Identity Theft
Canadian identity theft law has two main offences: identity theft under section 402.2 of the Criminal Code (obtaining or possessing another person's identity information with intent to use it to commit an indictable offence involving fraud, deceit, or falsehood); and identity fraud under section 403 (fraudulently personating another person, living or dead). Both offences were added by Bill S-4 (2009) to modernize the Criminal Code's response to identity crime.
Mass Tsang's criminal lawyers handle identity theft and identity fraud files alongside the often-co-charged fraud and forgery offences. For more, see our blog post on identity theft charges in Ontario.
Identity theft — section 402.2
Section 402.2 criminalizes obtaining or possessing another person's identity information in circumstances giving rise to a reasonable inference that the information is intended to be used to commit an indictable offence involving fraud, deceit, or falsehood. The offence captures preparatory conduct — having someone's information with the intent to misuse it — without requiring the fraud itself to be completed. Maximum penalty on indictment is 5 years.
Identity fraud — section 403
Section 403 criminalizes fraudulently personating another person with intent to gain advantage, obtain property, or cause disadvantage. The offence is hybrid: summary maximum 2 years less a day; indictable maximum 10 years. Personation can take many forms — using someone's name in a transaction, providing their identifiers to police, or using their credentials to obtain credit or benefits.
Identity information
Section 402.1 defines "identity information" broadly: any information of a type that is commonly used to identify an individual, including biographical and biometric information. The definition captures name, address, date of birth, Social Insurance Number, driver's licence and passport numbers, credit and debit card information, signatures, fingerprints, voice prints, retinal images, and DNA profiles.
Common scenarios
Identity-theft cases typically involve: stolen mail and document discarding (dumpster diving); phishing and other digital schemes; large-scale data breaches and the resale of stolen personal data; targeted theft from individuals (often during home invasions or break-and-enters); insider theft from financial or government institutions; and synthetic-identity schemes that combine real and fabricated information.
Defences
Defences include: lack of intent (genuine possession of identity information for innocent purposes — a person holds an old roommate's records, for example); lack of knowledge that the information belonged to another; identification challenges; and Charter issues with searches and digital extractions. Identity crime cases often involve voluminous disclosure — bank records, transaction logs, surveillance video — and detailed defence review is essential.
Related glossary terms
