Protecting your SIN: how to prevent misuse, how to check for it yourself, and who to call first if someone is using it

1. What a SIN is, and why you need to protect it

What a SIN is. SIN is short for Social Insurance Number. It is a 9-digit number. Service Canada states that you need a SIN to work in Canada or to use government programs and benefits. Your SIN is confidential, it is illegal for someone else to use your SIN, and protecting it is your responsibility.

Whether the number expires depends on your status:

Temporary residents should watch three things. Service Canada states:

• When you get a new work permit or study permit and the expiry date changes, you need to update your SIN record so that it matches your current document; you also need to update it if your status changes (for example, from temporary resident to permanent resident) or if you change your legal name;
• Once you have renewed your permit and your SIN has been extended, destroy your old SIN documents, because the old ones are no longer valid;
• If your SIN has expired but you have applied to extend your work permit or study permit and are on "maintained status", you can keep working with the expired SIN until Immigration, Refugees and Citizenship Canada (IRCC) makes a decision.

Plastic SIN cards are no longer issued. Service Canada states that it no longer issues plastic cards, but plastic cards issued in the past can still be used. If your card is lost or damaged, you can ask for a "Confirmation of SIN" letter, on paper or electronically. If your card is damaged but you remember the number, you do not need to do anything.

Neither the SIN confirmation letter nor the SIN card is an identity document. Service Canada is very clear on this: do not use your SIN as proof of identity; to prove who you are, use a document such as a passport or driver's licence.

If you forget your number, where to find it. Sign in to your Service Canada personal account, My Service Canada Account (MSCA for short; section 7 explains it in detail). On the account home page, in the "Social Insurance Number" section, you can see and print your SIN, the name on your SIN record and the expiry date (temporary residents only). You can also look through these documents: your tax returns; tax slips such as the T4 (the employment income slip your employer gives you every year); your Record of Employment (ROE); and your Registered Retirement Savings Plan (RRSP) contribution receipts.

Why you need to protect it. Service Canada lists three consequences:

• Invasion of privacy and identity theft. Someone could use your SIN to commit fraud, which could ruin your credit history;
• Harm to your money or credit. You could be unable to get government benefits or tax refunds, or lose a bank line of credit;
• Someone working under your number. You could owe the CRA tax on money you never earned.

An example. In 2025, Wang sent a photo of his SIN to someone online who called himself an "agent" and said he would help Wang find a job. In 2027, Wang gets a Notice of Reassessment from the CRA (the letter the CRA sends after it recalculates your tax for a year), saying he did not report income in 2026 from a factory he has never been to. This means someone has been working under his SIN. Section 10 explains what to do, step by step, if this happens to you.

Related: if you have just arrived in Canada and do not have a SIN yet, see Guide No. 2, First 90 days; if you have changed your name and need to update your SIN record, see Guide No. 16, Changing your name in Canada.

2. When you must give it, and when you do not have to

Service Canada's principle comes down to one sentence: give your SIN only when the law requires it.

The three situations where the law requires you to give it:

• Work. Your employer uses your SIN to report your pay; your taxes and various social benefits depend on it. Service Canada states that you only need to give it after you are hired and start earning income.
• Financial accounts. Banks and other financial institutions use your SIN to report income such as interest and dividends to the tax authority.
• Government services. The government uses your SIN to process your taxes, check whether you qualify, and pay benefits such as Employment Insurance (EI), student loans, grants and public pensions.

When you do not have to give your SIN (Service Canada's list):

• Filling out a job application;
• Applying for a credit card, mortgage or line of credit, or cashing a cheque;
• Renting a home (filling out a rental application or negotiating a lease);
• Getting a cellphone, Internet or cable TV service (the only exception is Hydro-Québec, because Quebec law requires it);
• Renting a car;
• Filling out a medical history questionnaire;
• Making a will;
• Applying to a university or college;
• Checking your own credit report.

Is it illegal for a business to ask for it? No, but officially it is strongly discouraged. Service Canada states that some businesses ask for your SIN, and this practice is "strongly discouraged, but not illegal". When the law does not require it, it is up to you whether to give it.

Before you give it, ask four questions. Service Canada suggests asking:

• Am I required by law to give it?
• Why do you need it?
• How will it be used?
• Who will be able to see it?

If the law does not require it, Service Canada says to give it only if you understand the risk of fraud and identity theft and are willing to accept that risk.

How to say no. What Service Canada advises:

1. Explain politely that the law does not require it;
2. Offer another document instead, such as a driver's licence or passport;
3. If they still will not serve you because of this, speak to the person in charge. Service Canada says many people do not actually know how a SIN should be used, and once it is explained to them, they may change their practice;
4. If that does not solve it, make a complaint (see "Where to complain" below).

You could say:

Can they refuse to serve you because you will not give it? Service Canada states that when the law does not require a SIN, you cannot be refused a product or service because you will not give it. The Office of the Privacy Commissioner of Canada says the same, and explains that this is a requirement of the federal private-sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA): an organization cannot refuse to serve you because you will not give your SIN unless it can show that the law requires you to give it, or that there is no other way to identify you.

