What to do if your SIN or ID is stolen in Canada
What to do if your SIN or ID is stolen in Canada
Work through these in order. The first three matter most, and they are all free.
The first 24 hours
1. Report it to the police
File a report with your local police service and write down the report number.
Do this even if you merely lost the document rather than had it stolen. Banks, credit bureaus and government agencies routinely ask for a police report number, and without one you will be telling your story repeatedly with nothing to point at.
2. Place a fraud alert with both credit bureaus
Canada has two national credit bureaus, and you must contact both separately — an alert with one does not propagate to the other.
- Equifax Canada
- TransUnion Canada
Ask for:
- a fraud alert on your file — lenders are then prompted to verify identity before granting credit,
- a copy of your credit report, which you are entitled to obtain, and
- whether a credit freeze is available to you, which is stronger than an alert.
Then read the report. You are looking for accounts you did not open, inquiries from lenders you never approached, and addresses that are not yours.
3. Report to the Canadian Anti-Fraud Centre
File a report with the Canadian Anti-Fraud Centre. It will not investigate your individual case, but it is the recognized national reporting channel and the report contributes to fraud intelligence.
The first week
Notify your financial institutions
Call your bank and every card issuer. Ask them to flag the accounts for identity theft. Change your online banking passwords, and turn on two-factor authentication everywhere it is offered.
If new accounts were opened in your name at institutions you have never used, contact those institutions directly — the credit report will tell you which.
Notify the CRA
Contact the Canada Revenue Agency and tell them your SIN may be compromised. They can flag your tax account. This matters because the two most common uses of a stolen SIN are filing a fraudulent tax return to capture the refund and claiming benefits in your name — both of which surface as a bill addressed to you, months later.
Check CRA My Account for direct deposit details you did not set, addresses you do not recognize, and benefit applications you did not make.
Notify Service Canada
If your SIN specifically was stolen, contact Service Canada.
Be realistic about a new SIN. Service Canada issues one only where there is proof the existing SIN was used fraudulently — exposure alone is not enough. And a new SIN is not a clean slate:
- your old SIN record does not disappear,
- your credit and employment history is attached to the old number, and
- explaining the change to future employers and lenders becomes an ongoing chore.
For most people, the fraud alert on the credit file does more protective work than a new number would.
Replace the documents
| Document | Where |
|---|---|
| Canadian passport | Passport Canada |
| Foreign passport | Your country's embassy or consulate in Canada |
| PR card, work or study permit | IRCC |
| Driver's licence, health card, Ontario Photo Card | ServiceOntario |
| Bank and credit cards | Your financial institution |
See Keeping your immigration documents safe for the immigration-document detail.
Secure your accounts
A stolen wallet is often accompanied by a compromised email account, and email is the reset path for everything else.
- Change your email password first, then everything that uses that email for recovery.
- Turn on two-factor authentication — see Turn on two-factor authentication.
- Better, use passkeys where offered, which cannot be phished — see Sign in with a passkey.
- Sign out of sessions on devices you no longer control.
Keep a log
Recovery is measured in weeks for the immediate steps and often months for fraudulent accounts. You will speak to a lot of people, and each one will ask what you have already done.
Record, every time:
| Date | Organization | Person | Reference # | What was agreed | Follow-up |
|---|
This single habit is the difference between a manageable process and an exhausting one.
Warning signs to watch for afterwards
For at least a year:
- A CRA notice about income you did not earn or a benefit you did not claim
- Credit accounts or inquiries you do not recognize
- Collection calls for debts that are not yours
- Mail from institutions you have never dealt with — often the first sign
- Missing mail, which can mean a redirect was filed in your name
- A denied credit application for no reason you understand
Pull your credit report periodically. You are entitled to obtain it.
Reducing the damage before it happens
- Do not carry documents you do not need that day. A stolen wallet containing a driver's licence is a problem; one containing a driver's licence, SIN letter, PR card and passport is a catastrophe.
- Give your SIN only where required — see Who can legally ask for your SIN.
- Stop emailing documents — see Is it safe to email your SIN, passport or ID?.
- Shred what you no longer need — see How long to keep tax records and documents.
- Keep a record of what you shared and with whom. When something is misused, the first useful question is where it went.
How my-id.ca helps
Two things matter in the aftermath, and both are things my-id.ca is built to hold.
A complete record of your documents. Replacing what was stolen requires knowing exactly what you had — numbers, issue dates, expiry dates. A vault with your document set already scanned turns that from guesswork into a lookup.
A record of what you shared. Sharing history shows what went to which business and when, which is the starting point for working out how an exposure happened.
Day to day, my-id.ca reduces the exposure in the first place: your details fill forms directly instead of being emailed as attachments, autofill is off on every site until you enable it there, and your data is encrypted on Canadian servers and never sent to a third-party AI provider. Secure your own account with passkeys or 2FA.
Next steps
- Who can legally ask for your SIN
- What to do after a data breach
- How to spot a fake government website
- Sign in with a passkey
Important: this is general information, not legal advice
This article is general information — it is not legal, security, or financial advice, and my-id.ca does not provide legal or professional consultation. my-id.ca is not a government agency, law firm, lawyer, police service, credit bureau, or licensed advisor, and is not affiliated with or endorsed by the Government of Canada, the RCMP, the Canadian Anti-Fraud Centre, Equifax, TransUnion, the Canada Revenue Agency, Service Canada, or ServiceOntario.
Procedures, contact channels and eligibility for a new SIN change over time and depend on your specific situation. Always confirm the current steps on the official sources — canada.ca, the Canadian Anti-Fraud Centre, and the credit bureaus — and report suspected crimes to your local police. For advice about your individual circumstances, consult a qualified professional. If anything in this guide differs from an official source, the official source is correct.
Frequently asked questions
- Can I get a new SIN if mine is stolen?
- Service Canada issues a new SIN only where there is proof that the existing one was used fraudulently — not merely because it was exposed. A new SIN also does not erase the old record, and it can complicate credit and employment history. The fraud alert on your credit file usually does more good.
- How do I place a fraud alert on my credit file in Canada?
- Contact both national credit bureaus, Equifax Canada and TransUnion Canada, separately — an alert with one does not propagate to the other. Ask for a fraud alert or credit freeze, and request a copy of your credit report at the same time.
- Should I report identity theft to the police?
- Yes. The report number is requested by banks, credit bureaus and government agencies as evidence, and without it you will be repeating your story with nothing to point to.
- What is the Canadian Anti-Fraud Centre?
- A national body, run jointly by the RCMP and partners, that collects fraud reports and intelligence. Reporting there does not investigate your individual case, but it is a recognized step and contributes to national fraud data.
- How do I know if my SIN is being used?
- Watch for a CRA notice about income you did not earn, a benefit you did not apply for, credit accounts you did not open on your credit report, collection calls for unknown debts, or mail from institutions you have never dealt with.
- How long does recovery take?
- Weeks for the immediate steps and often months for full resolution, particularly where fraudulent credit accounts exist. Keeping a detailed log of every contact is what makes the long tail manageable.