How to protect yourself from identity theft in Canada — and what to do if it happens

Identity theft is when criminals steal your personal information; identity fraud is when they use it — to open bank accounts, get loans and credit cards, buy goods, or obtain passports and government benefits in your name, the Canadian Anti-Fraud Centre (CAFC) explains. The theft can be as simple as stolen mail or as elaborate as phishing or a database breach. Identity fraud was the fraud most often reported to the CAFC in 2025, with 8,403 reports, and the CAFC notes that most victims aren't responsible for the losses.

Free steps that make identity theft harder

• Guard your Social Insurance Number. Keep your SIN card in a safe place at home, not in your wallet, and give the number only when it's legally required — never by phone, email, text or an unsolicited link, the CAFC says.
• Check your credit reports. Equifax and TransUnion, Canada's two main credit bureaus, give you your report free online or by mail, and checking doesn't affect your credit rating. Look at least once a year for accounts you didn't open.
• Protect your mail. Collect it every day, use Canada Post's Hold Mail service when you're away, and shred statements and credit card offers before throwing them out.
• Use strong, unique passwords and multi-factor authentication — phishing-resistant where possible, the Canadian Centre for Cyber Security says — and never share a code you receive by text or email.
• Share less: the CAFC warns that details such as your birth date, employer or travel plans can be pieced together, and to question unexplained requests for a photo of your ID.
• Caller ID can be faked: if someone claims to be your bank or a government agency, hang up and call back on a number you've found yourself.

Fraud alert or security freeze?

A fraud alert — also called an identity alert — tells lenders to contact you and confirm your identity before approving credit, the Financial Consumer Agency of Canada (FCAC) explains. It suggests one if you suspect fraud, if your wallet, ID or phone was stolen, or after a home or vehicle break-in. Ask both bureaus: TransUnion says it doesn't share information with Equifax. TransUnion's alerts stay on your file for six years and are free to add online; the FCAC notes that bureaus may charge a fee.

A security freeze goes further: a bureau can't release your file for new credit, a credit increase, a long-term lease or a contract such as a cell phone payment plan, though tenancy and insurance checks can still go ahead. It's available only in Quebec and, since July 1, 2026, Ontario. In the other provinces and the territories, a fraud alert is the tool you have. TransUnion doesn't charge for a freeze and says it doesn't affect your credit score, but you must lift it before applying for credit — and you need a freeze at each bureau.

Warning signs of identity theft

• Bills that stop arriving, or bills from providers you don't use.
• Transactions you don't recognize on your bank or credit card statements.
• Letters about credit applications you never made.
• Unfamiliar accounts or inquiries on your credit report, or collection calls about accounts you didn't open.
• A CRA Notice of Reassessment for income you didn't earn, or unfamiliar employment records in My Service Canada Account — signs someone may be using your SIN, Service Canada says.
• A phone that suddenly loses service. In a SIM swap, a fraudster takes over your number and uses 'Forgot password' codes to get into your accounts, the CAFC warns.
• A notice that your information was part of a data breach.

If your identity is stolen: what to do, in order

1. Call your bank and credit card companies: ask them to flag your accounts and issue new cards with new numbers. Change your passwords, including on accounts linked to the one that was compromised.
2. Ask Equifax (1-800-465-7166) and TransUnion (1-800-663-9980) for a fraud alert, and check both credit reports.
3. Ask each creditor where an account was opened in your name to close it and decline new ones. The bureaus must correct errors on your report for free.
4. Report it to your local police and get a file number, then to the CAFC through Report Cybercrime and Fraud (reportcyberandfraud.canada.ca) or at 1-888-495-8501.
5. If your CRA account may be affected, call the CRA at 1-833-995-2336 (personal accounts) or use its online form; protections can be placed on the account during your call. The CRA says victims aren't held liable for unauthorized claims or for taxes owed because of unauthorized activity.
6. You don't need to tell the SIN Program about SIN misuse, Service Canada says — close monitoring protects you better than a new number. If your SIN was used to get government money, tell the program involved, such as Employment Insurance.
7. Replace stolen ID. For a passport, call 1-800-567-6868 as soon as possible (abroad, contact the nearest Government of Canada office); for a driver's licence or health card, contact the province or territory that issued it. If your mail was redirected, contact Canada Post.
8. Ignore 'recovery' offers: fraudsters often target victims again, the CAFC warns — never pay to get money back.

Is paid identity protection worth it?

Credit monitoring alerts you to changes such as a new credit inquiry, and the FCAC says it may help after identity theft, fraud or a data breach. You usually have to pay for it, though some institutions offer it free after a breach, and the CRA says that in many cases it gives taxpayers affected by identity theft credit protection and monitoring at no charge. Monitoring tells you something has changed; it doesn't stop the change. The steps that do the most — credit reports, fraud alerts and, in Ontario and Quebec, a security freeze — you can set up yourself.

Can security software help?

Partly. Thieves also steal personal information through phishing, spyware and viruses, the CAFC notes. The Canadian Centre for Cyber Security recommends anti-virus software to scan your devices for malware, anti-phishing software to block phishing content, regular updates and a VPN if you have to use public Wi-Fi. A security suite can close some of the routes thieves use, but it can't place a fraud alert, correct your credit file or call your bank — those steps are yours.

Most protection against identity theft is free: guard your SIN, check both credit reports, and know who to call before you need to.