Your Canadian SIN Was Exposed: What to Do First and When to Request a New Number

• If your SIN appeared in a data breach, start by monitoring your credit, bank accounts, tax records, employment records, and mail. Exposure alone does not usually qualify you for a new SIN.
• If you find actual misuse, report it to the police, Canadian Anti-Fraud Centre, credit bureaus, affected creditors, financial institutions, and any government program involved.
• Service Canada generally requires clear evidence of fraud before issuing a new SIN, and a replacement does not erase or permanently protect the old number.

Your SIN was exposed. What should you do first?

If your Canadian Social Insurance Number appeared in a data breach, do not panic and do not pay anyone who offers to “replace” it immediately. The first priority is to find out whether the number has actually been used.

Service Canada’s current guidance recommends closely monitoring your credit reports, financial statements, mail, tax information, and employment records. If you discover unauthorized activity, report the specific misuse to the organization or government program involved. A leaked SIN and a fraudulently used SIN are related problems, but they are not the same thing.

A new SIN is not normally the first solution. Service Canada says a replacement may be issued only when there is clear evidence that the existing SIN was used fraudulently. Even then, the old number does not disappear, and you remain responsible for monitoring it.

Step 1: Check where the damage may have occurred

Start with the warning signs that match your situation. You may not see every sign, and a clean check today does not guarantee that someone will not try to use your information later.

• Credit: Look for accounts you did not open, unfamiliar credit inquiries, collection notices, or changes to your address.
• Banking and cards: Review statements for unauthorized withdrawals, transfers, purchases, or new accounts.
• Taxes: Watch for a CRA notice about income you did not earn, an unexpected reassessment, or changes to your tax account.
• Employment: Check whether unfamiliar employers have issued T4 slips under your SIN.
• Benefits: Look for unexpected Employment Insurance or other government-benefit activity.
• Mail: Take note of opened envelopes, missing financial statements, or mail being redirected without your permission.

Keep copies of the breach notice, suspicious messages, account statements, letters, screenshots, and dates. This evidence can make later disputes and reports much easier.

Step 2: Check both Canadian credit reports and add a fraud alert

Contact Equifax Canada and TransUnion Canada separately. Ask for your credit report or consumer disclosure and review the accounts, inquiries, addresses, and names listed on each file. One bureau may show information that the other does not.

If your SIN was exposed but you have not found confirmed fraud, ask about placing a potential fraud alert. If you find fraudulent accounts or confirmed identity theft, ask the bureau about the appropriate confirmed fraud warning and dispute process.

A fraud alert tells lenders to contact you before approving new credit in your name. It does not remove fraudulent accounts, replace your SIN, or guarantee that every creditor will stop a scam. You still need to contact each affected creditor and dispute inaccurate information.

Step 3: Report confirmed fraud to the right organizations

There is no single report that fixes every type of SIN misuse. Use the branch that matches what happened.

Credit or loan fraud

Contact the creditor using the phone number on its official website or statement. Tell the creditor that the account or application resulted from identity theft, ask for the account to be closed or blocked, and request written confirmation that you are not responsible for the fraudulent debt. Also dispute the account with both credit bureaus.

CRA or tax-related identity theft

If someone used your information with the Canada Revenue Agency, contact the CRA through its identity-theft process. You may need to complete Form RC213, Identity Theft and Suspicious Activity Declaration, and provide details about the suspicious activity. Change affected passwords and review your CRA account for unauthorized changes.

Employment fraud

If an unfamiliar employer appears under your SIN, contact the CRA to obtain information about employers that issued T4 slips for your SIN. Service Canada may require you to identify employers you never worked for, provide a police report, show identity documents, provide a photograph, and list your addresses for the previous 10 years if you later request a new SIN.

Employment Insurance or other benefit fraud

Contact the specific program that issued or received the suspicious claim. For example, fraudulent EI activity should be reported directly to the Employment Insurance program. Reporting to Service Canada alone does not automatically correct every affected benefit file.

Mail theft or suspicious delivery

Contact Canada Post if financial statements or government documents were opened, redirected, or never arrived. Also contact the institution that sent the missing document and ask whether your mailing address or account contact information was changed.

Step 4: File a police report and notify the Canadian Anti-Fraud Centre

If someone used your SIN to obtain credit, earn income, access benefits, or commit another crime, file a report with your local police service. Ask for the case reference number, the officer’s name and telephone number, and a copy of the report if available. Service Canada says the report should identify you and include your SIN or at least the last three digits.