Where to complain. Service Canada says you can complain to the Office of the Privacy Commissioner of Canada (OPC). But if you live in B.C., note one thing. The OPC itself states that B.C. has its own private-sector privacy law (the Personal Information Protection Act). Most organizations operating within B.C. fall under the Office of the Information and Privacy Commissioner for British Columbia (OIPC BC). Federally regulated industries such as banks, telecommunications companies and transportation companies, as well as personal information transferred across borders, still fall under the federal PIPEDA. So, roughly:

• If a bank or cellphone company asks for your SIN when the law does not require it (for example, when you apply for a credit card or get a cellphone), you can complain to the Office of the Privacy Commissioner of Canada (OPC). A bank asking for your SIN when you open an account that earns interest is required by law, so that does not count;
• If a landlord, a local store or a local company asks for your SIN, you generally complain to the Office of the Information and Privacy Commissioner for British Columbia (OIPC BC). We did not check exactly what that B.C. law says on this point; before you complain, you can check with OIPC BC first through its website.

How to complain. The OPC's "Protecting your SIN" page says that if an organization refuses to give you a product or service unless you give your SIN, you can complain to the OPC, and the "file a complaint with us" link on that page takes you to the complaint form. The OIPC BC home page has a "How do I make a complaint?" section; phone (250) 387-5629, Monday to Friday, 8:30 a.m. to 4:30 p.m. (the page does not say which time zone).

Service Canada also says you can go to the association, ombudsman or complaints office for the industry of the organization that asked for your SIN.

Two examples.

• You find a rental home you like in Victoria, and the landlord's application form has a "SIN" box. You can leave it blank and tell the landlord you can show your driver's licence or passport instead. Service Canada's list states that you do not need to give your SIN to rent a home (filling out an application or negotiating a lease).
• A restaurant's online job application asks for your SIN. You do not need to give your SIN on a job application, so you can leave it blank. Once they hire you and you start working and earning money, give your SIN to your employer.

Related: for what your employer has to do and what rights you have when you work in B.C., see Guide No. 13, Rights at work.

3. Keeping it safe day to day, and recognizing scams

Keeping it: let as few people as possible see it. Service Canada advises:

• Do not carry it with you. Unless you need to, do not write the number down or carry it;
• Give it only when the law requires it;
• To view or print your number, use a secure official account such as MSCA;
• Do not post your SIN publicly online, and do not share it anywhere your privacy cannot be protected.

Storing it: keep it somewhere safe.

• Lock documents that show your SIN, such as your SIN confirmation letter, SIN card and tax documents (tax slips such as the T4), in a cabinet or safe, or store them on a password-protected device;
• Do not keep your SIN confirmation letter or SIN card in your wallet or bag;
• Temporary residents should destroy their old SIN documents after renewing their permits (section 1).

Throwing it away: shred it first. Shred paper that shows your SIN and personal information before you throw it away. The Office of the Privacy Commissioner of Canada also reminds you not to put it straight into the recycling bin.

Recognizing scams: be careful with these calls, texts and emails. Service Canada's list:

• Saying there is "a problem" with your SIN or that it has "been leaked";
• Offering to get you a new SIN;
• Threatening to "block" or "cancel" your SIN;
• Asking for your personal information;
• Pressuring you to act right away;
• Being about something you did not expect and did not ask about;
• Claiming to be from a government department (be extra careful with these).

Service Canada's rule: do not give your SIN over the phone unless you made the call yourself and you know the law requires it. If you are not sure, contact the organization directly yourself.

How Service Canada itself contacts you. Service Canada states:

• When it calls, texts or emails you, it will not ask you for personal information;
• If someone says they are from Service Canada, you can call 1 800 O-Canada (1-800-622-6232) yourself to check: the agent will look up whether that person's name is on the list of Service Canada investigators and transfer you to the right department;
• Official documents from Service Canada come in a beige or white envelope with the Government of Canada wordmark (the word "Canada") on it.

An example. You get a call and the caller says: "Your SIN is involved in a money laundering case and is about to be frozen. First, please confirm your number and your bank card." This matches the scam signs Service Canada lists: saying there is a problem with your SIN, threatening to block the number, pressuring you to act right away and asking for your personal information. Hang up right away and do not give any information. If you are worried, look up the phone number on the official website yourself and call to ask.

Related: for how to recognize calls from people pretending to be the CRA, the police or immigration officials, and more scam tricks, see section 10 of Guide No. 34, Protecting your credit; for how to find the real phone numbers of government departments, see Guide No. 7, Phone directory.

4. Is someone using it? You need to check three places

We did not find any service on Service Canada's SIN pages that lets you find out, in one go, who has used your SIN. The signs of misuse that Service Canada lists come from three different places:

• You get a Notice of Reassessment from the CRA saying you did not report some income. This may mean someone else earned money under your SIN;
• There are inquiries you do not recognize on your credit report;
• In your MSCA account, you see a Record of Employment (ROE) you do not recognize.

So you need to check three places yourself:

Even if all three places look fine, that does not mean you are completely safe. If a scammer uses your SIN with another name to borrow money, that debt may not show up on your own credit report (section 14; this sentence is our own inference).

How often should you check? The Financial Consumer Agency of Canada (FCAC) only says to check your credit reports "regularly", and to check both of them; it does not say how often. Service Canada also only says to check "regularly" after your SIN has been misused. What follows is our suggestion, not an official rule: normally, check at least once a year, for example by checking all three places together each year before you file your taxes, once you have your T4s; if your information has been in a data breach or has already been misused, look at your credit reports once a month (both bureaus' free online reports are updated once a month).

