How to Protect Your Identity Online — A Practical Guide for Canadians

Identity theft occurs when someone uses your personal information — your name, Social Insurance Number, date of birth, address, or financial details — to impersonate you for financial gain. In Canada, identity theft and identity fraud are criminal offences under the Criminal Code, but prosecution is difficult and recovery is slow. Prevention is significantly more effective than remediation, and it starts with understanding what information about you is already available and how it can be used.

The foundation of identity protection is understanding your digital footprint. Your digital footprint is the collection of information about you that exists online — some of it posted by you, some of it collected by services you use, and some of it compiled by data brokers who aggregate public records and online activity. This footprint includes obvious things like your social media profiles and email address, but also less obvious things like your home address in property records, your professional history on LinkedIn, your phone number in online directories, and your purchasing history inferred from loyalty programs.

Start with a self-audit. Search your own name in Google and note what appears. Search your email address, your phone number, and your home address. Look at what your social media profiles reveal to people who aren't connected to you — many people are surprised by how much is visible to the public. Check whether your email address has appeared in a known data breach using a service like Have I Been Pwned (haveibeenpwned.com). If it has, change the passwords associated with that email address immediately, starting with your email account itself, your banking, and any other high-value accounts.

Passwords are the most basic and most commonly neglected layer of identity protection. The majority of account takeovers occur because people reuse the same password across multiple services. When one service is breached, the stolen credentials are tested against other services automatically — a technique called credential stuffing. Using a unique password for every account, managed through a password manager, eliminates this vulnerability. Enabling two-factor authentication on your email, banking, and social media accounts adds a second layer that prevents account takeover even when a password is compromised.

Your Social Insurance Number is the most sensitive piece of personal information you hold. It should be shared only when legally required — with your employer for tax purposes, with the Canada Revenue Agency, and with financial institutions when opening accounts. It should not be carried in your wallet, stored in email, or provided in response to unsolicited requests. If you believe your SIN has been compromised, contact Service Canada and the major credit bureaus — Equifax Canada and TransUnion Canada — to place a fraud alert on your credit file.

Monitoring your credit is one of the most effective ways to detect identity theft early. Both Equifax Canada and TransUnion Canada allow you to access your credit report for free. Reviewing your credit report annually — or more frequently if you have reason for concern — allows you to identify accounts you didn't open, inquiries you didn't authorize, or addresses you don't recognize. Early detection dramatically reduces the damage that identity theft causes.

Finally, be thoughtful about what you share on social media. The combination of your full name, date of birth, hometown, mother's maiden name, high school, and pet's name — all commonly shared on social media — provides answers to most security questions used by financial institutions. Fraudsters compile this information to reset passwords and take over accounts. Reviewing your privacy settings, limiting what you share publicly, and being selective about what you post are practical steps that meaningfully reduce your exposure.