If your SIN was exposed in a data breach, you almost certainly won’t get a new one. Service Canada doesn’t issue replacements for exposure alone, and they actively say a new SIN wouldn’t help most people anyway. What actually protects you is a set of free steps you can finish in about an hour: fraud alerts at both credit bureaus, a credit freeze if you’re in Quebec or Ontario, and regular monitoring of your credit reports and CRA account. This guide walks through every step in order, including what to do if someone does use your number.
Key Takeaways
- Service Canada won’t issue a new SIN unless your number was actually used for fraud, not just exposed. Even then, a replacement isn’t guaranteed and isn’t recommended.
- Place a fraud alert at both Equifax (1-800-465-7166) and TransUnion (1-800-663-9980). It’s free, lasts six years, and tells lenders to verify your identity before extending credit.
- Credit freezes are available only in Quebec (since February 2023) and Ontario (Equifax only, since July 1, 2026). TransUnion Ontario and BC follow in 2027. Everywhere else, fraud alerts plus regular credit report checks are your toolkit.
- Only 47 of the 1,034 verified breaches in the Have I Been Pwned dataset leaked identity data like a SIN. Most breaches are email-and-password problems fixable in an afternoon. A SIN breach is the serious end.
- File your taxes promptly each year so a fraudster can’t file in your name first, and pull both credit reports regularly. Every Canadian can do this for free, as often as monthly.
This article reflects Canadian policy as of September 2026. Service Canada rules, credit bureau procedures, and provincial credit freeze laws can change. Check each source for current details.
The Uncomfortable Truth: Canada Doesn’t Replace a Leaked SIN
The first thing most people search after a SIN breach is “new SIN canada,” so let’s deal with it plainly. Service Canada won’t issue a new SIN without proof that your existing SIN was actually used to commit fraud. Exposure alone doesn’t qualify. Even with proof, a request doesn’t guarantee a new number, and the application has to be made in person at a Service Canada Centre.
Here’s the part that surprises people: Service Canada actively says a new SIN isn’t recommended, even for many fraud victims. Their reasoning is practical. A new number doesn’t erase the old one, which stays linked to you forever. It doesn’t protect the new number from being misused later. And juggling two SINs across employers, banks, and the CRA creates exactly the kind of confusion that fraud thrives in. Their conclusion, in their own guidance, is that monitoring your accounts protects you better than a second SIN would.
If fraud is ever confirmed and you do pursue a new SIN, expect to bring real evidence: your identity documents, a police report, and either a letter from a creditor confirming your SIN was used fraudulently or, for employment fraud, a CRA printout showing employers who issued T4s under your SIN (request it at 1-800-959-8281). Service Canada also asks for a clear photo of yourself and a ten-year address history. That’s the path for confirmed victims, not for everyone whose number leaked.
What Service Canada Actually Tells You to Do
Since replacement is off the table for exposure alone, the official advice on Service Canada’s SIN fraud page is all about detection. It comes down to four habits:
- Pull your credit reports from both Equifax Canada and TransUnion Canada, and check for accounts or credit inquiries you don’t recognize. The bureaus hold different data, so one report isn’t enough. Every Canadian can request both for free, as often as monthly.
- Consider placing a fraud alert on your credit file, so creditors contact you before opening new accounts in your name. Details on how to do this are in the next section.
- Review your bank and credit card statements regularly for charges you didn’t make.
- Watch your mail. Statements that stop arriving, or envelopes that look opened, can mean someone has redirected or intercepted your accounts.
Service Canada also lists three specific warning signs that someone is using your SIN: a CRA Notice of Reassessment for earnings you never declared, credit inquiries on your report from lenders you never approached, and unfamiliar Records of Employment showing up in your My Service Canada Account. Any one of those moves you from “monitoring” to “reporting,” covered further down.
Fraud Alerts: Your First Practical Move
A fraud alert is a flag on your credit file telling lenders to verify your identity before extending credit. It’s free at both bureaus, it lasts six years, and it’s the single most useful step available to every Canadian regardless of province.