5. The first place: your credit reports

Guide No. 34, Protecting your credit, covers this in detail in section 2; here we only give a few points related to your SIN:

• It is free. FCAC states that you can check your credit reports online for free with both Equifax and TransUnion, and the information is updated once a month. TransUnion's free report is called "Consumer Disclosure". Checking your own report and credit score does not affect your credit.
• You do not need to give your SIN to check your report. Service Canada's list of times you do not have to give your SIN includes checking your own credit report (section 2).
• What to look for. Service Canada asks you to look for two things: accounts you did not open, and credit inquiries you did not make. Your credit score alone will not tell you which entry is the problem, so look at the report itself.
• Check both. The two are separate companies, and each has its own report. FCAC recommends checking both, so you can spot problems early.
• Make sure it is the official website. FCAC warns that scammers pretend to offer free credit reports to get your information. We suggest going to the two companies' websites through the links on FCAC's page; that is the safest way.

Related: for unfamiliar accounts on your report, adding a fraud alert and fixing errors, see sections 3, 8 and 11 of Guide No. 34, Protecting your credit.

6. The second place: your CRA personal account, My Account

Who can use it. The CRA states that to open My Account you need two things: a SIN, and a tax return for the current or previous year that you have filed and that the CRA has already assessed. If you have just come to Canada and have not filed a tax return yet, you have to wait until your first return has been assessed before you can open it.

How to sign in. There are three ways to sign in to a CRA account: a CRA user ID and password; signing in through your online banking (a Sign-In Partner); or signing in with a provincial account, which in B.C. means the BC Services Card issued by the B.C. government.

You need "full access" to see your tax slips. The CRA states that if you chose to get a security code by mail, you only have "limited access" until you receive the code and finish registering: you cannot see your tax slips, and you cannot see or change your direct deposit, address or authorized representatives. If you use the document verification service, you get full access right away; if you sign in with a provincial account such as the BC Services Card, you also have full access.

Once you are signed in, look at these. The CRA's "Keep your CRA account secure" page asks you to watch for:

• Whether your mailing address has been changed;
• Whether your bank account or direct deposit information (the account your refunds and benefits are paid into) has been changed;
• Whether there is anyone you do not recognize among your authorized representatives (people who deal with your taxes for you);
• Whether there are benefit applications you did not agree to.

Add one more thing: every T4 slip. My Account lets you see tax slips such as the T4 (the CRA's list of services calls this "View tax information slips"). Compare the employer on each T4 with the jobs you have actually worked.

When T4s become visible. The CRA states that the issuers send most slips to you by the end of February, and the CRA can only give you a copy after the issuer has sent the slip to the CRA. So if you cannot see a slip in My Account early in the year, that does not necessarily mean there is none; look again after the end of February.

Even if My Account looks clean, that does not mean no one at all is using your SIN. The CRA's list of services says that if the SIN, first name or last name on a slip is wrong, that slip will not appear in My Account. Based on this, we infer that if the person misusing your SIN uses your SIN but their own name, that T4 may not show up in your My Account. This is our inference; the CRA does not say this directly.

To check more fully, you can call the CRA's individual tax enquiries line at 1-800-959-8281 and ask which employers have issued T4s under your SIN in the past 3 years. This approach comes from Service Canada: when you report that someone is using your SIN to work, you have to provide a list of all employers who issued T4s under your SIN in the past 3 years. Service Canada states that you can get this list from the CRA by calling this number.

You could say:

If a T4 does not match.

1. First compare it with your own pay stubs and employment contracts: maybe it is from a job you did, and you just did not recognize the name right away;
2. If you have a question about the amount on a T4, the CRA states that you should first ask the organization that issued the slip;
3. If it still does not match, someone may be using your SIN to work; follow section 10.

If you get a Notice of Reassessment saying you did not report income you do not recognize. Service Canada lists this as the first sign that your SIN is being misused. First contact the CRA as described in section 10 and explain that you did not earn this income. Also remember: if you disagree with a reassessment, there is a time limit for filing an objection with the CRA, and interest still builds up on the amount owed, so do not miss the deadline because you are waiting for an investigation. For how to work out the deadline and how to object, see Guide No. 36, Disagreeing with a CRA assessment.

Set these up ahead of time. The CRA advises:

• Sign up for email notifications and keep your email address valid. First sign up in your CRA account to receive email notifications from the CRA; when there is a change on your account, the CRA will email you. If you change your email address, remember to update it;
• Keep your contact information up to date. If the CRA notices suspicious activity on your account, it may need to contact you. Your address, phone number and email address should all be current;
• Set up a CRA PIN. It adds an extra identity check when you call the CRA. Do not use information such as your date of birth or address as your PIN;
• Use a password that is hard to guess, and change it. Do not use the same password for your CRA account and your online banking; do not tell anyone your user ID or password.
• Set up at least two ways to verify your sign-in. The CRA states that everyone signing in to a CRA account must use multi-factor authentication (MFA), entering a one-time passcode every time they sign in. There are three ways to get a passcode: an authenticator app on your phone (a free one is fine); a passcode grid the CRA generates for you (you can save it or print it); or a text message or phone call to your phone. When you register, the CRA asks you to set up two methods, but right now only one is mandatory. We suggest setting up both: the CRA states that if you change your phone number and cannot receive passcodes, you can sign in with another method you have already set up; if you lose your passcode grid, you can still sign in if you have set up your phone or the app, and if you have neither, you can only call the CRA. Service Canada's account, MSCA, is the same: Service Canada states that signing in to MSCA requires multi-factor authentication.

