Protecting yourself from identity theft online (ITSAP.00.033)

Phishing

A scammer calls, texts, or emails you, or uses social media to trick you into clicking a malicious link, downloading malware, or sharing sensitive information.

Social engineering

A scammer uses a more personalized phishing attack to target you specifically. Social engineering attacks often include personal details about you or your organization to trick you into sharing further personal details.

Deepfakes

A threat actor uses synthetic media (e.g. video, audio, photos) to impersonate you or your organization, as a form of authentication (e.g. biometrics) or misrepresentation, to steal sensitive information or spread misinformation.

Third-party data breaches

Your vendor’s network and sensitive data is compromised by threat actors. External networks and information (e.g. client data, credentials) handled by the compromised vendor are at risk. Compromised credentials may be used to access other accounts, further spreading the attack.

Protect your identity

To protect your digital identity, you should implement security best practices, such as the following:

Use Wi-Fi securely

Secure your Wi-Fi network by changing the default network name (SSID) and password that came with your router and account. Avoid using public Wi-Fi networks, especially if sending sensitive information or logging into sensitive accounts. If you must use a public Wi Fi network, use a virtual private network (VPN) to protect sensitive information.

Use security tools and software

Install a firewall to filter and block malicious traffic, protecting your network from external threats. Install anti-virus software to scan your devices for malware and anti-phishing software to block phishing content. Ensure to update all software and applications regularly.

Secure your accounts

Use strong passwords and passphrases with multi-factor authentication (MFA) to secure all accounts. MFA adds a layer of security by protecting your account if your password is compromised.

Keep personal social media accounts private to restrict those who can see what you share (e.g. reduce the risks of deepfakes). For business social media accounts, remind employees who manage the accounts to be cautious about the information they are posting.

Share wisely

Before signing up for services and accounts, you may want to research who you are sharing data with. Review company privacy policies to find out how third parties handle your personal information.

If you get an unsolicited request, think twice before sharing personal information. Don’t click on links included in text or email messages. Verify the identity of the person or company asking for this information and the legitimacy of the request. When in doubt, contact the company (e.g. your bank) by using the contact information posted on the official website.

Manage and monitor accounts

Review your accounts regularly and monitor financial accounts for suspicious activity. If you no longer use an account (e.g. online shopping account), be sure to remove any personal information and delete the account.

Address identity theft

If your digital identity has been compromised, take immediate action:

1. Report the incident to the account source, as well as other associated or connected accounts (e.g. login through partnered sources).
2. Determine which information could be affected (e.g. financial information, social insurance number).
3. Change passwords and security questions on all accounts that are related to the compromised account (e.g. partnered accounts, emails) or that use the same password.
4. Use Equifax and TransUnion to analyze your credit report and enable alerts to notify you of unauthorized inquiries.
5. Report your incident to the Canadian Anti-Fraud Centre online or at 1 888-495-8501.
6. Notify law enforcement of the incident.
7. Report organizational identity theft activity to the Cyber Centre (contact@cyber.gc.ca).