You should also report the fraud to the Canadian Anti-Fraud Centre. The centre collects information that can support broader law-enforcement investigations, although it does not replace a police report or a creditor dispute.

Should you request a new SIN?

Usually, not immediately. Service Canada says monitoring and reporting misuse may provide better protection than obtaining a second number. A replacement SIN does not erase the old one, correct your credit reports, or stop someone from continuing to use information already connected to you.

Service Canada may consider a new SIN when there is clear evidence of fraudulent use. Simply being worried, losing a document, or receiving notice that your information was included in a breach is generally not enough by itself.

If you still want to apply, you must visit a Service Canada Centre with the required documents. Depending on the fraud type, you may need identity documents, a police report or case number, and letters from creditors or employment records showing the fraudulent use.

Think of a replacement SIN as a limited administrative remedy, not a reset button. If one is issued, you must update employers, banks, creditors, pension providers, and other organizations that legitimately need the new number. You must also continue watching the old SIN and correcting records that contain inaccurate information.

A practical response checklist

1. Save the breach notice and record when you learned about the exposure.
2. Review both Equifax and TransUnion files for unfamiliar accounts, inquiries, addresses, and employers.
3. Ask both bureaus about a fraud alert and dispute any inaccurate information.
4. Review bank, credit-card, CRA, benefit, and employment records.
5. Contact each creditor, bank, or government program connected to suspicious activity.
6. File a police report if fraud occurred and keep the case reference number.
7. Report the incident to the Canadian Anti-Fraud Centre.
8. Report suspicious mail to Canada Post.
9. Keep monitoring after the immediate problem is resolved.
10. Consider a new SIN only if you can document actual fraudulent use and understand the ongoing responsibilities.

What to avoid after a SIN breach

Do not respond to unsolicited calls, texts, or emails promising to cancel, lock, or replace your SIN. Service Canada warns that scammers may impersonate government representatives and create urgency to obtain your SIN, banking details, passwords, or payment.

Do not send your full SIN to an unverified contact. If you receive a message about the breach, contact the organization using a phone number or website you found independently. Also avoid assuming that paid credit monitoring is required; first check what protection your bank, employer, insurer, or the organization responsible for the breach may already provide.

Helpful Links

• Service Canada: SIN fraud and data breaches – Review the federal response steps, warning signs, reporting guidance, and requirements for requesting a new SIN.
• Canada Revenue Agency: Report a scam or identity theft – Report suspicious CRA account activity and learn how to submit the identity-theft declaration.
• Financial Consumer Agency of Canada: Protecting financial information after a data breach – Find federal guidance on reviewing accounts, contacting financial institutions, and reporting data-breach-related fraud.
• Canadian Anti-Fraud Centre – Report fraud or identity theft and access Canadian fraud-prevention information.
• TransUnion Canada consumer support – Access TransUnion consumer disclosure, fraud-alert, and credit-file support options.
• Service Canada: Find a Service Canada Centre – Find an in-person location if you decide to discuss a new SIN request.
• Employment Insurance and fraud – Official page referenced in the article.
• Support: Find answers, contact us or report a problem – Official page referenced in the article.

Frequently Asked Questions

Q. Does a data breach automatically mean I need a new SIN?

A. No. Exposure alone generally does not qualify you for a new SIN. Service Canada recommends monitoring your records and reporting confirmed misuse. A new SIN may be considered when there is clear evidence that your current number was used fraudulently.

Q. Can someone open a credit card with only my SIN?

A. A SIN is sensitive information, but lenders may use other identity details and verification methods as well. If you see an unfamiliar account or inquiry, contact the creditor, dispute the item with both credit bureaus, and report the identity theft.

Q. Do I have to report a leaked SIN directly to Service Canada?

A. You do not generally need to report exposure alone to the SIN Program. If fraud occurred, report the activity to the police, Canadian Anti-Fraud Centre, affected creditor or government program, and credit bureaus. Contact Service Canada if you need guidance or want to discuss a possible replacement.

Q. Will a new SIN erase my old credit history or fraudulent debts?

A. No. A new SIN does not erase the old number, correct credit files automatically, or eliminate the need to prove that fraudulent activity was not yours. You must continue managing records connected to both numbers.