If you get a notice saying your information has been changed, and you did not change it. The CRA states that if you get a notice that claims to be from the CRA and shows a change you did not know about, you should contact the CRA. Do not click the link in the notice; open the CRA website yourself and sign in to check, or call the CRA to report it as described in section 10.

Related: if you want to file your own taxes for free, see Guide No. 37, Free filing with CRA SimpleFile.

7. The third place: Records of Employment in your Service Canada account (MSCA)

What a Record of Employment (ROE) is. ROE stands for Record of Employment, a record of your work that your employer issues. Service Canada states that it is the most important document when you apply for Employment Insurance (EI).

Why ROEs do not list all your jobs. An employer issues an ROE when your earnings are "interrupted". The most common case is when you have had no work and no pay for 7 days in a row (for example, because you quit, were laid off or were fired); the employer must then issue one. So a job you still have usually does not have an ROE yet. ROEs can only help you see whether an employer you do not know has issued you an ROE; they cannot show every job where someone is using your SIN.

First, open an MSCA account. MSCA is My Service Canada Account, Service Canada's personal account. Service Canada states:

• You must be at least 12 years old to open one, and only you can open and use your own account; no one can open it for you;
• If you remember your SIN, you enter it when you register, and then confirm your identity with the Interac verification service (which uses your online banking to verify your identity) or a personal access code (PAC; if you have already applied for Canada Pension Plan (CPP) or Old Age Security (OAS) benefits, your PAC has been sent to you by mail; for other cases, see the "Verify your identity with a PAC" page linked from the MSCA page);
• If you have forgotten your SIN, you can use the birth registration number on your birth certificate, or the client number IRCC gave you (UCI, also called client ID), and then confirm your identity with the Interac verification service;
• A temporary resident's SIN must be valid to use MSCA; if it has expired, you have to extend it first (section 1);
• There are three ways to sign in to MSCA: through your online banking (Interac Sign-In Partner), with a GCKey user ID and password, or with Provincial sign-in (available only in B.C. and Alberta); use the option you registered with every time you sign in.

Viewing your ROEs, step by step:

1. Go to Service Canada's MSCA page and click "Register or Sign in to MSCA" to sign in;
2. On the account home page, choose "Employment Insurance benefits";
3. Then choose "View my records of employment";
4. You can view and print electronic ROEs directly; for paper ROEs issued by your employer, you can check the information on them here;
5. An ROE stays in MSCA for 7 years from the day it is issued.

Compare the employer on each ROE with the jobs you have worked. If you see a company you do not recognize, follow section 10.

While you are there, check whether there is an EI claim you never made. Also under "Employment Insurance benefits", choose "View my latest claim" or "View my past claim" to see information about EI claims. If you have never applied for EI but there is a record here, report it right away as described in section 10.

Also look at the name on your SIN record. In the "Social Insurance Number" section of the MSCA home page, you can see the name and the expiry date on your SIN record (section 1). If the name or expiry date is wrong, you need to update your SIN record.

Related: each time you are paid, your employer should give you a pay stub; for this, and for how to raise unpaid wages, see Guide No. 13, Rights at work.

8. Other signs to watch for

Besides the three places above, Service Canada and the Canadian Anti-Fraud Centre (CAFC) also ask you to watch for:

• Mail. Envelopes that have been opened; bank statements or credit card bills that should have arrived but did not. The CAFC recommends collecting your mail promptly to reduce the chance of it being stolen; when you move, tell the post office, and also your bank and your service providers. If you suspect someone has redirected your mail somewhere else, contact Canada Post.
• Bank and credit card statements. Service Canada asks you to read your statements carefully and look for unusual transactions you did not make. If you find any, call the number on the back of your card right away (see Guide No. 31, Card fraud and scam transfers).
• Letters from the CRA or Service Canada. Benefits you did not apply for, employers you never worked for and income you never earned are all signs to look into.

9. You got a "data breach" notice, but have not found any misuse yet

Sometimes you may get a letter from a company or organization saying its systems were broken into and the leaked information included your SIN. If you have not found anyone using it yet, what should you do?

You do not need to tell the SIN Program. Service Canada states that if you only suspect someone is using your SIN, or you know your SIN was in a data breach, you do not need to notify the SIN Program.

What you need to do is keep a close watch. Service Canada states that if you have been scammed or your SIN has been leaked, you must keep a close watch on these:

1. Your credit reports. Check both, and look for accounts you did not open and inquiries you did not make (section 5);
2. Fraud alerts. Consider adding a fraud alert to both bureaus' reports. Service Canada says an alert asks lenders to contact you to confirm before they open a new account in your name; Service Canada notes that there may be a fee. Also, the Equifax wording quoted in Guide No. 34 says that in B.C., lenders are currently only encouraged to make this call; the law does not require it. From August 1, 2027, B.C.'s new law provides a mandatory "security alert": see section 5 of Guide No. 34, Protecting your credit. You have to add alerts with the two bureaus separately; for how to add them and what to provide, see section 3 of Guide No. 34, Protecting your credit;
3. Your bank and credit card statements;
4. Your mail (section 8).