- Equifax Canada: call 1-800-465-7166 or use consumer.equifax.ca. Free, lasts six years. Equifax calls this an “Identity Alert.” If you live in Manitoba or Ontario, lenders are legally required to call you before extending credit when an Identity Alert is on file. Everywhere else, contacting you is encouraged rather than mandatory.
- TransUnion Canada: place a “potential fraud alert” online through TransUnion’s website or by phone at 1-800-663-9980. It’s free and also runs six years. Lenders see the alert, though they have discretion in how they respond.
Place the alert at both bureaus, not just one. Lenders don’t all check the same file. And a note for anyone reading American advice: there’s no Canadian equivalent of the US seven-year extended fraud alert. Six years is the term here, and you can renew when it lapses.
Credit Freezes: Quebec, Ontario, and Soon BC
This is where US-centric advice actively misleads Canadians. American articles about a stolen SSN all say the same thing: freeze your credit at all three bureaus. In Canada, that option exists in exactly two provinces right now, with a third on the way:
- Quebec has had a true credit freeze since February 2023, free at both Equifax and TransUnion.
- Ontario joined on July 1, 2026, but there’s an important catch: the free credit lock (Equifax calls it “Credit Lock”) is currently available only through Equifax. TransUnion Ontario won’t implement its freeze until July 1, 2027. So Ontario residents should place the Equifax Credit Lock now and add TransUnion when it becomes available.
- British Columbia is expected to follow in August 2027 under Bill 28, which has been introduced but hasn’t taken effect yet.
In both Quebec and Ontario, you need to place the freeze with each bureau separately. A freeze blocks new credit checks entirely until you lift it, which makes it stronger than a fraud alert.
In every other province and territory, there’s simply no freeze to place. Your toolkit there is the fraud alert plus regular monitoring of both credit reports. That’s not a consolation prize. It’s the combination Service Canada itself recommends, and it catches the warning signs that matter.
If Someone Actually Uses Your SIN
If one of the warning signs shows up, the response has a specific order, and the order matters because later steps ask for proof of earlier ones:
- File a report with your local police and keep the report number. Almost everything downstream asks for it.
- Report to the Canadian Anti-Fraud Centre at 1-888-495-8501 on weekdays (10 a.m. to 4:45 p.m. Eastern), or any time through the online portal at reportcyberandfraud.canada.ca. Canada doesn’t use the FTC or IdentityTheft.gov; the CAFC is the national reporting body here.
- Notify both credit bureaus and place fraud alerts if you haven’t already.
- Contact the creditors and financial institutions where the fraudulent activity happened.
- Notify the affected government program, such as the CRA for tax fraud or Service Canada for benefits fraud.
Two numbers to keep handy: the CRA identity protection line at 1-833-995-2336 can place protections and flags on your tax account immediately, on the same call. Service Canada’s SIN line is 1-866-274-6627. And if the fraud is documented, this is the point where a new SIN becomes a real option: bring your identity documents, the police report, the creditor letter or CRA employer printout, a clear photo, and your ten-year address history to a Service Canada Centre in person.
What a Leaked SIN Doesn’t Mean
Exposure isn’t use. A SIN sitting in a stolen database is a risk, not an event, and most breach records never turn into identity fraud. Using a SIN takes effort, leaves a paper trail, and gets caught by exactly the monitoring described above. The people badly hurt by SIN fraud are usually the ones who never look at their credit reports, not the ones reading articles like this one.
A SIN rarely leaks alone
What surrounds it decides the real risk. A SIN alongside your name, date of birth and home address is the combination that lets someone pass as you; a SIN with nothing else attached is a narrower problem. Tick what your notice listed in our free data breach risk checker and see what the mix actually allows.
