Identity Theft Statistics Canada [2026]: Key Facts

The Canadian Anti-Fraud Centre’s 2024 Annual Statistical Report recorded 9,683 identity fraud reports, the highest volume of any single fraud type that year. Statistics Canada’s 2019 General Social Survey estimated that 2.5 million Canadians (7.8% of adults aged 15 and older) experienced fraud in the preceding twelve months. This page draws on CAFC data, StatsCan’s UCR Survey, and CRA breach reports. It maps who gets hit, how losses break down by age, and what the decade-long trend shows.

What is identity theft

Identity theft and identity fraud are related but legally distinct offences under Canada’s Criminal Code. Identity theft is the preparatory act: obtaining or possessing another person’s identity information with the intent to use it fraudulently. Identity fraud is what happens next: using that stolen information to impersonate the victim for financial gain or to cause harm. The theft is the setup; the fraud is the crime committed with it.

Canada’s Criminal Code defines “identity information” exhaustively in s. 402.1 (Department of Justice Canada). The biometric items include fingerprints, voice prints, retina and iris images, and DNA profile. The administrative items include name, address, date of birth, signature, username, credit and debit card numbers, financial account numbers, passport number, Social Insurance Number, health insurance number, and driver’s licence number.

The two downstream offences carry distinct penalties:

• Identity theft (s. 402.2, enacted 2009): obtaining or possessing another person’s identity information with intent to commit an indictable offence involving fraud, deceit, or falsehood. Maximum sentence on indictment: 5 years. (Department of Justice Canada 2009)
• Identity fraud (s. 403): fraudulently personating another person (living or dead) to gain an advantage, obtain property, cause disadvantage, or obstruct justice. Maximum sentence on indictment: 10 years. (Department of Justice Canada 2009)
• CAFC operational definition: the Canadian Anti-Fraud Centre treats identity theft as stealing personal information and identity fraud as the downstream use of that information: opening credit accounts, accessing government benefits, or filing false tax returns.

The theft-versus-fraud distinction matters practically. Police and the CAFC track the two offences separately; Statistics Canada’s Uniform Crime Reporting Survey records distinct incident counts for each. A single criminal event can produce both a theft charge and a fraud charge against the same offender.

Identity theft and identity fraud in Canada: key numbers [2024]

Note on the police-reported figures: Statistics Canada’s 2024 release excludes the Montréal Police Service due to a data transmission gap, so the national totals are slightly understated.

The fraud statistics Canada post covers the full CAFC taxonomy across all fraud types: investment fraud, romance scams, service fraud, and the top-10 loss categories. It draws on the same UCR trend series used here.

Police-reported trends: a decade of identity crime

The long-run trajectory is unmistakable. Police-reported identity fraud in Canada climbed from 15 incidents per 100,000 population in 2010 to 50 per 100,000 in 2024. That is a 233% increase, per Statistics Canada’s 2024 crime data release.

The rate peaked at 55 per 100,000 in 2021 before declining briefly, then rebounding. Identity theft, the narrower “preparatory” offence, peaked at 19 per 100,000 in both 2020 and 2021. It then fell to 14 per 100,000 by 2023 and held stable in 2024. The fraud rate accelerated while the theft rate softened. That gap reflects the shift toward digital delivery vectors, where the theft and fraud steps collapse into a single automated transaction.

Identity fraud is also the fastest-growing component of Canada’s broader crime increase. All fraud in Canada rose 92% over the decade, from 261 incidents per 100,000 in 2014 to 500 in 2024, per Statistics Canada’s Daily release. Identity fraud drove more of that increase than any other fraud sub-category.

Rural areas have not been shielded. Statistics Canada’s 2024 Juristat on rural and urban crime records a 204% rise in rural identity theft rates between 2014 and 2024, versus 117% in urban areas. That makes it the property crime with the highest rural growth rate over the decade.

Nearly 48,900 fraud-related cybercrime violations were reported by police in Canada in 2023, almost double the 2019 count (+95%). Identity fraud and identity theft together accounted for 62% of all cybercrime violations combined, according to Statistics Canada’s fraud analysis page.

Who is most at risk: age and demographic breakdown

Source: Canadian Anti-Fraud Centre 2025.

Canadians aged 60 and older absorbed 40.3% of total CAFC-reported fraud losses in 2024, despite making up roughly 23% of the population. Their average loss per incident ($21,604) was nearly three times the average for the 30–39 cohort ($7,813).

