Identity Theft in Canada 2026
Identity theft and identity fraud have become defining features of Canada’s crime landscape in 2026, growing faster than almost any other category of criminal activity and generating losses that dwarf the officially reported figures by a factor of ten or more. The distinction between the two offences matters in Canadian law: identity theft, under Section 402.2 of the Criminal Code, is the collection or possession of another person’s identity information with the intent to commit a crime — the upstream act of stealing. Identity fraud, under Section 403, is the actual use of that stolen identity to impersonate, deceive, or defraud — the downstream exploitation. Both are tracked separately by Statistics Canada’s Uniform Crime Reporting (UCR) Survey and by the Canadian Anti-Fraud Centre (CAFC), and both have grown substantially over the past decade. The most current UCR data — released by Statistics Canada on 22 July 2025 — confirms that the police-reported identity fraud rate reached 50 incidents per 100,000 population in 2024, a 2% increase year-over-year, while identity theft held stable at 14 incidents per 100,000. The combined fraud rate of 500 incidents per 100,000 is 92% higher than a decade earlier in 2014, when the rate stood at 261 per 100,000.
The scale of Canada’s identity theft and fraud problem in 2026 is simultaneously captured and obscured by the available statistics. The CAFC’s 2024 Annual Statistical Report, covering reports received to 31 December 2024, recorded 9,683 reports of identity fraud — the single highest-volume fraud category in Canada for the second consecutive year — out of 108,878 total fraud reports, with total confirmed losses across all fraud types reaching $638 million. But the CAFC’s own spokesperson, Jeff Horncastle, has stated repeatedly that only 5% to 10% of fraud incidents are ever reported to the Centre, due to embarrassment, stigma, and lack of awareness. This means the true annual number of Canadians experiencing identity-related fraud could be between 100,000 and 200,000 or more, and the true national financial loss could plausibly exceed $6 billion annually. The 2019 General Social Survey — the most recent population-level victimization study — estimated that 2.5 million Canadians experienced fraud in a single year, a figure that dwarfs every police-reported or CAFC-reported number and frames the reporting gap in stark terms.
Key Facts: Canada Identity Theft Statistics 2026
| Fact | Data |
|---|---|
| Police-reported identity fraud rate (2024, Statistics Canada UCR) | 50 incidents per 100,000 population |
| Police-reported identity theft rate (2024, Statistics Canada UCR) | 14 incidents per 100,000 population |
| Combined police-reported fraud rate (2024, all types) | 500 incidents per 100,000 population |
| Combined fraud rate increase over 10 years (2014–2024) | +92% |
| Identity fraud reports to CAFC (2024) — highest-volume category | 9,683 reports |
| Identity fraud — 100% victimization rate (60+ age group) | 1,684 reports; all confirmed victims |
| Total CAFC fraud reports (2024) | 108,878 |
| Total confirmed fraud victims (2024, CAFC) | 34,621 |
| Total reported fraud losses (2024, CAFC) | $638 million |
| Fraud losses 4-year increase (2020–2024) | $165M → $638M (+287%) |
| Cumulative CAFC losses since 2021 | Over $2 billion |
| Estimated true reporting rate (CAFC / McMaster University / Statistics Canada) | 5–10% of incidents |
| Estimated true annual fraud losses (if 5–10% reported) | $6–12+ billion |
| 2019 GSS estimate: Canadians experiencing fraud in one year | ~2.5 million |
| Synthetic identity fraud share of Canadian business fraud losses (2025) | 26% (up from 18% in 2024) |
| Canadian business fraud losses (2025, TransUnion survey of 200 biz leaders) | CAD$111 billion (+42% from $78B in 2024) |
| Canadian business fraud losses as share of revenues (2025) | 7.2% |
