Contain the damage, then rebuild
Money is rarely the only thing taken. Identity data, account access and confidence all need attention — and the third one matters more than people expect.
Protecting your credit and identity
If any identity document, SIN or account credential was exposed, treat it as compromised and work through all five steps rather than waiting for something to go wrong.
Place fraud alerts with both credit bureaus
Equifax Canada and TransUnion Canada operate independently — an alert with one does nothing at the other. A fraud alert asks lenders to verify your identity before extending credit. It is free at both.
Freeze or lock your credit file if you can
A freeze is stronger than an alert: it blocks new credit outright. Quebec residents have had a statutory right to a free freeze since February 2023 under the Credit Assessment Agents Act. In Ontario, security-freeze provisions of the Consumer Reporting Act came into force on 1 July 2026, and Equifax now offers a free Credit Lock to Ontario residents — TransUnion has until 1 July 2027 to meet the suspension requirements. Other provinces are at varying stages; ask both bureaus what is available where you live.
Pull and read your own credit reports
Check for accounts, inquiries and addresses you do not recognise. Dispute anything unfamiliar in writing with the bureau that reported it, and keep the correspondence.
Protect your SIN
If your Social Insurance Number was exposed, contact Service Canada. A SIN is only reissued in confirmed fraud cases, and a new number does not erase history tied to the old one — so the credit-file work above still matters most.
Tell the CRA if tax accounts may be affected
Identity theft can lead to fraudulent returns or benefit claims filed in your name. The CRA has a dedicated process for this, and flagging it early prevents a much harder cleanup later.
Phone numbers change. Confirm each one on the organisation's official website before calling — never from a search advertisement, and never from a number given to you by someone who contacted you.
Hardening what is left
Assume the fraudster kept everything they learned about you, and that it will be reused or resold. Close the paths they already know.
- Change passwords from a device you know is clean, starting with email — it is the reset path for everything else.
- Turn on multi-factor authentication everywhere, preferring an authenticator app over SMS.
- Remove any remote-access software the fraudster had you install, and run a full malware scan.
- Review account recovery settings: forwarding rules, backup emails, and phone numbers that may have been changed.
- Check for unfamiliar devices or sessions signed in to your bank, email and crypto accounts.
- Set up transaction alerts on every account so unusual activity reaches you in real time.
- Consider a separate email address used only for financial accounts.
- If your phone number may have been ported, contact your carrier and add a port-out PIN.
Expect a second approach
Being defrauded once makes you a more valuable target, not a less valuable one. Details of who paid, how much and through what channel are traded between operations.
Assume any unsolicited contact is hostile
If someone contacts you about a loss you never told them about, they got your details from the fraud. That is true whether they claim to be a recovery firm, a law office, a securities commission, a police service, or the platform itself.
End the contact, look up the organisation independently, and call the number on their official site if you want to verify. Never use a number, link or contact given to you by the person who reached out.
The one exception is a call you arranged. If you booked an appointment with us, our call is expected — and it still has to pass the same checks. Same rule as everyone else: verify it against a number you looked up, not one you were given.
How to verify a call from us →The tells are consistent
An up-front fee of any kind. A guarantee. Claims that your funds are "located" and merely need a release payment. Pressure to act before a deadline. A request to keep it confidential from your bank or family.
Any single one of these is enough. Real recovery work is slow, documented, and never promises an outcome in advance.
The part nobody prepares you for
Fraud victims frequently describe grief, insomnia, and a specific kind of shame that makes reporting feel worse than staying silent. Where the fraud involved a relationship built over months, the loss is genuinely a bereavement as well as a financial event, and treating it as only the latter tends to prolong it.
None of this reflects poor judgement. These operations are professionally run, heavily scripted, and iterated against thousands of people. They are designed by specialists to defeat exactly the caution you are now blaming yourself for not having.
Provincial victim services provide free, confidential counselling and practical support, and you do not need charges to have been laid to use them. If you are in crisis, call or text 988 anywhere in Canada, at any hour.
If you are helping someone else
Lead with belief rather than with what they should have noticed. People who feel judged stop disclosing, and partial disclosure is what allows a fraud to continue — often for months after the family first suspects something.
Practical help lands better than advice: sit with them while they call the bank, help assemble the evidence folder, drive them to the police station. If they are still in contact with the fraudster, pushing for an abrupt cut-off can backfire — focus first on stopping outgoing payments and on getting the report filed.