Add the CRA's advice as well: change your CRA account password, and do not use the same password as for other accounts (section 6).

A data breach on its own is not enough to get a new number. Service Canada states that a new SIN may only be issued when there is clear evidence that your current SIN has been used fraudulently (section 11 explains this in detail). So if your number has only been leaked and there is no evidence that it has been misused, you cannot get a new one.

An example. You get a letter saying a company you once applied to had its systems broken into, and customers' names, dates of birth, addresses and SINs were leaked. You could do this: that same day, check both your Equifax and TransUnion reports online for free; add a fraud alert with both; change your CRA account and online banking passwords; after that, look at your credit reports once a month; and at tax time, check CRA My Account and MSCA again. If the letter asks you to click a link or call a number to "claim compensation", do not click or call yet; look up the contact information on the company's own website and check first.

Related: for what to do on the first day if your ID is lost or stolen, see section 11 of Guide No. 34, Protecting your credit.

10. Once you know someone is using it: who to call first, in what order, and what to prepare

The order Service Canada gives is: first report it to the police; then report it to the Canadian Anti-Fraud Centre; then contact the two credit bureaus, the lenders, your bank and Canada Post; and finally contact the government department that was defrauded. Here it is, step by step.

Step 1: Gather your documents first. The CAFC recommends first staying calm and keeping everything related to what happened: documents, receipts, and screenshots of emails and text messages. Keep a copy of any letters from the CRA, suspicious T4s, printouts of ROEs and your credit reports.

Step 2: Report it to the police and get a case number. If someone is in danger or it is happening right now, call 911. If it is not urgent, call your local police non-emergency line. If you live in the City of Victoria or Esquimalt, you are served by the Victoria Police Department (VicPD). VicPD's fraud page states that if you think you may have been scammed, call VicPD's non-emergency line at 250-995-7654 to report it; for the phone numbers of police services elsewhere in Greater Victoria, see the table in section 11 of Guide No. 34, Protecting your credit. VicPD also takes reports online, but an online report does not send a police officer to you.

Service Canada states that when you report it to the police, you should:

• Get a case reference number, and write down the name and phone number of the officer handling it;
• Make sure the report includes your name and SIN (your full SIN, or the last 3 digits of your SIN);
• Ask for a copy of the report.

You will need this report later if you ask Service Canada to deal with the matter, or if you apply for a new SIN (section 11).

You could say:

Step 3: Report it to the Canadian Anti-Fraud Centre (CAFC). Report online at reportcyberandfraud.canada.ca; you can report whether you are a victim or have only seen a scam, and you can report anonymously. Phone: 1-888-495-8501, Monday to Friday, 10 a.m. to 4:45 p.m. Eastern Time, closed on holidays (for B.C. time, see section 13). The CAFC states that investigating is the job of your local police; the CAFC collects information and helps the police solve cases, so even if you report to the CAFC, you should also report to the police.

Step 4: Call the right place, depending on where the problem showed up.

Why EI has to be reported separately. Service Canada states that if someone used your SIN to get money from the government, you must report it directly to that program (for example, Employment Insurance, EI) to stop these payments.

Do you need to report it to the SIN Program or not? The two official pages do not say quite the same thing, so we give you what each one says:

• Service Canada's SIN fraud page says you are not required to report it to the SIN Program;
• The CRA's reporting page says that if you suspect or know someone is using your SIN, report it to Service Canada at 1-866-274-6627; Service Canada's page on reporting fraud also lists this number as the line for reporting SIN fraud.

Our understanding is that if you do not report it, the SIN Program will not hold it against you. But there are two situations where you should contact it:

• Someone is using your SIN to work, and you want Service Canada to contact the employers you never worked for: you need to provide the documents listed in the table in section 11. To find out how to submit them, call 1-866-274-6627 first;
• You want to apply for a new number: you need to bring all the required documents and go to a Service Canada Centre in person (section 11).

If you are not sure, call 1-866-274-6627 and ask.

When you call the CRA, you could say:

Step 5: Write down every call. Write down who you called, the date, the name of the person you spoke to and any reference number they gave you, all on one sheet of paper. Service Canada reminds you that after you report it, you should keep checking your credit reports, statements and personal information regularly. The CAFC reminds you that if anything new happens, tell the CAFC, your bank and the police; if you find more suspicious entries on your credit report, update your police file.

Watch out for being scammed a second time. The CAFC states that scammers often go back to people who have already been scammed, saying they can help get the money back, but asking for a fee first. Do not pay any "recovery fee".