| Average loss per victim aged 60+ (identity fraud, CAFC 2024) | $21,604 |
| Average Canadian data breach cost (2024) | USD$4.66 million |
| Nova Scotia Power ransomware breach (March 2025) | ~280,000 customers; ~140,000 SINs exposed |
| Cybercrime rate (2024, UCR) | 225.1 per 100,000 (doubled since 2018) |
| Fraud as share of all police-reported cybercrime (2024) | ~47% (largest single cyber-violation category) |
| Police-reported fraud incidents (all types, excluding Montreal, 2024) | ~201,000+ (extrapolated from 2023 baseline) |
| Largest data breach in Canadian history | Desjardins, 2019 — 9.7 million individuals |
| Alberta: highest self-reported fraud victimization rate | 22% of the province’s population |
| Identity fraud criminal penalty (Criminal Code s. 403) | Up to 10 years imprisonment |
| Identity theft criminal penalty (Criminal Code s. 402.2) | Up to 5 years imprisonment |
| Canadians expressing concern about data security | 85% |
| Online community fraud attempts (Canada, H1 2025 vs H1 2024) | +68% year-over-year |
| Digital fraud attempt rate across all Canadian industries (H1 2025) | 4.2% of attempted transactions |
Sources: Statistics Canada, The Daily — Police-Reported Crime Statistics in Canada, 2024 (22 July 2025); Canadian Anti-Fraud Centre (CAFC) 2024 Annual Statistical Report (Open Government Portal, 2025); Canada.ca — Fraud Prevention Month 2025 (February 2025); RCMP Gazette — “The cost of fraud exceeds financial loss, victims say” (March 2025); TransUnion Canada — H2 2025 Update to Top Fraud Trends Report (October 2025); Corbado — 11 Biggest Data Breaches in Canada 2026 (May 2026); Government of Canada — canada.ca, Social Insurance Number fraud and data breaches (updated May 2026); Office of the Privacy Commissioner of Canada — Identity Theft guidance; Canadian Centre for Cyber Security — Protecting yourself from identity theft online (ITSAP.00.033)
The key facts surrounding Canadian identity theft statistics in 2026 are defined by two converging crises: a sustained rise in the number of incidents, and an accelerating rise in average loss per victim. The CAFC data from 2024 documents that while total report volumes actually declined slightly from 2021 peaks (a function of processing capacity and the post-pandemic normalisation of fraud reporting patterns), the dollar losses per incident have grown sharply — from $165 million in 2020 to $638 million in 2024, a near-four-fold increase in just four years. The identity fraud category is particularly striking: it recorded the highest victimization rate of any fraud type in the 60+ age group — with every single one of the 1,684 elderly victims who reported identity fraud confirmed as genuine victims (a 100% victimization rate), averaging $21,604 in losses per person. This combination of high volume, high victimization rate, and high per-victim loss makes identity fraud the single most damaging fraud category for older Canadians.
The business fraud dimension has emerged as equally alarming. TransUnion Canada’s H2 2025 Top Fraud Trends report, based on a survey of 200 Canadian business leaders, found that fraud losses across their organisations reached CAD$111 billion in 2025 — equivalent to 7.2% of revenues — up 42% from CAD$78 billion in 2024. The most dramatic single trend within business fraud is the rise of synthetic identity fraud, which has surged from 18% to 26% of total business fraud losses in a single year — making Canada the country with the highest synthetic identity fraud share among all markets surveyed globally by TransUnion. Synthetic identity fraud — which combines a real stolen piece of information (typically a Social Insurance Number) with fabricated details to construct a new fictitious identity — is structurally more damaging than traditional identity theft because it is far harder to detect, leaves victims unaware for years, and causes lasting credit damage that takes an average of several years to resolve.
