I’m 55, my SIN was found on the dark web and no one will help me — what Canadians with RRSPs at stake should do immediately

A scenario like this reflects a growing problem: Financial institutions are increasingly offering dark-web monitoring as a safety feature, but don't follow up with support to customers whose SIN has been circulating on the darknet. For Canadians with a hard-earned nest egg waiting for them as they approach retirement, the stakes couldn't be higher.

Here's how to assess the potential risk and what steps to take if this happens to you.

How serious is a dark web SIN alert?

Finding your SIN on the dark web doesn't automatically mean it's being misused. Large-scale data breaches often mean personal information is bundled and sold in bulk, where it may sit unused for months or years. But the risk of it falling into the wrong hands is still very real.

A 2025 analysis by U.S.-based fraud-intelligence firm SentiLink found that 97% of people whose full personal information appeared on the dark web experienced attempted identity theft (1). The word "attempted" is critical because it means there's still time to prevent becoming a fraud victim.

In Canada, the Office of the Privacy Commissioner of Canada (OPC) tracks mandatory data breach reports under the Personal Information Protection and Electronic Documents Act (PIPEDA). The OPC has consistently flagged identity theft as one of the most harmful outcomes of a breach. Your SIN is one of the most sensitive pieces of personal information out there — and it's exactly the kind of data that ends up in the wrong hands when it isn't monitored (2).

In the event of an alert like this, the main priority is limiting what someone else can do with your identity.

The first line of defence: Put alerts on your credit file

One of the most effective actions Canadians can take is beefing up the protection on their credit file, as restricting access to it makes it much harder for fraudsters to open new accounts in your name.

In Canada, you can get credit protection through the two major credit bureaus: Equifax Canada and TransUnion Canada. They both allow consumers to request a fraud alert through their websites or by calling their fraud departments. Equifax also offers an identity alert, which stays on your Equifax credit report for six years (3). TransUnion Canada only offers a credit lock to residents in Québec (4). Contact both for current procedures and any applicable fees.

Protect your SIN account

Your SIN is administered by Employment and Social Development Canada (ESDC). If you believe it's been compromised, ESDC recommends contacting Service Canada directly and, in serious cases, filing a report with the Canadian Anti-Fraud Centre (CAFC) (5).

The CAFC — operated jointly with the RCMP, the Competition Bureau Canada and the Ontario Provincial Police (OPP) — is Canada's central agency for reporting fraud and identity theft. Filing a report with the CAFC creates an official record, which can be critical if problems arise later (6).

Also, log in to your My Service Canada Account to review your SIN-linked records, including your Canada Pension Plan (CPP) contribution history and employment record. Both of these can be affected if someone fraudulently uses your SIN.

Expanding your defences

Once you have the basics covered, there are a few more steps you can take to protect yourself against specific types of SIN-related fraud.

Tax fraud

Tax identity fraud — where someone files a fake return under your SIN — is a serious and growing concern. The Canada Revenue Agency (CRA) recommends registering for and monitoring your CRA My Account for any unfamiliar tax filings or refund requests made under your name. If you suspect someone is using our SIN for this type of scam, contact the CRA's security and identity protection team. The CRA can flag your account, which means you'll need to provide additional verification before you process your next return (7).

Employment fraud

If you suspect someone is using your SIN for employment purposes, report this to Service Canada and to the CAFC immediately. Fraudulent employment under your SIN could affect your CPP contribution record and, ultimately, your retirement benefit (8).

Free credit report review

Canadians are entitled to a free credit report from both Equifax Canada and TransUnion Canada. Reviewing these reports regularly — particularly after receiving a dark-web alert — helps you check for unfamiliar activity, credit inquiries or address changes that could indicate your SIN has fallen into the wrong hands.

Why this matters more near retirement

If you're in your 50s, someone misusing your SIN misuse can cause a lot more damage than just a fraudulent loan or credit card application.

A fraudulent tax return could trigger a CRA review, delay your refund or create complications with your RRSP or Tax-Free Savings Account (TFSA) contributions — errors that can take months or years to untangle.