An example (continuing Wang's story from section 1). Wang gets a Notice of Reassessment from the CRA saying he had income from a factory in 2026. Here is what he did:

1. He signed in to CRA My Account and saw that the factory had indeed issued him a T4; he signed in to MSCA and saw that the same factory had also issued him an ROE;
2. He called VicPD to report it, got a case number, wrote down the officer's name and phone number, and made sure the report included the last 3 digits of his SIN;
3. He reported it to the CAFC at reportcyberandfraud.canada.ca;
4. He called the CRA at 1-833-995-2336 to explain that the T4 was not his and to ask the CRA to put protection on his account; he called 1-800-959-8281 to get a list of employers who had issued T4s under his SIN in the past 3 years;
5. He called Service Canada's SIN Program at 1-866-274-6627 to ask how to report that someone was using his SIN to work;
6. He checked both credit reports and added fraud alerts;
7. He wrote down all the reference numbers, names and dates on one sheet of paper.

Related: if money has already been taken, for how to get the bank to pay you back and where to complain, see Guide No. 31, Card fraud and scam transfers; for the real phone numbers of government departments, see Guide No. 7, Phone directory.

11. Should you get a new SIN?

Many people's first thought is "I'll just get a new number". Service Canada's answer is: generally, it is not recommended.

Why it is not recommended. Service Canada states:

• Having more than one SIN actually increases the risk of misuse;
• If you get a new number, your old number is not erased, and getting a new one does not stop the old number from being used;
• The steps described above, such as keeping a close watch on your credit reports and statements, do more to prevent further misuse than getting a new number.

When you can get a new one. The SIN Program may issue you a new number only if you can show evidence that your SIN has been used fraudulently. If it has only been leaked and there is no evidence of misuse, you cannot get one. Even if you apply, it may not be approved; if your documents are incomplete, your application will be refused.

How to apply. You must go to a Service Canada Centre in person and bring all the required documents. Service Canada lists different documents depending on the type of misuse:

What "primary identity documents" and "secondary identity documents" are. A primary identity document proves your status in Canada: citizens use a Canadian birth certificate or citizenship certificate; permanent residents use a Permanent Resident Card (PR card), a Confirmation of Permanent Residence (COPR) from within the past year, and so on; temporary residents use a work permit, study permit or visitor record that says they are allowed to work. A secondary identity document proves who you are; it must be valid and show your full name and date of birth, for example a passport (Canadian or foreign), a Canadian driver's licence or a provincial ID card. If a document is not in English or French, you must include a translation, and family members cannot translate it for you.

If you get a new number, you have to look after both numbers. Service Canada states:

• The new number: you have to tell your bank, lenders, employer and pension providers yourself so they can update their records; if you do not, you may not receive benefits, and the number may be misused. Service Canada only gives the new number to the federal departments that need it; it cannot change your credit records for you and cannot guarantee that the new number will not be misused;
• The old number: you are still responsible for it. If someone uses the old number for fraud and a business does not check your credit, you may have to pay the impostor's debts; if something goes wrong, you have to prove you were not involved.
• Also, EI tax slips (T4E) issued under your old number cannot be seen in MSCA; contact Service Canada and ask them to mail them to you.

12. How the CRA handles it (for information only)

This section only tells you what the CRA's website says. CanDo Studio does not prepare or file taxes for anyone and does not give tax advice; for how your own account will be handled, go by the CRA's answer.

When to contact the CRA. The CRA states:

• You suspect someone has gotten into your CRA account;
• Someone has changed the bank account, address or personal information in your account;
• There are benefit applications you did not agree to;
• You want to disable online access to your account because of suspicious activity;
• You cannot sign in to your account, and the system tells you to report it on this page.

Four ways to report:

Have this ready before you call. The CRA states that to confirm you are who you say you are, it may ask for: your SIN; your name and date of birth; your full address; and a tax return that has been assessed, a notice of assessment, a notice of reassessment or another tax document, or else for you to be signed in to your CRA account.

What the CRA may do. The CRA states that for individuals, it may:

• Temporarily disable your access to your CRA account;
• Call you or send you a letter explaining how to confirm your identity and get your account back;
• Check whether you qualify for free credit protection services;
• Hold back your benefit and credit payments until your identity is confirmed;
• Work with you to correct your personal information, and make sure applications made in your name and money taken in your name are not counted against you.

Documents the CRA may ask for: copies of government-issued ID (such as a driver's licence, passport or birth certificate); proof of address (such as an electricity, phone or Internet bill, or a tax document); and bank statements, or a letter from your bank, confirming your direct deposit information.

If your account was misused in your name, the CRA says you are not responsible. The CRA's explanation page states that victims of identity theft are not responsible for applications made in their name by someone else, are not responsible for taxes owed related to unauthorized activity on their account, and are not responsible for money that the impostor received using their identity. The page does not say how the CRA handles the income when someone works under your SIN; go by the CRA's answer. In many cases, the CRA also provides free credit protection and monitoring services. Since October 2020, the CRA has had Identity Protection Services, a single point of contact for individuals dealing with identity theft; if you need more time to gather documents, you can discuss this with the Identity Protection Services officer handling your case.

When the CRA contacts you first. The CRA states that when there is suspected identity theft, it may call you or send you a letter; if someone is suspected of having gotten into your account without permission, it may notify you by registered mail. If you get a call from someone who says they are from the CRA and you are not sure whether it is real, check first; see Guide No. 7, Phone directory.