Police-Reported Identity Theft and Identity Fraud Rates — Canada 2014–2024
Police-Reported Fraud Rate per 100,000 Population (Statistics Canada UCR)
2014 Combined |████████████████████████████ | 261 per 100,000
2016 Combined |███████████████████████████████ | ~285 per 100,000
2018 Combined |█████████████████████████████████████ | ~350 per 100,000
2020 Combined |███████████████████████████████████████| ~380 per 100,000
2022 Combined |█████████████████████████████████████████| ~460 per 100,000
2023 Combined |█████████████████████████████████████████| ~498 per 100,000
2024 Combined |█████████████████████████████████████████| 500 per 100,000 (+92% vs 2014)
2024 ID Fraud |███████ | 50 per 100,000
2024 ID Theft |██ | 14 per 100,000
|------+------+------+------+------+----|
0 100 200 300 400 500
| Year | Identity Fraud Rate (per 100,000) | Identity Theft Rate (per 100,000) | Combined All-Fraud Rate |
|---|---|---|---|
| 2014 | — | — | 261 |
| 2018 | — | — | ~350 |
| 2020 | — | — | ~380 |
| 2022 | — | — | ~460 |
| 2023 | ~49 | ~18 (peak before 2024 dip) | ~498 |
| 2024 | 50 (+2% YoY) | 14 (stable) | 500 (+92% vs 2014) |
| 10-year rate increase (2014–2024) | — | — | +92% |
Sources: Statistics Canada, The Daily — Police-Reported Crime Statistics in Canada, 2024 (22 July 2025); Statistics Canada, Police-Reported Crime Statistics in Canada, 2023 (25 July 2024); Statistics Canada — Fraud and extortion police-reported rates, Canada, 2010 to 2024 (chart data, 22 July 2025); Statista — Rate of identity thefts in Canada, 2012–2023 (CAFC/StatCan source, updated February 2026)
The police-reported fraud data from Statistics Canada is the most authoritative measure of identity theft and identity fraud trends in Canada, but it captures only a fraction of the true problem. The 2024 UCR data — released by Statistics Canada on 22 July 2025 and covering all police-reported incidents nationally (excluding the Montreal Police Service due to a data transmission issue that is expected to be corrected in the 2026 revision) — confirms that the combined fraud rate has nearly doubled in a decade, from 261 to 500 incidents per 100,000. The identity fraud rate of 50 per 100,000 and identity theft rate of 14 per 100,000 are, respectively, the downstream offence (using a stolen identity) and the upstream offence (acquiring the identity information), and they move differently over time. Identity theft showed a −24% decline in 2023 compared to the previous year according to Statista’s StatCan-sourced data — likely reflecting the increasing sophistication of identity acquisition, which now occurs largely through data breaches and phishing rather than the more readily detected physical methods like mail theft and dumpster diving.
The data quality note that accompanies the 2024 Statistics Canada release is significant for users of this data: the exclusion of Montreal Police Service fraud data due to a transmission issue means the national identity fraud and identity theft rates presented in the 2024 release are understated, and Statistics Canada has confirmed corrections will be applied when 2024 data is revised in 2026. This means the true 2024 identity fraud rate was higher than the reported 50 per 100,000, though by an unspecified margin. The broader 10-year context is unambiguous regardless: the 92% increase in the combined fraud rate from 2014 to 2024 represents one of the most sustained periods of crime-category growth in the UCR series, exceeding the growth rates of virtually every other Criminal Code offence category over the same period — a trajectory that researchers at Statistics Canada’s Canadian Centre for Justice and Community Safety Statistics have attributed to the digitalisation of financial services, the expansion of social media attack surfaces, and the growing sophistication of organised fraud operations targeting Canadian consumers.
CAFC Identity Fraud Reports and Losses 2020–2024
CAFC Total Fraud Losses (CAD millions, all fraud types)
2020 |████████████ | $165M
2021 |█████████████████████████ | $379M
2022 |█████████████████████████████████ | $530M
2023 |████████████████████████████████████ | $578M
2024 |████████████████████████████████████████████| $638M (+287% vs 2020)
|------+------+------+------+------+------+--|
$0 $100M $200M $300M $400M $500M $638M
| Year | Total CAFC Fraud Reports | Total Losses | Identity Fraud Reports (where available) |
|---|---|---|---|
| 2020 | — | $165 million | — |
| 2021 | — | $379 million | — |
| 2022 | — | $530 million | — |
| 2023 | — | $578 million | — |
| 2024 | 108,878 | $638 million | 9,683 (highest-volume fraud type) |
| 2024 confirmed victims | 34,621 | — | — |
| Cumulative losses 2021–2024 | — | Over $2 billion | — |
| Identity fraud victimization rate (60+ CAFC, 2024) | 100% | $21,604 avg per victim | 1,684 seniors (60+) |
Sources: Canadian Anti-Fraud Centre (CAFC) 2024 Annual Statistical Report; Canada.ca — Fraud Prevention Month 2025 (March 3, 2025); RCMP Gazette — “The cost of fraud exceeds financial loss, victims say” (March 14, 2025); Discreet Investigations Canada — Fraud Statistics Canada 2025 (compiled from CAFC 2024 Annual Report, May 4, 2026)
The CAFC’s 2024 Annual Statistical Report provides the most granular picture of identity fraud’s human cost in Canada. The centre recorded 9,683 reports of identity fraud — making it the single highest-volume category of fraud for the year, ahead of service fraud and investment fraud by number of reports (though investment fraud vastly exceeded it in dollar losses at $313 million). The total fraud loss figure of $638 million represents a +10.4% increase from the $578 million in 2023, and a staggering +287% increase from $165 million in 2020 — meaning reported fraud losses have nearly quadrupled in four years. The CAFC’s own statement that cumulative losses since 2021 have now surpassed $2 billion underscores the pace and scale of the problem.