Two calm habits close most of the remaining gap. File your taxes promptly each year, so a fraudster can’t file in your name first. And put a recurring reminder in your calendar to pull both credit reports, which every Canadian can now do for free, as often as monthly. A breach monitor covers the other side: NotchUp Shield watches for your email address in newly verified breaches, so you hear about the next exposure early instead of years later. Vigilance is boring, and boring is what wins here. Panic buys you nothing that a fraud alert and two credit reports don’t.
Frequently Asked Questions
Can I get a new SIN if mine was leaked?
Not for a leak alone. Service Canada requires proof your SIN was actually used for fraud, such as a police report plus a creditor letter or a CRA printout of employers who issued T4s on your number, and even then a new SIN isn’t guaranteed and isn’t recommended. The old number stays active, so monitoring protects you more than a second SIN would.
Should I put a fraud alert on my credit report?
Yes, at both bureaus. It’s free, lasts six years, and tells lenders to verify your identity before opening credit. Call Equifax at 1-800-465-7166 and place TransUnion’s potential fraud alert online or at 1-800-663-9980. In Manitoba and Ontario, lenders must call you before extending credit when an Equifax Identity Alert is on file.
Can I freeze my credit in Canada?
Only in Quebec (since February 2023, free at both bureaus) and Ontario (Equifax Credit Lock only, since July 1, 2026; TransUnion follows July 2027). British Columbia is expected in August 2027 under Bill 28. Everywhere else in Canada there’s no credit freeze, so ignore US advice that assumes one exists and use fraud alerts plus regular credit report checks instead.
How do I know if someone is using my SIN?
Service Canada lists three warning signs: a CRA Notice of Reassessment for income you never declared, credit inquiries on your Equifax or TransUnion report from lenders you never contacted, and unfamiliar Records of Employment in your My Service Canada Account. Missing mail or bank statements that stop arriving are also worth investigating.
Who do I call about SIN fraud?
Start with local police, then the Canadian Anti-Fraud Centre at 1-888-495-8501 (weekdays, 10 a.m. to 4:45 p.m. Eastern) or the online portal at reportcyberandfraud.canada.ca. For tax-related identity theft, the CRA’s identity protection line is 1-833-995-2336 and protections can be placed during the call. For questions about your SIN record itself, Service Canada is at 1-866-274-6627.
How do I check if my SIN was in a data breach?
SINs themselves aren’t searchable in public breach databases. What you can check is whether your email address appeared in a breach that also leaked SINs or national IDs. NotchUp Shield checks your email against verified breach datasets for free, and our list of Canadian data breaches shows exactly what data types each breach exposed.
Is a leaked SIN more dangerous than a leaked password?
Yes, because you can’t change it. A leaked password is a one-afternoon fix: change it everywhere you used it and turn on two-factor authentication. A leaked SIN connects to your taxes, employment record, and government benefits for life, and it can be used to open credit accounts, file fraudulent tax returns, and redirect benefit payments. The protections are different too: fraud alerts and credit monitoring instead of just a password reset.
Does filing taxes early protect me from SIN fraud?
Yes. One common SIN fraud tactic is filing a fraudulent tax return in your name to collect your refund. If you’ve already filed, the CRA flags the second return as suspicious. Filing promptly each year is one of the simplest protections against this specific type of fraud, and the CRA identity protection line (1-833-995-2336) can add extra flags to your tax account.
This article is for informational purposes only and does not constitute professional legal, financial, or cybersecurity advice. If you believe you’re a victim of identity theft or SIN fraud, contact your local police, the Canadian Anti-Fraud Centre at 1-888-495-8501, and the CRA identity protection line at 1-833-995-2336.
Related Reading
- Notable Canadian Data Breaches: The Running List
- How to Get Your Credit Report Free in Canada
- Credit Card in a Data Breach? Do This First
- Is That Data Breach Email Real or a Scam?
Monitoring only works if you know what leaked and where. You can check your own email address against roughly a thousand verified breaches free, with no account, at NotchUp Shield, and see which exposures actually involve identity data.
Breach data referenced from Have I Been Pwned, licensed CC BY 4.0.
