Skip to main content
All of CanadaUpdated September 2026

Identity Theft and Fraud in Canada

How to respond if your personal information has been stolen, and your rights under Canadian privacy, consumer reporting, and criminal law.

TL;DR

Identity theft cases usually involve four bodies: the credit bureaus (Equifax and TransUnion, for fraud alerts), the Canadian Anti-Fraud Centre, the local police, and the institutions where accounts were affected. Where an organization's handling of personal information contributed, a complaint to the OPC or a provincial commissioner is also possible.

Immediate steps

The steps commonly involved when identity theft is suspected:

  • Fraud alerts on the credit files at Equifax and TransUnion (free for reported victims; they last six years).
  • Freezing or cancelling compromised accounts through the bank and credit card companies.
  • A report to the Canadian Anti-Fraud Centre (CAFC) at 1-888-495-8501 or reportcyberandfraud.canada.ca.
  • A police report with the local police service, which produces a file number that banks and bureaus ask for.
  • A record of all correspondence and reference numbers.

Your rights against the source of the breach

If a specific organization's breach exposed your data, they must notify you under PIPEDA or applicable provincial law.

You may be able to file a privacy complaint, and in some cases join a class action.

You can sue for intrusion upon seclusion in provinces that recognize the tort (Ontario and several others).

Criminal Code provisions

Sections 402.2 and 403 of the Criminal Code criminalize identity theft (obtaining and possessing identity information to commit an offence) and identity fraud (fraudulently using identity information).

Related topics

Ask AI