The identity fraud victimization rate — the proportion of CAFC reporters who are confirmed as genuine victims rather than reporters of attempted but unsuccessful fraud — varies significantly by age group, and the pattern is deeply concerning. The CAFC’s 2024 age-stratified analysis found that among Canadians aged 60 and over who reported identity fraud, the victimization rate was 100% — every single senior who reported identity fraud to the CAFC was confirmed as a genuine victim. This contrasts with lower victimization rates in younger age groups, where a higher proportion of reporters had identified and avoided the fraud before it was completed. The average loss of $21,604 per elderly identity fraud victim also significantly exceeds the average across all age groups, reflecting both the larger financial accounts held by older Canadians and the greater difficulty of recovering losses once an identity has been fully compromised. CAFC spokesperson Jeff Horncastle has noted directly that “identity fraud can have a huge impact on victims because it affects everything in their life, whether it be their mortgage or trying to get a new car.”
Methods of Identity Theft in Canada 2025–2026
Primary Identity Theft Methods — Relative Prevalence in Canada (2025–2026)
Phishing / smishing / vishing |████████████████████████████████████████| Most prevalent digital vector
Data breaches |████████████████████████████████████████| Mass-exposure events
Account takeover |████████████████████████████████████████| Credential stuffing key driver
Synthetic identity fraud |████████████████████████████████ | Fastest growing (SIN + fabricated data)
Social engineering |████████████████████████████████ | Impersonation of gov/bank
Physical theft (mail/wallet) |████████████████████████ | Declining but persists
Dumpster diving |████████████████ | Declining
|---+---+---+---+---+---+---+------------|
(Relative frequency — not absolute count scale)
| Identity Theft Method | How It Works | Key 2025–2026 Trend |
|---|---|---|
| Phishing / smishing / vishing | Deceptive emails, texts, or phone calls impersonating banks, CRA, or government agencies | Ongoing — most common initial vector; spoofing of business numbers up |
| Data breaches | Large-scale theft of personal data from organisations holding SINs, financial records, health data | Nova Scotia Power (2025): 280,000 affected, 140,000 SINs exposed |
| Account takeover (ATO) | Credential stuffing using re-used passwords; gains access to banking, tax, or government accounts | Leaked credentials up +160% in 2025 vs 2024 globally |
| Synthetic identity fraud | Real SIN + fabricated name, DOB, address used to build a new fictitious credit identity | Surged to 26% of Canadian business fraud losses (from 18% in 2024) — largest YoY increase globally |
| Government benefit fraud | Stolen SIN/identity used to claim EI, CRA tax refunds, or other government transfers | CRA accounts targeted; CRA escape room campaign in 10 cities in 2024 |
| Mail theft / physical methods | Theft of pre-approved credit offers, bank statements, SIN card | Declining but persistent; Canada Post notification essential |
| Social engineering / impersonation | Fraudster poses as authoritative figure to extract identity data | 60% of Canadian businesses report customers victimised by brand impersonation email |
| AI-enabled deepfakes / voice cloning | Synthetic media used to impersonate individuals in real-time verification | Emerging; flagged by CCCS and TransUnion as growing 2025–2026 threat |
Sources: Canadian Centre for Cyber Security (CCCS), Protecting yourself from identity theft online (ITSAP.00.033); Government of Canada, canada.ca — SIN fraud and data breaches (updated May 2026); Canada Revenue Agency — How the CRA supports victims of identity theft (February 2025); TransUnion Canada — H2 2025 Top Fraud Trends Report (October 2025); Corbado — 11 Biggest Data Breaches in Canada 2026 (May 2026); KnowledgeFlow — Synthetic Identity Theft; iFinance Canada — Identity Theft Prevention in Canada 2026 (March 2026)
The methods used to commit identity theft in Canada in 2025–2026 have evolved substantially toward digital and large-scale vectors that generate far more exposure than the physical methods — mail theft, dumpster diving, wallet theft — that dominated in earlier eras. Phishing (deceptive email), smishing (deceptive text), and vishing (deceptive phone calls) remain the most commonly reported initial attack vectors in CAFC data, with 48% of Canadian businesses reporting that their customers were victimised by fraudsters spoofing their business phone number or name on caller ID in the past year, and 60% reporting that customers were victimised by fake emails impersonating their brand. These figures confirm that the Canadian identity theft ecosystem operates primarily through digital impersonation of trusted institutions — banks, government agencies, and major businesses — to extract credentials and personal information.
