If your identity has been stolen in Canada, act the same day: file a police report, submit a report to the Canadian Anti-Fraud Centre, call your bank, and place fraud alerts with both Equifax Canada and TransUnion Canada. The Criminal Code treats identity theft and identity fraud as separate offences, carrying up to five years in prison for obtaining your personal information and up to ten years for actually using it.
Who to Call First
The order of your calls matters because each agency asks for a reference number from the one before.
Local Police
Contact your local police service first. The report creates the official record of the crime and gives you a case reference number that nearly every other agency and creditor will ask for before processing your claim.1Canadian Anti-Fraud Centre. Identity Fraud Bring government-issued ID and whatever you have that documents the fraud: suspicious statements, screenshots, collection letters, and a timeline of when you noticed the problem.
The Canadian Anti-Fraud Centre
After filing with police, report to the Canadian Anti-Fraud Centre through its online portal or at 1-888-495-8501.2Canadian Anti-Fraud Centre. Report Fraud and Cybercrime The CAFC feeds a national intelligence database used by law enforcement across the country and will issue its own reference number. Your local police still handle the criminal investigation; the two reports serve different purposes, and you need both.
Your Bank and Card Issuers
Call every bank, credit card issuer, and lender where you hold accounts or where someone has opened accounts in your name. Ask them to freeze compromised accounts, reverse unauthorized transactions, and flag your file for fraud. Keep a log of every call with the date, the representative’s name, and what you were told. This log matters if there is later a dispute about when you reported the problem.
Securing Your Credit File
Equifax Canada and TransUnion Canada maintain separate credit files, and placing an alert with one does not notify the other. Contact both.
Fraud Alerts
A fraud alert, sometimes called a fraud statement, is a note on your file telling lenders to verify your identity before approving new credit in your name. At TransUnion Canada, a fraud statement remains on your file for six years from the date it was added unless you request removal in writing sooner.3TransUnion Canada. Fraud Victims Resources Equifax Canada offers a comparable alert. Alerts are advisory: lenders see the warning but decide for themselves what verification to do.
Credit Freezes
A credit freeze blocks lenders from accessing your file for purposes like approving new credit, entering lease agreements, or setting up payment plans. Availability in Canada is limited. TransUnion Canada currently offers credit freezes only to Quebec residents, while Equifax Canada offers a credit lock service.3TransUnion Canada. Fraud Victims Resources Outside Quebec, a fraud alert combined with regular monitoring is your main option through TransUnion.
Once your alerts are in place, request an updated copy of your credit report from each bureau and go through it line by line. Dispute every account, inquiry, or address you don’t recognize directly with the bureau that lists it.
If Your Social Insurance Number Was Used
A stolen SIN is the most damaging form of identity theft in Canada because it reaches employment records, tax accounts, and government benefits. Report suspected misuse to Service Canada at 1-866-274-6627.4Canada Revenue Agency. Report a Scam or Identity Theft
Getting a new SIN is possible but intentionally difficult. Service Canada will not issue a replacement without documented proof that your existing SIN was used for fraud. You must visit a Service Canada Centre in person with valid identity documents, a police report, and a letter from the creditor confirming the fraudulent use of your SIN.5Government of Canada. Social Insurance Number – Fraud and Data Breaches If the creditor’s letter doesn’t contain your SIN, you also need a copy of the fraudulent credit application showing your name and SIN.
Employment fraud has a different list. You need identity documents, a police report, a printout from the CRA of all employers who issued T4 slips under your SIN in the past three years, a photograph of yourself for employer verification, and a list of every address you have had in the past ten years.5Government of Canada. Social Insurance Number – Fraud and Data Breaches
Service Canada is candid that a replacement SIN is not always the right choice. The old number doesn’t disappear, and managing two of them can increase your fraud exposure. In many cases, securing your existing SIN with credit bureau alerts and monitoring is the better path.
If Your CRA Account Was Compromised
Tax accounts are prime targets because they hold your SIN, banking details, and benefit information. Report the suspected compromise through the CRA’s online form or by calling the personal accounts line at 1-833-995-2336.4Canada Revenue Agency. Report a Scam or Identity Theft Phoning is faster: the CRA can place protections on your account during the call, while online reports take up to 14 business days for a designated officer to follow up.
Once a compromise is confirmed, the CRA may temporarily disable your online access, halt benefit and credit payments until your identity is validated, and assess whether you qualify for free credit protection services.6Canada Revenue Agency. How the CRA Secures Compromised Accounts The agency will work with you to restore your information and will not hold you liable for fraudulent claims or payments made through your account. To validate your identity, expect to provide government-issued photo ID, proof of address such as a utility bill, and bank statements confirming your direct deposit details.