Income and education cut against common intuition. Canadians earning $120,000 or more annually had a five-year fraud victimization rate of 24%. That compares to 13% for those earning under $20,000, according to Statistics Canada’s 2019 GSS. University graduates were 2.5 times more likely to report fraud than those without a high school diploma. Higher income and education correlate with greater online financial activity, not with protection.

Provincial victimization rates also varied substantially in the 2019 GSS. Alberta recorded the highest five-year rate at 22%, while Nunavut (8.6%), New Brunswick (13%), and Newfoundland and Labrador (13%) recorded the lowest among reported jurisdictions.

Equifax Canada’s 2025 fraud survey adds attitudinal data: 96% of Canadians aged 65+ agreed that companies must do more to protect personal data. That compares to 75% of adults aged 18–24. Across all age groups, 48% personally knew someone who had been victimized by identity theft.

How identity theft happens: the main delivery vectors

• Cyber-enabled methods dominate losses. Internet, social networks, email, and text together drove 75% of all reported fraud losses in Canada in 2024. That came to $481.6 million of the $643.7 million total, even though these channels generated fewer reports by volume than telephone-based methods, per the CAFC’s solicitation methods bulletin.

• Phishing is the primary credential-theft vector. Fraudulent emails, text messages, or websites impersonating trusted organizations are among the most commonly reported fraud types in Canada. Spear phishing, which targets specific individuals or organizations, generated $67.3 million in losses in 2024, per the CAFC 2024 Annual Statistical Report. That is the second-highest loss total of any fraud category, behind only investment fraud. For the national scale of phishing, the phishing statistics Canada post covers CCCS threat data, email-platform breakdowns, and credential-theft typologies.

• Data breaches expose identity credentials at scale. Statistics Canada’s 2022 Canadian Internet Use Survey found that 70% of Canadians experienced at least one cyber security incident in 2022, up from 58% in 2020. Of those incidents, 6% produced a financial loss.

• Identity fraud is 6% of cybercrime incidents by category. Among Canadians who experienced cyber security incidents in the 2022 CIUS, fraudulent content accounted for 40%, fraudulent payment card use for 9%, and account hacking for 8.3%. Identity fraud specifically was 6%, per Statistics Canada’s Canada at a Glance, 2023.

• AI tools are lowering the entry barrier. The Canadian Centre for Cyber Security’s National Cyber Threat Assessment 2025-2026 identifies AI-enhanced phishing tools as making credential theft increasingly accessible for less technically sophisticated criminals. Reported fraud losses in Canada rose 48% from $383 million in 2021 to $567 million in 2023 over the same period that AI-assisted phishing became commercially available.

The broader cybercrime data context, covering ransomware, business email compromise, and PIPEDA breach trends, sits in the cybercrime statistics Canada post. It tracks the full CCCS threat-assessment series.

CRA impersonation and SIN theft: the Canadian-specific threat

The Canada Revenue Agency’s taxpayer accounts represent a uniquely high-value target. A 2026 Office of the Privacy Commissioner special report found that the CRA suffered 42,755 confirmed unauthorized access cases between May 2020 and mid-2025. The agency authorized more than $190 million in fraudulent payments linked to those breaches between 2020 and October 2024.

The OPC’s 2024-2025 annual report recorded 1,301 total breach reports: 615 under the Privacy Act and 686 under PIPEDA. Roughly 20 million Canadian accounts were affected by private-sector breaches. 91% of Canadians surveyed expressed concern about their personal data being misused for identity theft.

Impersonation fraud is one of the fastest-growing fraud categories in Canada. The CAFC, Canadian Competition Bureau, RCMP, and OPP jointly designated it the focus of Fraud Prevention Month 2025, per the CAFC 2024 Annual Statistical Report. Fraudsters impersonate the CRA, Immigration, Refugees and Citizenship Canada, and Service Canada to steal Social Insurance Numbers and personal financial data.

A 2024 B.C. healthcare breach illustrates the downstream chain. The Social Insurance Numbers of 28,000 Interior Health employees were exposed. CBC News reporting confirmed those SINs were used to file bogus tax returns, obtain fraudulent loans, and create fake businesses through compromised CRA accounts.

