Identity Theft and Identity Fraud in Canada

The short answer

Canada has two separate identity offences. Identity theft under s. 402.2 is getting, having or passing on someone's identity information so that it can be used for a crime. Identity fraud under s. 403 is actually pretending to be someone else in order to gain something or avoid something. Identity fraud is the more serious of the two charges, and both are often laid together with a general fraud charge under s. 380.

What counts as identity information

Identity information is any information that is commonly used to identify a person (s. 402.1). It includes names, addresses and dates of birth, as well as SIN, driver's licence, health card and passport numbers. It also includes bank and card numbers, PINs and passwords, along with fingerprints, voice prints and other biometric information.

Identity theft (s. 402.2)

Identity theft covers two kinds of conduct. The first is getting or having another person's identity information while intending to use it to commit a fraud, deceit or falsehood offence. The second is passing on, selling or offering identity information while knowing, or being reckless about whether, it will be used that way.

Identity theft carries up to 5 years by indictment. Having someone's information is not a crime on its own, because the Crown must also prove the intent or knowledge that the section requires.

Identity fraud (s. 403)

Identity fraud is pretending to be another person, living or dead, or using their identity information as if it were your own. The pretending must be done to gain an advantage for yourself or someone else, to obtain property, to cause a disadvantage to someone, or to avoid arrest or prosecution. Identity fraud carries up to 10 years by indictment.

Related offences

• Fraud (s. 380): This may be charged if money or property was actually obtained.
• Identity documents (s. 56.1): This covers having or selling another person's identity documents without a lawful excuse.
• Credit card offences (s. 342): These may be charged if card data was used. See credit card fraud and forgery.

Common situations

• Using someone's card or account details to make purchases online.
• Opening bank accounts, phone plans or loans in another person's name.
• Using a family member's ID to obtain a service or benefit.
• Giving police another person's name during a traffic stop.

These charges often come with fraud under s. 380. See online and internet fraud.

The evidence in a typical case

The Crown often relies on bank, lender and credit bureau records, account applications and the information used on them, and video from banks or stores. It may also use delivery addresses, phone numbers, and documents or data found on phones and computers during a search.

What changed in 2026

Bill C-16, in force July 18, 2026, allows affidavit evidence in some identity theft and fraud cases. As a result, the Crown may be able to prove certain facts, such as the lack of consent from the person whose identity was used, through a written statement instead of live testimony. However, the defence can ask the court to require that person to attend court for questioning.

Family cases

Many identity cases involve family members, such as a parent's credit card or a sibling's ID. These cases often turn on consent and on what was actually agreed between the people involved. The person whose identity was used may not want the charge to go ahead, and although only the Crown can withdraw the charge, that person's views can still matter.

Defences

• No intent: You did not intend to use the information to commit a crime.
• Consent: A family member or other person allowed you to use their card or information.
• Identity: The evidence does not prove that you were the person who used the information.
• Charter issues: Police may have exceeded their authority when searching devices or accounts.

Effects beyond the sentence

Because identity fraud carries a maximum of 10 years, a conviction can make a permanent resident inadmissible for serious criminality. Both offences are treated as dishonesty offences, which can affect background checks for employment and entry to the United States.

Possible outcomes

What to do now

• Do not contact the person whose identity was used if your release conditions forbid it.
• Keep any messages that show permission or an agreement about using the information.
• Do not delete accounts, files or phone data.
• Get legal advice before speaking to police or the bank.

What happens after you are charged

1. Release: Most people charged with identity theft or identity fraud are released by police with an undertaking or a court date, often with conditions about contact, devices or finances.
2. Disclosure: The Crown provides its evidence, which in fraud cases is often large and can take several months to complete.
3. Crown pre-trial: Your lawyer meets with the Crown to discuss the strength of the case, repayment and possible resolutions.
4. Resolution or trial: If the case does not resolve, it is set for trial, and the Crown must prove every element beyond a reasonable doubt.

Restitution to victims

Identity offences often leave victims with damaged credit, closed accounts and hours of work to fix their records. The court can order you to repay out-of-pocket costs that are readily calculated, such as the cost of replacing documents or reversing fraudulent charges (s. 738). Offering to cover these costs early can help the outcome.

How we can help

We can review how the information was obtained and used, and carefully test the evidence linking it to you. Call (647) 223-1980 for a free consultation.

Frequently asked questions