraudulent accounts and instruct credit bureaus to remove them. Get everything in writing.

Canada’s federal privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), gives you the right to access your personal information held by private sector organizations, to challenge its accuracy, and to have it corrected. Provincial privacy laws (PIPA in Alberta and BC, and Quebec’s Law 25) provide similar or stronger protections. If a lender or credit bureau refuses to correct fraudulent information, you can file a formal complaint with the relevant privacy commissioner — this escalation is often the catalyst that drives faster resolution.

Digital Security: Protecting Yourself Online

For Canadians managing their finances online — as most do — digital security practices are inseparable from credit and identity protection. Here are the most impactful steps you can take.

Password Security

Use a password manager (Bitwarden, 1Password, and LastPass are widely used) to generate and store unique, complex passwords for every account. A password manager eliminates the most common vulnerability: password reuse. When one site is breached, attackers automatically try those credentials on banks, email services, and government portals (a technique called “credential stuffing”).

Two-Factor Authentication (2FA)

Enable 2FA on all financial accounts, your email, and your government online portals (CRA My Account, My Service Canada Account). Authenticator apps (Google Authenticator, Microsoft Authenticator, Authy) are more secure than SMS-based codes, since SIM swapping attacks can intercept text messages. The extra 30 seconds required at login is a small price for dramatically enhanced security.

Secure Your Email

Your email account is the master key to most of your other accounts — password resets flow through it. Use a strong, unique password and enable 2FA. Monitor your sent folder and login history for signs of unauthorized access.

Be Cautious With Public Wi-Fi

Avoid accessing banking, government accounts, or any service requiring personal information on public Wi-Fi networks (coffee shops, airports, hotels). If necessary, use a reputable VPN (virtual private network) to encrypt your connection. Many free VPNs are themselves data collection operations — choose a paid service with a clear no-logging policy.

Keep Devices Updated

Software updates are predominantly security patches. Leaving your operating system or apps unpatched leaves known vulnerabilities open for exploitation. Enable automatic updates on all devices, including your router’s firmware.

Monitor Your Digital Footprint

Periodically search your own name, phone number, and email address online to see what personal information is publicly accessible. Data broker sites aggregate and sell personal information — Canadian services like DeleteMe can help reduce your exposure, though Canadian data protection frameworks are generally stronger than U.S. equivalents regarding data broker activity.

Identity Theft Recovery: Rebuilding Your Credit After Fraud

Once the immediate response steps are complete and fraudulent accounts are in the process of being removed, your focus shifts to recovery. For Canadians already working to rebuild credit, this phase requires particular attention to ensure that fraud-related damage doesn’t permanently derail your progress.

Confirm All Fraudulent Items Are Removed

After disputing fraudulent accounts, pull both credit reports again to confirm the items have been removed. Check not only the accounts themselves but also:

• Hard inquiries made by lenders on behalf of the fraudster
• Personal information (address history, employer) that the fraudster may have changed
• Collections accounts that may have been opened in your name

Establish a Clean Credit Baseline

Once fraudulent items are removed, review what remains on your credit file. This is your true starting point for recovery. If your credit was already in repair mode before the fraud, you may now need to restart or accelerate your strategy. Secured credit cards, credit-builder loans, and becoming an authorized user on a trusted family member’s account are proven pathways for credit rebuilding in Canada.

Work With a Non-Profit Credit Counsellor

Credit Counselling Canada (creditcounsellingcanada.ca) and the Credit Counselling Society (nomoredebts.org) offer free or low-cost counselling to Canadians navigating debt and credit challenges — including fraud recovery. These organizations can help you create a recovery plan, negotiate with creditors, and avoid the predatory credit repair companies that often target fraud victims.

Fraud victims are frequently targeted by predatory “credit repair” companies promising to remove negative items from their credit report — for a fee. In Canada, you cannot legally pay a third party to remove accurate, legitimately reported information from your credit report. Any company promising to “erase” your bad credit history or offering a “new credit identity” is either running a scam, operating illegally, or both. You have the right to dispute inaccurate information yourself, for free, through the credit bureaus.

Timeline for Credit Recovery After Fraud

Government Resources for Canadian Fraud Victims

Canada has a number of federal and provincial resources specifically for fraud and identity theft victims. Bookmark these and use them — they are funded by your tax dollars and are there to help.

