When a request feels wrong
When a request feels wrong
A request arrives asking for more than you expected, or for something that seems unrelated to what you are actually doing. That reaction is worth taking seriously — and acting on it costs you nothing, because declining sends nothing.
First: is it really them?
Every request shows the business name, email, and phone. Check those against what you already have for that business — a signed engagement letter, their website, an earlier email thread.
If anything differs, contact them through a channel you already trust. Not a phone number in the request, and not a reply to the message that made you suspicious. Look them up independently.
This is not paranoia. Impersonating a professional mid-transaction, when a client is expecting document requests, is a well-worn tactic.
Second: can you name the reason for each item?
Go item by item and ask: why does this person need this, for this task?
Reasonable, in the right context:
- Identity documents for anything with an identity-verification obligation — real estate, financial services, immigration
- Proof of address for tenancy, banking, or benefits
- Income documents for a mortgage or a rental application
- Existing paperwork they are helping you with
Worth a question:
- A document unrelated to the task. Why does a rental application need your marriage certificate?
- More than was needed. Full bank statements when a balance letter would do.
- Everything at once, urgently. Urgency is the oldest pressure tactic there is.
- Identifiers with no stated purpose. A SIN in particular has narrow legitimate uses — see Is it safe to store my SIN?.
Things my-id.ca will never ask for
No legitimate request through my-id.ca will ever ask you to:
- Provide your my-id.ca password — nobody needs it, ever
- Provide a two-factor code — those are for you to type at sign-in, nowhere else
- Enter credit card or banking credentials to fulfil a document request
- Install something to view a request
Any of these means something has gone wrong. Stop and verify independently.
What you can do
Ask. Use the conversation attached to the relationship: "What's the health card for on a rental application?" You will usually get a straightforward answer, and sometimes they will withdraw the item. See Chatting with a business.
Send part of it. Fulfil what is clearly justified, hold the rest, and say what you are holding and why. This is a completely normal outcome.
Redact. If a document proves one thing but reveals ten, ask whether a narrower document would do — a balance letter instead of statements, a utility bill instead of a bank record.
Decline. Declining sends nothing. You can always send later once you have an answer.
Wait. There is no timer. A request left unanswered while you check something is a request left unanswered.
Afterwards
If you did send something you now regret, What happens after you share covers what is and is not possible.
If you believe a business has misused your data, you can raise it with them directly, and Canadians can escalate to the Office of the Privacy Commissioner. Your own data rights apply to what my-id.ca holds; what a business does with a copy they received is governed by their own obligations.
Related
Frequently asked questions
- Will declining hurt my application?
- Asking why something is needed will not. A professional who cannot explain why they need a document is the actual problem, not your question.
- Can I send some of what was asked and not the rest?
- Yes. Send what you are comfortable with, and say what you are holding back and why. Partial is a normal outcome.
- How do I know a request is really from them?
- Check the business name and contact details on the request against what you already have for them. If anything differs, contact them through a channel you already trust — not one supplied by the request.