Synthetic identity fraud is the fastest-rising threat in Canada’s identity theft landscape in 2026. The method combines a real Social Insurance Number — stolen through data breach, phishing, or purchase on dark web markets — with entirely fabricated personal details: a false name, date of birth, address, and employment history. The fraudster uses this composite identity to apply for credit, build a credit history over months or years (a process called “busting out”), and then maximise and default on credit lines before disappearing. Children’s SINs are particularly targeted because children typically don’t build credit until adulthood, creating a window of a decade or more during which the fraud may go undetected. TransUnion’s October 2025 data confirmed that synthetic identity fraud now accounts for 26% of all Canadian business fraud losses — the highest share of any market in TransUnion’s global survey — and that this represents the largest year-over-year increase of any fraud type in Canada. The Canadian Centre for Cyber Security has explicitly flagged AI-generated deepfakes and voice cloning as an emerging identity fraud vector, warning that synthetic media is increasingly being used to bypass biometric and voice-based verification systems that businesses deploy as authentication safeguards.
Major Canadian Data Breaches Enabling Identity Theft 2019–2026
Scale of Major Canadian Data Breaches (Individuals Affected)
Desjardins 2019 |████████████████████████████████████████| 9.7 million (financial + personal)
Capital One Canada |████████████████████████████████████ | 6 million+ (shared with US breach)
HomeDepot Canada |████████████████████████████ | 2.4 million (payment + email)
NS Power 2025 |████████ | 280,000 (140,000 SINs exposed)
NS Govt PowerSch. |████ | ~41,700 (SINs, student + staff data)
|------+------+------+------+------+-----|
0 2M 4M 6M 8M 10M
| Breach | Year | Individuals Affected | Data Exposed |
|---|---|---|---|
| Desjardins Credit Union | 2019 | 9.7 million | Full financial and personal data; insider threat lasting 26+ months |
| Capital One Canada | 2019 | 6 million+ (shared with US breach) | Names, addresses, credit scores, SINs |
| Nova Scotia Power (ransomware) | March 2025 | ~280,000 customers; 140,000 SINs | SINs, bank account details, personal info; data published online |
| NS Government / PowerSchool | January 2025 | ~41,700 (students + staff) | SINs, personal info, student records — global breach across N. America |
| 2024 average Canadian breach cost | 2024 | — | USD$4.66 million per incident |
| CRA credential-stuffing attack | 2020 | 11,000+ taxpayer accounts | Password reuse from unrelated breaches; MFA absence exploited |
Sources: Corbado — 11 Biggest Data Breaches in Canada 2026 (updated May 22, 2026); Nova Scotia Government — Privacy Breach Alerts (2025); Government of Nova Scotia — PowerSchool breach notification; IBM / Ponemon Institute — Cost of a Data Breach Report 2024 (Canadian data)
The data breach landscape in Canada is a critical upstream driver of identity theft, because large-scale breaches create the raw material — Social Insurance Numbers, dates of birth, addresses, banking details — that fraudsters require to commit downstream identity fraud at scale. The Desjardins breach of 2019 remains the largest in Canadian history by number of individuals affected: 9.7 million people had their complete financial and personal profiles exposed through an insider threat that went undetected for over 26 months, ultimately triggering intervention from the Office of the Privacy Commissioner and a landmark class-action settlement. The breach’s ongoing relevance in 2026 is direct: SINs and personal data from the Desjardins breach continue to circulate on dark web markets seven years later, enabling ongoing identity fraud against individuals whose information was stolen but who may not yet have experienced fraudulent use.