Federal Resources

• Canadian Anti-Fraud Centre: antifraudcentre-centreantifraude.ca | 1-888-495-8501
• Office of the Privacy Commissioner of Canada: priv.gc.ca | 1-800-282-1376
• Canada Revenue Agency (tax fraud): canada.ca/en/revenue-agency | 1-800-959-8281
• Service Canada (SIN fraud): canada.ca/service-canada | 1-800-206-7218
• RCMP cybercrime reporting: rcmp-grc.gc.ca/cybercrime
• Get Cyber Safe (federal public awareness): getcybersafe.gc.ca

Provincial Privacy Commissioners

For incidents involving businesses or organizations operating within their province, provincial privacy commissioners have jurisdiction and can compel organizations to correct fraudulent information:

• Alberta: Office of the Information and Privacy Commissioner of Alberta — oipc.ab.ca
• British Columbia: Office of the Information and Privacy Commissioner for BC — oipc.bc.ca
• Quebec: Commission d’accès à l’information du Québec — cai.quebec.ca
• All other provinces: Federal Office of the Privacy Commissioner applies — priv.gc.ca

Special Situations: Romance Scams, Job Scams, and Emerging Threats

Romance Scams

Romance fraud is one of the highest-loss fraud categories in Canada. Fraudsters build elaborate fake relationships over weeks or months before requesting money transfers — or, increasingly, asking for information that facilitates identity theft. They may request a copy of your ID for a supposed visa application, ask for your banking information to “send you money,” or request your SIN for a fictitious employment opportunity. In 2025, romance fraud losses reported to the CAFC exceeded $50 million — and most cases go unreported due to shame.

Employment Scams

Fake job postings are an increasingly common vector for identity theft. “Employers” request SINs, banking information, and government ID upfront as part of a supposed onboarding process. Legitimate employers in Canada request SIN information only after employment has begun, for tax reporting purposes. Any job offer that requires you to provide this information before starting — especially for remote positions — warrants significant scrutiny.

CRA and Government Impersonation

CRA impersonation scams remain among the most reported fraud types in Canada. These calls or texts claim you owe back taxes and threaten immediate arrest. The real CRA will: send written notice before calling about a debt, never demand payment by gift cards or cryptocurrency, and never threaten police involvement as part of a collection call. If you receive a suspicious CRA communication, call the CRA directly at 1-800-959-8281 to verify.

AI-Enabled Fraud: The Emerging Frontier

Artificial intelligence is dramatically lowering the cost and increasing the sophistication of fraud. Voice cloning technology can now replicate a family member’s voice from just a few seconds of audio, enabling the “grandparent scam” and similar family emergency frauds to be far more convincing. Deepfake video is being used in some cases to pass video verification requirements. The CAFC has flagged AI-enabled fraud as one of the top emerging threats for 2025–2027. Establish a family code word or verification phrase that can confirm identity in emergency situations.

Staying Vigilant: Your Ongoing Identity Protection Checklist

Identity theft protection is not a one-time task — it’s an ongoing practice. Here is a maintenance checklist for Canadian consumers:

Monthly

• Review bank and credit card statements for unauthorized transactions
• Check credit monitoring alerts from Borrowell and/or Credit Karma
• Review your email sent folder and login activity for signs of unauthorized access

Quarterly

• Pull your full credit report from one bureau (alternate between Equifax and TransUnion each quarter)
• Review all hard inquiries — any you don’t recognize warrant immediate follow-up
• Update passwords on high-value accounts (banking, email, government portals)

Annually

• Pull and review full credit reports from both Equifax and TransUnion
• Review your CRA My Account for any filing activity you don’t recognize
• Confirm your fraud alerts are still active (they may expire and need renewal)
• Review what personal information is associated with your accounts (address, phone, email) and update anything outdated
• Check HaveIBeenPwned.com to see if your email addresses have appeared in new data breaches
• Confirm your SIN card and sensitive documents are still securely stored

The period from February to April — tax filing season in Canada — is when tax-related identity fraud spikes dramatically. File your tax return as early as possible: a fraudster cannot file a fraudulent return in your name if you’ve already filed. Set up CRA My Account and My Service Canada Account before someone else does it using your information. Enable the CRA’s “Auto-fill my return” and review all pre-populated information carefully for discrepancies that could indicate prior fraud.

Identity theft is not a matter of if but when for many Canadians. The fraudsters are persistent, increasingly sophisticated, and operate at scale. But with the right knowledge, the right tools, and consistent vigilance, you can minimize your exposure, detect problems early, and recover fully if the worst does happen. The resources are there — it’s a matter of using them.

If you’re currently dealing with identity theft or fraud and need guidance on the credit rebuilding path forward, our team at CreditResources.ca is here to help. We work with Canadians at every stage of the credit journey — including those navigating the difficult terrain of fraud recovery.