The CRA sends mandatory email notifications when key account details change, including your address, direct deposit information, marital status, authorized representative, and multi-factor authentication settings.7Canada Revenue Agency. Email Notifications From the CRA – Individuals If one of those notifications arrives and you didn’t make the change, treat it as a confirmed breach. Legitimate CRA emails will never ask for personal information, demand payment by gift card, or threaten arrest.
If Your Passport Was Lost or Stolen
Report a lost or stolen Canadian passport by calling 1-800-567-6868 within Canada, or by contacting the nearest Government of Canada office if you are abroad.8Government of Canada. Lost, Stolen, Inaccessible, Damaged or Found Canadian Passports and Other Travel Documents Replacing a valid passport that was lost or stolen means submitting the PPTC 203 declaration form with your new application and paying an extra $45 surcharge on top of regular fees. The government may investigate before issuing a replacement, which can slow processing.
What You Owe for Unauthorized Transactions
Canadian rules cap your liability for unauthorized use, but credit and debit cards work differently.
Credit Cards
Under the Financial Consumer Protection Framework Regulations, your maximum liability for unauthorized credit card use is $50, unless you were grossly negligent in safeguarding your card or account information.9Justice Laws Website. Financial Consumer Protection Framework Regulations After you report the card as lost, stolen, or at risk, you have zero liability for any unauthorized transactions that happen once the institution receives your report. Many issuers voluntarily waive the $50 through their own zero-liability policies, but the regulation guarantees the cap as a baseline.
Debit Cards
Debit cards fall under the Canadian Code of Practice for Consumer Debit Card Services rather than a regulation with hard dollar caps. When a cardholder contributes to unauthorized use, liability is limited to the daily transaction and withdrawal limits set by the financial institution.10Financial Consumer Agency of Canada. Canadian Code of Practice for Consumer Debit Card Services You are not liable for losses caused by system malfunctions or for unauthorized transactions after you report the card as lost or stolen. If your account has overdraft protection or a linked line of credit, your potential exposure can exceed the balance in the account, which is one reason debit fraud tends to hurt faster than credit card fraud.
For either card type, timing drives the outcome. Liability protections hinge on when you tell your financial institution, so check accounts often and report suspicious transactions the moment you see them.
Penalties the Offender Faces
The Criminal Code splits identity crime into two offences. Section 402.2 covers identity theft: obtaining or possessing another person’s identity information with the intent to commit a crime involving fraud or deceit.11Justice Laws Website. Criminal Code – Section 402.2 Someone who collects SINs, banking credentials, or driver’s licence details for criminal use has committed the offence before spending any of your money.
Section 403 covers identity fraud, which is actively impersonating another person to gain an advantage, obtain property, cause the victim harm, or avoid arrest.12Justice Laws Website. Criminal Code – Section 403 Using a stolen credit card number to make a purchase crosses from theft into fraud. Prosecutors can charge both when the facts support it.
As an indictable offence, Section 402.2 identity theft carries up to five years in prison.11Justice Laws Website. Criminal Code – Section 402.2 Section 403 identity fraud carries up to ten years.12Justice Laws Website. Criminal Code – Section 403 Either can also be prosecuted by summary conviction for smaller-scale cases or first-time offenders. Under Section 787 of the Criminal Code, the default summary conviction penalty is a fine of up to $5,000, up to two years less a day in jail, or both.13Justice Laws Website. Criminal Code – Section 787 Either route produces a criminal record.
Restitution for Your Recovery Costs
Section 738 of the Criminal Code lets a judge order an offender convicted under Section 402.2 or 403 to pay restitution directly to the victim. The restitution covers the cost of re-establishing your identity, including replacing identity documents and correcting your credit history and credit rating.14Justice Laws Website. Criminal Code – Section 738 The amount has to be reasonable and easy to calculate, so keep every receipt from your recovery. Document fees, courier charges, notarization costs, time off work for Service Canada appointments: anything spent cleaning up the fraud is potentially recoverable at sentencing.
Warning Signs Worth Watching
Early detection limits damage. The common signals are financial: charges you don’t recognize on bank or credit card statements, calls from debt collectors about accounts you never opened, or an unexplained drop in your credit score. Regular reviews of your Equifax Canada and TransUnion Canada reports are the most reliable way to spot inquiries or accounts you didn’t authorize.
Mail is another channel. Expected bills or statements that stop arriving can mean someone filed a change-of-address request to redirect them. Cards or confirmations you never applied for mean someone is using your name. For suspected mail theft or fraudulent redirection, contact Canada Post’s customer service and file a police report.
Government accounts need attention too. A CRA email notifying you of a change you didn’t make is a confirmed breach signal, not a routine message. Treat it that way, and start the call list at the top of this article.