(The Montreal Gazette published today this piece I sent them.)

On June 20, 2019, millions of Desjardins customers learned that their personal data had been leaked in one of the largest incidents of this type to ever happen in Canada. They joined the increasing ranks of Canadians who have seen their information leaked. In its 2021-2022 annual report, the Office of the Privacy Commissioner of Canada informed of 645 breach reports, “affecting at least 1.9 million Canadian accounts.” These are only the breaches we know about; the actual situation is likely worse than that. A recent survey revealed that 74 per cent of responding businesses didn’t report a cyber security incident after it was discovered.

The people most affected by these leaks, the ones who saw their most sensitive data getting out (name, address, birth date and social insurance number), must be on the lookout for identity theft forever. With that information on hand, criminals can impersonate them, get a new car, phone or credit line, and the victims will have to scramble to prove, in a perverse inversion of the burden of proof, that they didn’t open those accounts. It can happen next week, next month or 10 years from now. In its 2021 report, the Canadian Anti-Fraud Centre reported 29,500 cases of identity theft, an increase of 45 per cent over the previous year.

Official guides to protect yourself against identity theft (CRA, Canadian Anti-Fraud Centre) emphasize personal measures: shred your mail, don’t give away personal information, use strong passwords. However, no matter what you do at the personal level (and you should still do it), your data is not yours anymore. It will keep jumping from company to database to report and every time it gets copied the probability that it will get leaked only increases. It doesn’t need to be digital: your data can be stolen from your mailbox, or from the tax receipt you threw away without shredding. And once it’s out there, there’s no going back; you can’t unscramble an omelet.

Once we accept that we have little control over our data, it is wise to establish a second line of defence downstream. The two main credit bureaus, Equifax and TransUnion, offer their customers credit monitoring services and will send them alerts if something changes in their file. It’s a reactive solution, and not a very good one at that; it may take up to 30 days for a notification to get sent.

A better tool arrived at the United States starting in 2003 in California, and later legislated federally in the Economic Growth, Regulatory Relief, and Consumer Protection Act: the credit freeze. It enables U.S. citizens to lock their credit files. This means that their file can’t be accessed and no new credit accounts can be opened unless the freeze is removed or temporarily lifted, in case that person is really applying for new credit. As opposed to monitoring services, it’s a proactive approach: it gets triggered before the damage is done.

Here in Canada we’ve had to wait almost 20 years, but credit freezes are finally arriving, though only in Quebec, thanks to the Credit Assessment Agents Act, passed in October 2020. As of Feb. 1 this year, Quebec residents are to be able to place security freezes with the credit bureaus. So if you are not currently shopping around for new credit, put aside a couple of hours, contact Equifax and TransUnion and freeze your file for free. You don’t know who might be trying to do something nefarious with your data until they do.

Those in the rest of Canada? Today is a day as good as any other to contact their elected representatives, to ask them to enact similar legislation.

The CBC reports:

Like recent case Toronto police are investigating, fraudster impersonated homeowner

[...] the family found out that someone posing as the 95-year-old homeowner had hired two different real estate agents from another Royal LePage brokerage to list the house for sale without the family's knowledge or permission. 

The CBC ran some checks that should have raised important red flags:

When screening the two potential tenants, the agents collected photocopies of their driver's licences, contact information for their employers and personal references, and credit history checks.

The companies listed as employers had very little online presence, including no website.

When CBC called the phone numbers, those given for the employers were out of service, as was one of the personal references. The second personal reference appeared to be a wrong number.

CBC News also ran the three driver's licence numbers through the Ontario government's free driver's licence check tool. The two licences provided by the tenants on their lease application came up as "not found," [...]

Read the full article.

Equifax published on August 2022 a webinar with very interesting details about the Credit Assessment Agents Act (Bill 53) and how the new credit freezes it brings will affect Equifax and related stakeholders.

The webinar can be seen here.

Please note that some information on the webinar contradicts what's published by Equifax with implementation notes regarding Bill 53, specifically the part regarding costs to the consumer:

No, Equifax will not charge consumers to lock, suspend the lock, or unlock their credit file.

The webinar mentions that there will be a cost for placing the freeze (not for suspending or removing it.) The information on the webpage linked above is more current, however, as the last update happened on 2022-11-22, a few months after the webinar took place.