5 Identity Theft Threats Coming in 2026 and What to Do Now
The Canadian Anti-Fraud Centre logged 8,403 identity fraud reports in 2025. Most victims found out months after the damage, when a collection agency called or a loan application bounced. The threats in 2026 don't look like the ones most Canadians are watching for.
1. Phone number hijacking (SIM-swap attacks)
A fraudster calls your mobile carrier, pretends to be you, and convinces them to transfer your number to a new device. Once they control your phone number, they receive every two-factor authentication code sent via text. That unlocks your bank account, your CRA My Account login, and any other service that uses SMS for security.
The fix: call your carrier and ask them to add a "port protection PIN" to your account. Rogers, Bell, and Telus all offer this. The PIN is required before anyone can move your number. Set it, write it down somewhere that isn't your phone, and never share it.
2. Synthetic identity fraud
This one's harder to spot because it's not entirely your identity. Fraudsters blend your real Social Insurance Number with a fake name, birthdate, or address. The result is a "person" who doesn't exist but has enough real markers to open accounts. Traditional credit monitoring won't flag it because the fraud happens under a name that isn't yours.
You catch it by checking your SIN usage. Call Service Canada once a year and ask for a confirmation of your SIN and the name tied to it. If anything looks off, file a report immediately. This is free.
3. Title fraud on your home
Someone impersonates you, forges documents, and either sells your house or takes out a fraudulent mortgage against it. This used to be rare. In 2026, with property values elevated across Canada, it's a high-return target for organized fraud.
The only effective defence is title insurance. If you already have a policy from when you bought the home, confirm it's still active. If you don't have one, call your insurer and add an owner's title policy now. It costs roughly $200-$500 as a one-time fee for most properties and covers legal costs if someone goes after your title. Some insurers also offer a "title monitoring" service that alerts you if someone files a document against your property.
4. Pre-approved credit card offers in your mailbox
This is old-school but still works. Fraudsters watch for mail, pull the pre-approved card offer before you see it, fill it out, and redirect the card to a address they control. You don't know a card was opened in your name until you check your credit report.
Get a locking mailbox or a PO box. Shred anything with your name and address before it goes in the trash. And put a fraud alert on your Equifax and TransUnion files. The alert stays active for six years and forces lenders to call you before approving new credit. It's free. You request it online or by phone.
5. Credential stuffing from old breaches
You used the same password for your email, your bank, and three shopping sites back in 2019. One of those sites got breached. The passwords are now in a database that gets sold and resold. In 2026, automated bots are testing those old credentials against Canadian bank logins, CRA portals, and provincial service sites.
Change your passwords. Use a password manager (1Password, Bitwarden, or Dashlane all work). Turn on two-factor authentication everywhere, but use an authenticator app, not SMS. Google Authenticator and Microsoft Authenticator are both free.
The $1 test transaction at a gas station is still the canary. Check your statements weekly, not monthly.
The Canadian Anti-Fraud Centre logged 8,403 identity fraud reports in 2025. Most victims found out months after the damage, when a collection agency called or a loan application bounced. The threats in 2026 don't look like the ones most Canadians are watching for.
1. Phone number hijacking (SIM-swap attacks)
A fraudster calls your mobile carrier, pretends to be you, and convinces them to transfer your number to a new device. Once they control your phone number, they receive every two-factor authentication code sent via text. That unlocks your bank account, your CRA My Account login, and any other service that uses SMS for security.
The fix: call your carrier and ask them to add a "port protection PIN" to your account. Rogers, Bell, and Telus all offer this. The PIN is required before anyone can move your number. Set it, write it down somewhere that isn't your phone, and never share it.
2. Synthetic identity fraud
This one's harder to spot because it's not entirely your identity. Fraudsters blend your real Social Insurance Number with a fake name, birthdate, or address. The result is a "person" who doesn't exist but has enough real markers to open accounts. Traditional credit monitoring won't flag it because the fraud happens under a name that isn't yours.
You catch it by checking your SIN usage. Call Service Canada once a year and ask for a confirmation of your SIN and the name tied to it. If anything looks off, file a report immediately. This is free.
3. Title fraud on your home
Someone impersonates you, forges documents, and either sells your house or takes out a fraudulent mortgage against it. This used to be rare. In 2026, with property values elevated across Canada, it's a high-return target for organized fraud.
The only effective defence is title insurance. If you already have a policy from when you bought the home, confirm it's still active. If you don't have one, call your insurer and add an owner's title policy now. It costs roughly $200-$500 as a one-time fee for most properties and covers legal costs if someone goes after your title. Some insurers also offer a "title monitoring" service that alerts you if someone files a document against your property.
4. Pre-approved credit card offers in your mailbox
This is old-school but still works. Fraudsters watch for mail, pull the pre-approved card offer before you see it, fill it out, and redirect the card to a address they control. You don't know a card was opened in your name until you check your credit report.
Get a locking mailbox or a PO box. Shred anything with your name and address before it goes in the trash. And put a fraud alert on your Equifax and TransUnion files. The alert stays active for six years and forces lenders to call you before approving new credit. It's free. You request it online or by phone.
5. Credential stuffing from old breaches
You used the same password for your email, your bank, and three shopping sites back in 2019. One of those sites got breached. The passwords are now in a database that gets sold and resold. In 2026, automated bots are testing those old credentials against Canadian bank logins, CRA portals, and provincial service sites.
Change your passwords. Use a password manager (1Password, Bitwarden, or Dashlane all work). Turn on two-factor authentication everywhere, but use an authenticator app, not SMS. Google Authenticator and Microsoft Authenticator are both free.
The $1 test transaction at a gas station is still the canary. Check your statements weekly, not monthly.
Sources
Read Next
In Nearly All 50 Major U.S. Cities, Minimum Wage No Longer Covers a One-Bedroom Apartment
Builders Can't Finance Tiny Homes Fast Enough to Meet Canadian Demand
Can $1.16 Million Actually Retire You at 63? The Two Numbers Tom Missed
5 Steps to Build a Financial Buffer Before You Need One