13. Phone list (hours converted to B.C. time)

First, a word on time differences. B.C. moved its clocks forward for the last time on March 8, 2026, and did not move them back on November 1, 2026; it now uses Pacific Time all year (UTC-7, which means 7 hours behind Coordinated Universal Time) (from the B.C. government's notice published on October 30, 2026). Ontario and Quebec in the east still change their clocks: they move forward one hour on the second Sunday in March each year and back on the first Sunday in November. This comes from the National Research Council Canada's time zone page; that page now has a notice at the top saying that "some information on this page is no longer accurate as of November 1, 2026" and asking readers to refer to provincial and territorial government websites, and we did not check the clock-change dates for the two eastern provinces on their governments' websites. So:

• From the first Sunday in November each year until the second Sunday in March the next year (winter): B.C. is 2 hours behind Eastern Time;
• The rest of the year (summer): B.C. is 3 hours behind Eastern Time.

The two credit bureaus' phone numbers are the ones given on Service Canada's SIN fraud page; the hours note in the Equifax row comes from Equifax's "Contact us" page, and the OIPC BC row comes from its home page. For the phone numbers of other police services in Greater Victoria, see section 11 of Guide No. 34, Protecting your credit.

14. A scammer does not need your name: synthetic identities and children's SINs

Many people think that only someone with exactly the same name as them could misuse their SIN. That is not true.

What a "synthetic identity" is. Equifax Canada's website states that synthetic identity theft is when a scammer uses fake information, real information, or a mix of real and fake information to create a fake identity, for example by taking a real SIN and pairing it with a name that does not match the number. Equifax also states that the information of children and of people who have died is often used this way, because few people are watching it.

What scammers do with a fake identity like this. An article Equifax Canada published on February 26, 2026 (written for banks and other lenders) describes the usual steps:

1. First, use the fake identity to apply for credit cards that are easy to get, such as a secured credit card with a $500 deposit and a $500 limit;
2. Pay it off on time every month, until lenders gradually raise the limit and switch it to a card that does not need a deposit;
3. Build the credit score up to 650 or 700 or higher, and then take out personal loans and car loans;
4. Finally, max out the cards and borrow the money all at once, and then disappear. The lenders cannot find anyone to collect the debt from, because this person does not exist.

Equifax says building up a fake identity like this can take up to two years. The same article also says that, according to Equifax Canada's fraud trend data, synthetic identity fraud's share of all fraudulent applications doubled from 2022 to 2024.

Why checking your own credit report may not show it. The Equifax article states that when a lender first checks this fake identity with a credit bureau, no record is found, because the identity is newly created. From this, we infer (these are not Equifax's own words) that cards and loans a scammer gets using your SIN with another name may not be recorded on your own credit report, so you may not see them when you check your report. So if you see nothing unusual on your report, that does not mean your SIN has definitely not been used. The most effective thing is still what sections 2 and 3 say: do not give out your SIN unless you have to, and keep it safe.

Why children are more likely to be targeted. Equifax states that most children under 18 do not have a credit report, so a scammer can open credit accounts in a child's name and nobody may notice. Some children only find out when they grow up and apply for credit for the first time that accounts were opened in their name long ago, with debts that were never paid.

An example. Your child is 10, and when you move, a folder with their SIN confirmation letter in it goes missing. A scammer uses the number to open accounts; your family never gets any bills, and nobody knows. When your child grows up and applies for their first credit card, they check their credit report and only then see several unpaid debts in their name.

How to check whether your child has a credit report. Equifax states that parents can write a letter to Equifax Canada asking it to confirm whether their child has a credit report. Include with the letter:

• A copy of your child's birth certificate;
• Copies of two pieces of your own ID, such as your driver's licence, passport or other government-issued ID.

This part of Equifax's website does not say where to send the letter. The mailing address for individuals on Equifax's "Contact us" page is: Equifax Canada Co., National Consumer Relations, Box 190, Montreal, Quebec H1S 2Z2 (that page gives this address where it talks about changing the contact information on a fraud alert). Before you mail it, you can call Equifax at 1-800-465-7166 first to ask where to send it (Equifax's website does not give the hours for agents on this number). Equifax's "Contact us" page also warns: if you get an unexpected call or text claiming to be from Equifax, hang up (or delete the text), and call Equifax Canada's agents yourself at 1-800-465-7166 or 1-866-828-5961 to check.

We could not check whether the other bureau, TransUnion, offers the same option (TransUnion's website refused our access). We also could not check whether parents can request the free credit freeze that B.C. offers from August 1, 2027 on behalf of their children.

Our suggestion (not an official rule): before your child signs their first cellphone contract or gets their first credit card, write to Equifax once on their behalf to ask.

If you find accounts opened in your child's name. The steps Equifax lists:

1. Report it to your local police and get a copy of the police report;
2. Report it to the Canadian Anti-Fraud Centre (see step 3 of section 10 for how);
3. Contact the fraud department of the company that opened the account in your child's name, ask it to close the account and send you a confirmation letter. It may ask for proof of identity for both you and your child;
4. Notify the two credit bureaus.

The SIN of a family member who has died. Equifax states that some scammers also use the information of people who have died to steal money and open accounts. One thing you can do is ask the credit bureaus to add a "death notice" to the credit report of the family member who has died.

How common these scams are. Statistics on the Canadian Anti-Fraud Centre's home page: in 2026, up to September 30, it handled 22,002 fraud reports, there were 15,422 victims, and $535 million was lost; for all of 2025, the figures were 40,679 reports, 27,693 victims and $704 million. These figures cover all kinds of fraud added together, not just SIN misuse.

