Protect Your Money Online

Identity theft happens when someone uses your personal information — your Social Insurance Number (SIN), name, date of birth, or financial details — to open accounts, file taxes, or borrow money in your name. It's one of the fastest-growing crimes in Canada.

The damage goes beyond money. Identity theft can take months to resolve. Fraudulent debts can destroy your credit score, prevent you from getting approved for a mortgage or car loan, and even affect employment — some employers run credit checks. The sooner you detect it, the easier it is to contain.

• Someone files a tax return in your name and collects your refund.
• Fraudulent credit cards or loans are opened using your SIN and personal details.
• Your bank account is accessed and drained through stolen credentials.
• Medical services are billed under your identity (less common in Canada but it happens).
• Your social media accounts are compromised and used to scam your contacts.

Scammers target Canadians with increasingly sophisticated methods. Here are the most common ones — knowing what they look like is your best defence.

Most scams share common characteristics. If you can recognize these red flags, you'll avoid the vast majority of fraud attempts.

5 Universal Red Flags

1. 1Urgency or threats: "Act now or face arrest." "Your account will be closed in 24 hours." "This offer expires today." Legitimate organizations don't pressure you with artificial deadlines.
2. 2Unusual payment methods: Gift cards, cryptocurrency, wire transfers, or e-Transfer to a personal account. No government agency or legitimate company accepts payment by gift card.
3. 3Unsolicited contact: You didn't initiate the call, email, or message. The CRA, your bank, and legitimate employers don't cold-call or text out of the blue asking for personal information.
4. 4Too good to be true: Guaranteed investment returns, a job that pays $5,000/week for minimal work, or a prize for a contest you never entered.
5. 5Requests for sensitive information: Your SIN, passwords, banking login credentials, or PINs. No legitimate organization asks for these by phone, text, or email.

Your CRA My Account contains your tax returns, SIN, income history, and benefit payments. If someone gains access, they can change your direct deposit information, file a fraudulent tax return, or steal your refund. This is one of the highest-value targets for identity thieves in Canada.

Your banking credentials are a prime target for scammers. Canadian banks have strong security systems, but they rely on you to follow basic security practices. Most bank fraud succeeds because the customer was tricked into giving up their own credentials.

If your debit or credit card is compromised, call your bank immediately. Under the Canadian Code of Practice for Consumer Debit Card Services, you are generally not liable for unauthorized transactions if you report them promptly and haven't been negligent with your credentials.

If you discover unauthorized activity — accounts you didn't open, charges you didn't make, or a tax return you didn't file — act immediately. The faster you respond, the less damage is done.

Step-by-Step Response Plan

1. 1Contact your bank immediately. Report the fraud, freeze compromised accounts, and request new cards. Most banks have a 24/7 fraud hotline.
2. 2Place a fraud alert with both credit bureaus: Equifax Canada (1-800-465-7166) and TransUnion Canada (1-800-663-9980). This flags your file so lenders take extra verification steps before issuing credit in your name.
3. 3Report to the Canadian Anti-Fraud Centre (CAFC): call 1-888-495-8501 or report online at antifraudcentre-centreantifraude.ca. They track fraud across Canada and coordinate with law enforcement.
4. 4File a police report with your local police service. You may need the report number for disputes with creditors.
5. 5Report to the CRA if tax fraud is involved: call 1-800-959-8281 to report identity theft related to your tax account.
6. 6Check your credit reports from both Equifax and TransUnion for any accounts or inquiries you don't recognize. Dispute any fraudulent items in writing.
7. 7Document everything: keep records of every call, email, and letter related to the fraud. Note dates, names of representatives, and reference numbers.

Fraud alerts and credit freezes are two tools available to protect your credit file after identity theft — or even proactively if you want extra security.

If you place a credit freeze, remember that you'll need to temporarily lift it whenever you legitimately apply for credit — a new credit card, mortgage, car loan, or even a new phone plan. Keep the PIN or password you're given when you set up the freeze in a secure location.

Most people know they should use strong, unique passwords. Most people also don't actually do it. If you use the same password for your email and your bank account, a single data breach — at any company — gives attackers access to your financial life.

The Solution: Password Managers

A password manager generates, stores, and auto-fills unique, strong passwords for every account. You only need to remember one master password. This is the single most impactful thing you can do for your online security.

• 1Password: Canadian-founded (Toronto). Individual plan ~$4 CAD/month. Family plan ~$7 CAD/month for up to 5 people.
• Bitwarden: Open-source, free for basic features. Premium plan ~$13 CAD/year. Great budget option.
• Apple Passwords (built into iCloud Keychain): Free if you're in the Apple ecosystem. Works across iPhone, iPad, and Mac.
• Google Password Manager: Free, built into Chrome and Android. Convenient but less feature-rich.

Additional Security Measures