Canadians’ Social insurance numbers (SINs), are becoming increasingly compromised in data breaches. For example, 1 million SINs were stolen in the CapitalOne data breach that occurred in July 2019. Social insurance numbers were also compromised in the Desjardins data breach that compromised the personal data of 2.7 million Canadians.
Criminals have been harvesting SINs for over 20 years. Estimates of the number of Americans who are compromised vary from 444 000 to 14.4 million. Experts say that the only reason that there hasn’t been an epidemic of fraud enabled by stolen SINs is that criminals “don’t have time to get to it all”.
Social insurance numbers are prized by criminals, as they can be used to file fraudulent credit or loan applications, and/or forge identities.
When are you required to provide your SIN?
Canadian law only requires citizens to provide their SIN to certain government agencies as well as employers. However, many more people and institutions demand Canadians’ SINs, including landlords, credit agencies, and universities. None of these cases require Canadians to provide their SIN.
Replacing a SIN can be difficult
In 2018, the federal government issued replacement SINs in just 60 cases of fraud and abuse and issued 1.6 million new SINs. In order to issue a new SIN, proof of fraudulent use must be shown. The government’s reasoning is that, “getting a new social insurance number will not protect individuals from fraud”. Even when a replacement is issued, the former number still exists and is linked with the individual.
While the government “strongly discourages” businesses and institutions from asking for Canadians’ SIN if they do not require it, the practice is not illegal.
How to protect yourself
In order to protect themselves, Canadians should request and review their credit report to see which accounts are opened in their name.
If an unfamiliar account appears on the report, the next step is to set-up a fraud alert with one of the major credit reporting agencies. Consumers can request an investigation into any inaccurate information on their credit file.
American consumers are able to request a freeze on their credit, which limits the number of entities able to see the consumer’s credit file. Creditors won’t extend credit to those whose credit they can’t see, so a freeze prevents accounts being opened in the consumer’s name.
However, at the time of writing, Canadian consumers are not able to freeze their credit.