The Nova Scotia Power ransomware attack of March 2025 is the most significant Canadian breach in recent years, and its characteristics are particularly damaging from an identity theft perspective. Approximately 280,000 customers — almost half of Nova Scotia Power’s entire customer base — had their data exposed, including approximately 140,000 customers whose Social Insurance Numbers were included in the stolen data. The utility refused to pay the ransom, which resulted in the stolen data being published online before detection — meaning that unlike breaches where data is held privately for ransom negotiations, the Nova Scotia Power data was made publicly available to any threat actor who sought it. The combination of SINs, banking details for pre-authorized payments, and personal information represents precisely the package required for synthetic identity fraud and government benefit fraud. Experts quoted in breach coverage specifically questioned the necessity of storing SINs alongside payment data, a practice that creates disproportionate long-term identity risk for utility customers who have no alternative to providing their SIN to certain regulated providers.
Identity Theft by Age Group and Demographics in Canada 2024
Identity Fraud Impact by Age Group (CAFC 2024 data)
Under 50 |████████████████████████████████████████| Higher report volume; lower avg loss
50–59 |████████████████████████████████ | Rising reports and losses
60+ reports |████████████████████████████████████ | 12,801 total CAFC reports from this group
60+ victims |████████████████████████████████████████| 65% victimization rate (overall all fraud)
ID fraud 60+ |████████████████████████████████████████| 100% victimization rate (identity fraud)
60+ avg loss |████████████████████████████████████████| $21,604 per victim (identity fraud)
|---+---+---+---+---+---+---+------------|
(Relative scale — not absolute report volumes)
| Demographic Group | CAFC 2024 Data | Key Vulnerability Factor |
|---|---|---|
| Canadians aged 60+ | 12,801 total reports; 8,327 confirmed victims; 65% victimization rate (all fraud) | Higher savings, less familiarity with digital fraud tactics |
| Canadians aged 60+, identity fraud specifically | 1,684 reports; 100% victimization rate; avg loss $21,604 | Most financially damaging per victim of any age/fraud combination |
| Canadians aged 60+ share of total losses | $179.9 million (40.3% of total) | 40.3% of losses from 23% of population |
| Canadians under 50 | Higher report volume than 60+; lower average loss | More reports; fewer completions; faster detection |
| Alberta residents | 22% self-reported fraud victimization rate (highest province) | Highest provincial rate; online reporting more accessible |
| Daily internet users vs non-users | 18% victimization rate vs 6% (GSS 2019) | 3× higher fraud risk with daily internet use |
| Men vs women (identity fraud) | Male deaths from heat not applicable — men somewhat more frequently report identity fraud | Pattern consistent with cybercrime victimisation data |
Sources: CAFC 2024 Annual Statistical Report; Discreet Investigations Canada — Fraud Statistics Canada 2025 (CAFC source, May 2026); Statistics Canada, 2019 General Social Survey on victimization; Government of Canada, Fraud Prevention Month 2025
The demographic profile of identity fraud victimisation in Canada reveals a pattern of concentrated financial harm among older Canadians that is disproportionate by any measure. Canadians aged 60 and over represent approximately 23% of the Canadian population but absorbed 40.3% — or $179.9 million — of total 2024 CAFC-reported fraud losses, averaging a 65% victimization rate across all fraud types they reported. For identity fraud specifically, the victimization rate among seniors was 100% — a figure that reflects both the targeted nature of identity fraud operations (which specifically seek out individuals with established credit histories, savings accounts, and retirement income) and the greater difficulty older Canadians face in quickly detecting that their identity has been compromised and taking remedial action. The $21,604 average loss per elderly identity fraud victim is substantial enough to materially affect retirement savings, credit access, and financial security for the remainder of a victim’s life.
The provincial dimension of identity fraud victimisation adds another layer of nuance. Alberta has the highest self-reported fraud victimisation rate of any Canadian province at 22% — significantly above the national average — a finding the CAFC attributes partly to Alberta’s higher online engagement rate and partly to the province’s large population of resource sector workers who are frequently targeted by employment and investment scams. Yukon leads all jurisdictions in per-capita CAFC report rates, likely reflecting the higher proportion of digital transactions relative to population size in the territory’s economy. The 2019 General Social Survey finding that daily internet users face three times the fraud victimisation risk of non-internet users (18% vs 6%) is particularly relevant to the 2026 landscape, where the pandemic-driven expansion of internet use among older Canadians — remote banking, telehealth, online shopping — has brought a larger population into the highest-risk category without a commensurate expansion of digital literacy or fraud awareness.