The CRA established its Identity Protection Services program in October 2020 to provide a single point of contact for taxpayers resolving identity theft concerns related to their accounts. The Canada Revenue Agency’s victim-support page confirms that affected taxpayers are not held liable for unauthorized claims or taxes owed on unauthorized activity.

Identity theft in Canada vs the United States: a comparison

The United States Federal Trade Commission received 1.1 million identity theft reports in 2024, with credit card fraud the top sub-category (449,032 reports). Total US reported fraud losses reached $12.5 billion, a 25% increase over 2023’s $10 billion.

Canada’s police-reported rate of 50 per 100,000 and the US FTC’s complaint rate of roughly 329 per 100,000 cannot be compared directly. The FTC operates a self-reported consumer complaint portal; Canada’s UCR Survey counts incidents reported to and recorded by police. The true under-reporting rate for both countries is substantial.

The age-loss pattern in the United States closely mirrors Canada’s. AARP’s analysis of FTC 2024 data found that US adults aged 50+ were more likely to have lost money to fraud (41%) than those aged 18–49 (35%). Adults in their 70s recorded a median loss of $1,000 per incident, more than double the $417 median for those in their 20s.

Canada received approximately 10% of global phishing attempts in Q2 2024, behind the United States (46%) and Great Britain (16%), per the Canadian Centre for Cyber Security’s NCTA 2025-2026. Credential-stealing phishing emails targeting Canadian organizations increased 27% from 2023 to 2024.

What identity theft costs victims beyond money

• Psychological and emotional harm is consistent and well-documented. Fraud victims in Canada report feelings of betrayal, anger, sadness, mistrust, hopelessness, anxiety, depression, and post-traumatic stress, according to the RCMP Gazette. Shame and embarrassment frequently cause victims to withdraw from family and friends.

• The direct financial picture is highly skewed. Statistics Canada’s 2019 GSS recorded $16.3 billion in self-reported fraud losses over five years. The average loss was $5,000 per incident, but the median was approximately $600. One in four victims lost more than $1,000. The distribution is driven by a smaller group of high-loss cases.

• Credit damage, time costs, and health impacts compound the dollar loss. Research cited by Department of Justice Canada documents “indirect financial losses” through credit damage and extensive time spent clearing credit ratings. Physical health impacts such as sleep difficulties, and emotional consequences such as isolation and loss of trust, are also documented.

• CRA-account victims face a distinct harm profile. The OPC’s special report on the CRA notes that victims experienced “loss of thousands of dollars of benefits or tax refunds,” fraudulent benefit claims and tax filings, and psychological stress. For many, the identity theft persists for years. The majority of unauthorized CRA account cases are self-reported by taxpayers, not proactively detected by the CRA.

• Protective behaviours remain weak on both sides of the border. AARP research finds that 45% of adults use the same password on two or more accounts and 21% never shred personal documents. These gaps facilitate prolonged undetected identity theft.

What these numbers mean if your identity is compromised

The gap between reported and actual identity crime is the most operationally important number in this dataset. Only 5 to 10% of fraud incidents in Canada are reported to any authority, according to RCMP Gazette research citing McMaster University and Statistics Canada studies. The 9,683 CAFC identity fraud reports and the 25,178 police-reported incidents for 2024 likely represent a fraction of actual events. The true burden is probably 10 to 20 times larger.

The preparedness gap is wide. Equifax Canada’s 2025 survey found 55% of Canadians believe identity thieves stay ahead of prevention efforts. Another 58% struggle to keep up with evolving scams, and 51% are unsure how to respond if they became victims. Awareness has risen; preparedness has not kept pace.

Readers whose identity may already be compromised, through a CRA account breach, an exposed Social Insurance Number, or unauthorized credit applications, have a concrete next step. Social media and internet investigation services can document how personal information has circulated, identify which accounts have been compromised, and produce court-admissible records of digital misuse.

As licensed PIs operating across Canada’s major urban centres, we see the downstream consequences of identity theft in our client work. Victims frequently discover SIN misuse years after the original breach. Others learn their digital footprint was used to open fraudulent accounts across multiple institutions. The data matches what we see: losses skew older, the CRA is a persistent target, and the reporting gap means most victims carry the burden without official recognition.

All fraud statistics on this page connect to the broader fraud statistics Canada pillar hub. It indexes the full CAFC annual data series, UCR trend charts, and sub-topic breakdowns covering investment fraud, romance scams, insurance fraud, and cybercrime.