I Was The Victim Of Identity Fraud

“Look at this,” I interrupt my husband in his home office and shove the wad of documents that just came in the mail at him. “I thought it was one of those pre-approved paper credit cards, but it’s not.” I bend the American Express card and point to the front, “My name is spelt wrong and,” I flip the pages over, “It’s got a $15,000 limit!”

He frowns. Takes the documents. “You’d better contact the bank,” he says in his understated English way. Unease tingles in my chest.

At a branch of the bank that issued the card, I slide it across the counter. “Please tell me this is a mistake,” I say. “I’ve never had any accounts here!”

The teller checks my identification and waves another woman over. They whisper in front of the computer. She pivots the screen towards me, “You didn’t open the chequing or the credit account?”

With an apologetic look, the teller labels the accounts as fraudulent, and says there is nothing else she can do. She sends me away with phone numbers for the bank’s fraud department, the police and two credit bureaus.

Back at home, I call the issuing bank’s fraud department and learn that my Social Insurance Number, birthdate, address and name were used to open the accounts. When I report the crime to the police, they tell me I was lucky. The fraudster was probably outside my house waiting to pluck the credit card package from my mail, but I got to it first.

However, while I was lucky in the sense that I didn't lose any money, there was other fallout: My credit rating dropped, my anxiety shot up and it was the start of several months of trying to undo the mess and protect myself from future fraud. Here's what I've learned from my experience as an identity fraud victim.

We are living in a fraudulent time

Fraud is skyrocketing in Canada, and that includes identity theft. We lost a record $554 million to fraud in 2023, according to the Canadian Anti-Fraud Centre (CAFC), which estimates that the cases reported to it represent only only five percent of all fraud cases.

People often confuse identity theft and identity fraud. Identity theft means your identifying information has been stolen or used without your permission; identity fraud means your identity has been used fraudulently to try to get money. I was a victim of both because my stolen SIN and personal details were used to open a bank account and obtain a credit card. No one can tell me how my SIN was stolen. It could have been accessed digitally after a data breach or through other venues including my own bank, a government agency or a third-party company working with them. Or I could have accidentally recycled a document with my SIN on it, but that’s probably the least likely option. Given the tsunami of data breaches and scams, we are all at risk.

“Our personal information is all over the internet and may be for sale on the dark web,” says Marilyn Abate, a forensic accountant and partner at KPMG Canada. “Even smart people fall victim to scams or get tricked into giving out information.” And many don’t talk about it. “We need to get the message out there that no one needs to be embarrassed,” Abate says. While I was more angry than embarrassed, many of the websites I consulted made me feel like I’d done something wrong or been careless with my personal information.

How to help protect yourself from identity theft

“Identity theft is one of the biggest challenges facing consumers and the economy today but there are steps people can take to protect themselves,” says Carl Davies, head of Fraud & Identity at Equifax Canada Co., part of a global company that collects and stores credit information. Experts, including Davies and Abate, recommend the following actions.

Set up transaction alerts on all of your accounts. This way, you'll receive an email, text, or app notification for bank account and credit card transactions above a certain amount of your choosing.

Reduce your daily withdrawal limits. This will help minimize potential losses.

Enable two-factor or multi-factor authentication. This means that anyone trying to access your account will need to provide identifying information aside from your password—such as a code sent to your cell phone number.

Regularly check your credit reports for free. You can do this through Canada’s two official agencies, TransUnion and Equifax, or consumer services like Borrowell or Credit Karma. Before companies grant credit, they will make “inquiries” into your credit worthiness. Track and question any inquiries you haven’t initiated.

Don’t access your financial accounts on public wi-fi.

Install anti-virus software and consider subscribing to a virtual private network (VPN). A VPN is an encrypted tunnel that protects your information. (That said, do your research before you sign up because even VPN providers can be hacked.)

Log off or sign off from each banking session. (This is different from just closing the window.)

Never share personal details. Don't reveal details like your mother’s maiden name, your birthday or even your birth month on social media or in online games or questionnaires because they could be scams that fraudsters are using to piece together your profile.

Use strong passwords. Also change them regularly.

Install a locked mailbox. That way, even if a fraudster does succeed in opening a credit card in your name, they won't be able to access it easily.

What to do if you become an identity fraud victim

Four months after my identity was stolen, I was still spending frustrating hours trying to protect myself. While my credit rating had bounced back, my credit report was still displaying incorrect information. I was constantly monitoring my credit information because I didn’t know any other way to keep tabs on whether there was suspicious activity, whether it was someone was trying to use my SIN to get another credit card, rent an apartment, apply for benefits or work illegally. I often wondered if this would ever be over.

If you do end up in this situation, here’s some advice from the experts that worked for me.

If the fraud occurred through a legitimate company, like a financial institution, notify it. Different types of fraud have different requiring documents. If it’s credit fraud, request a copy of the application that shows your SIN and name and a separate letter including your SIN and name and stating they were used to apply for credit and that you are not responsible for any purchases made fraudulently using your information.

Start your own paper trail. Note dates, official’s names, phone numbers, conversations and processing times for every interaction regarding your identity theft.

Contact your own financial institution. Explain the situation and ask them to add victim-of-fraud notices to your accounts. Also ask how they can increase security on your accounts. If you request it, they can stop all online access to your accounts, and/or require that anyone trying to access the accounts in person show multiple pieces of ID.

If you’re not happy with the information you’re given, escalate it. Ask to speak to whomever is at the next level of whatever organization you’re dealing with. Because it’s difficult to get a person on the phone, I had the most success when I approached organizations in person.

Check all of your account details, including your personal information, to ensure no one has tampered with them.

File a police report. I got the quickest result by physically going to my local police station. The police will need all pertinent details to open an investigation, and then they'll give you a fraud report number. Keep a record of this number–along with the officer’s name, badge number, phone number and email address–and get a copy of the report because you will need it to prove fraud and protect yourself in the future.

Set up fraud alerts for free with both TransUnion and Equifax. If you can afford it, subscribe to a paid monthly credit monitoring service (both TransUnion and Equifax offer these), which will alert you to any changes and allow you to check your full credit details at any time. Dispute all inaccuracies.

If your SIN is compromised, report it in person to Service Canada. If your SIN was used to apply for credit, you need the police fraud report number, the police report, your birth certificate, photo ID (a valid passport or driver's license), the credit bureau report showing the fraudulent credit, a copy of the credit application and the letter with your SIN and name from the issuing financial institution. And then you will still have to fill out more forms. If you don’t know what to bring, request an appointment through eServiceCanada and ask them what to bring when they phone back.

Notify the CAFC. This will help them more accurately track the impact of fraud nationwide.

At this  point, I'll have to monitor my credit reports, bank accounts and my SIN for years in case someone tries to use them again. And if I want to apply for credit, I’ll have to temporarily disable fraud alerts on my credit reports or do it in person and explain what happened. The good news is that you can learn from my experience.

“I don’t want to sound glum, but unfortunately I would always be vigilant,” says Abate. “It's on all of us now. My information could be out there and I don't even know it.”