Synthetic Identity Fraud and Emerging Threats in Canada 2026
Synthetic Identity Fraud — Share of Canadian Business Fraud Losses
2024 |██████████████████ | 18% of business fraud losses
2025 |████████████████████████████████ | 26% of business fraud losses (+8 pp YoY)
Global rank |████████████████████████████████████| HIGHEST synthetic ID fraud share globally (TransUnion)
|---+---+---+---+---+---+---+---------|
0% 5% 10% 15% 20% 25% 30%
| Synthetic / Emerging Threat | 2025–2026 Data | Source |
|---|---|---|
| Synthetic identity fraud share of Canadian business losses | 26% (up from 18% in 2024) — largest YoY jump globally | TransUnion H2 2025 |
| Total Canadian business fraud losses (2025) | CAD$111 billion | TransUnion survey of 200 biz leaders |
| Online community fraud attempts (H1 2025 vs H1 2024) | +68% YoY; rate of 11.4% of attempted transactions | TransUnion H2 2025 |
| Gambling platform fraud rate in Canada (H1 2025) | 10.9% of attempted transactions | TransUnion H2 2025 |
| Financial services fraud rate decline (H1 2025) | Down 40% in volume YoY | Stronger auth protocols |
| AI-enabled identity fraud — voice cloning / deepfakes | Emerging; flagged by CCCS as growing 2025–2026 threat | CCCS ITSAP.00.033 |
| Leaked credentials globally (2025 vs 2024) | +160% YoY (mostly personal, not corporate accounts) | Check Point / Identity fraud study 2025 |
| Organisations using passwords as primary auth (global) | 87% | Despite known credential risks |
| Children targeted for SIN-based synthetic fraud | Child SINs preferred — no credit history for years | KnowledgeFlow — Synthetic Identity Theft |
Sources: TransUnion Canada — H2 2025 Update to the Top Fraud Trends Report (October 8, 2025); Canadian Centre for Cyber Security (CCCS) — Protecting yourself from identity theft online (ITSAP.00.033); KnowledgeFlow — Synthetic Identity Theft; Check Point / Regula Forensics — Identity Fraud by Numbers 2025 (December 2025); iFinance Canada — Identity Theft Prevention in Canada 2026 (March 2026)
Synthetic identity fraud has emerged as the most rapidly escalating threat within Canada’s identity theft ecosystem, and in 2026 it has achieved a level of sophistication that makes it qualitatively different from traditional forms of identity crime. Unlike conventional identity theft — where a single stolen identity is used against one victim who will eventually discover the fraud — synthetic identity fraud creates entirely new fictitious persons using real SIN numbers combined with fabricated details, builds credit histories for these phantom individuals over months or years, and exploits the resulting credit lines at scale before abandoning the synthetic identity. Because no real individual has their existing credit directly harmed in the initial stages, the fraud often remains undetected by credit bureaus, lenders, and fraud monitoring systems until the synthetic identity has accumulated significant credit exposure. When a real person whose SIN was used in a synthetic identity eventually attempts to obtain credit themselves, they may discover that a fraudulent credit history has been built in parallel to their real one — a situation that can take years and extensive legal documentation to resolve.
The +68% surge in fraudulent attempts against Canadian online communities and social platforms in H1 2025 reflects a strategic reorientation by organised fraud networks toward platforms where trust and engagement are high and verification is weak. Dating platforms and online forums — which have high user trust, relatively weak identity verification, and large volumes of personal information sharing — have become preferred environments for building the social credibility that supports both romance scams and the long-term synthetic identity cultivation process. The CCCS’s explicit warning about AI-enabled deepfakes and voice cloning as identity fraud tools in Canada reflects the next stage of this evolution: the use of generative AI to create convincing visual and audio impersonations that can bypass the biometric verification systems that financial institutions have deployed specifically to counter credential-based attacks. As 85% of surveyed Canadians have expressed concern about their data security and 66% report heightened anxiety about data protection compared to three years earlier, the psychological toll of Canada’s identity theft crisis in 2026 is demonstrably extending beyond the direct financial victims to the broader population that lives with a daily awareness of systemic vulnerability.
Disclaimer: The data research report we present here is based on information found from various sources. We are not liable for any financial loss, errors, or damages of any kind that may result from the use of the information herein. We acknowledge that though we try to report accurately, we cannot verify the absolute facts of everything that has been represented.