Related: for adding a fraud alert to your own reports and the free credit freezes in B.C. from August 2027, see Guide No. 34, Protecting your credit.

15. Checklist before you act

Day to day:

• Lock away your SIN confirmation letter, old SIN card and T4s, and do not keep them in your wallet; shred paper with your SIN on it before throwing it away.
• When you fill out a job application or rental application, or get a cellphone or credit card, leave the SIN box blank; if they ask for it, first ask whether the law requires it, and offer your driver's licence or passport instead.
• Do not give your SIN over the phone unless you made the call yourself and know the law requires it.
• Temporary residents: when you get a new work permit or study permit and the expiry date changes, update your SIN record; destroy your old SIN documents.
• Keep the email address, mailing address and phone number on your CRA account up to date; set up a CRA PIN; do not use the same password as for your online banking.
• Set up at least two ways to verify your CRA account sign-in (section 6).
• Keep your child's SIN safe in the same way, and do not give it out unless you have to. Before your child signs their first cellphone contract or gets their first credit card, you can write to Equifax first to ask whether your child has a credit report (section 14).

Before or after filing your taxes each year, check all three places together:

• Both credit reports (Equifax and TransUnion): any accounts you did not open, or inquiries you did not make.
• CRA My Account: the employer on each T4; your address, direct deposit and authorized representatives; any benefits you did not apply for.
• MSCA: first choose "Employment Insurance benefits", then "View my records of employment", and look for employers you do not know; check for any EI claims you never made.

If your information was in a data breach:

• You do not need to tell the SIN Program; check both reports; you can consider adding a fraud alert with both bureaus; change your CRA and online banking passwords; after that, we suggest looking at your reports once a month.

If you know someone is using your SIN:

• First, gather your documents;
• Then report it to the police: get a case number, write down the officer's name and phone number, make sure the report includes your SIN or its last 3 digits, and ask for a copy;
• Then report it to the CAFC;
• Then call the right places, depending on where the problem showed up: lenders and credit bureaus, your bank, the CRA at 1-833-995-2336, EI at 1-800-206-7218, the SIN Program at 1-866-274-6627;
• For every call, write down the date, the name of the person you spoke to and the reference number.
• Do not pay any "recovery fee".
• Before you try to get a new SIN, read section 11 first: it is generally not recommended, and if you get one, you still have to look after the old number.

Related guides

• → No. 34 · Protecting your credit
  Checking your two credit reports from Equifax and TransUnion for free (section 2) and adding a fraud alert (section 3); how to recognize common scams, including calls from people pretending to be the CRA, the police or immigration officials (section 10); what to do step by step if your ID is lost or you find a loan you did not apply for, and the non-emergency numbers of police services in Greater Victoria (section 11); free credit freezes in B.C. from August 2027.
• → No. 31 · Card fraud and scam transfers
  If money has already been taken from your card or account: whether you can get it back for credit cards, debit cards and transfers you were tricked into making; what to do in the first hour after you spot a suspicious transaction (section 7); reporting it to the police and also to the Canadian Anti-Fraud Centre (section 8); how to complain if the bank will not pay (section 11).
• → No. 16 · Changing your name in Canada
  How to apply for a legal name change in B.C.; how to update your records once you have the name change certificate, including updating your SIN record within 60 days of the change (section 5).
• → No. 13 · Rights at work
  The pay floor and overtime rules when you work in B.C.; your employer should give you a pay stub each payday; how to raise unpaid wages, what to prepare and the time limits (section 5).
• → No. 2 · First 90 days
  What to do, in order, in your first 90 days in Canada: in the first week, apply for your SIN, apply for MSP as early as possible and open a bank account; in the first three months, set up benefits and your CRA account.
• → No. 7 · Phone directory
  What to prepare before calling a government office (have your SIN ready for questions about taxes or EI); phone lines such as the CRA's line for individuals and EI; what to do if you cannot get through.
• → No. 37 · Free filing with CRA SimpleFile
  Filing with the CRA's free SimpleFile service: who can use it (section 2), where to find your invitation letter and access code, and how to file online, by phone or on paper; other free or reliable options if you cannot use it (section 11).
• → No. 36 · Disagreeing with a CRA assessment
  If you disagree with a notice of assessment or reassessment: first identify the letter; how to work out the objection deadline by taking the later of two dates (section 5); how to object (section 7); interest still builds up on the amount owed while you object (section 9).

Main official links in this guide

These are all the official pages used in this guide; the end of each section also lists the ones for that section. What this guide says comes from the pages of Service Canada, the Canada Revenue Agency (CRA), the Financial Consumer Agency of Canada (FCAC), the Canadian Anti-Fraud Centre (CAFC), the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner for British Columbia (OIPC BC), the Province of B.C., the National Research Council Canada, the Victoria Police Department and Equifax Canada, which were read on November 3, 2026; the pages used for sign-in verification in section 6 and for section 14 were read on November 4, and the OIPC BC phone details in section 2, the MSCA sign-in options in section 7, who to fax in section 12 and the hours in two rows of section 13 were also checked against the official websites on November 4 and added. TransUnion's website refused our access, so we could not check what its free report page says, or whether you can check if your child has a credit report with TransUnion.