"There's a problem with your file, and I need to confirm your Social Insurance Number before the account is suspended." You gave all nine digits. Then you hung up, and your stomach dropped.
First, the part nobody says out loud: this happens to careful people. The callers practise the pressure for a living, and a threat that sounds official can make anyone answer on reflex. Feeling foolish is normal. It is also not a plan, so here is one.
Our take: the SIN by itself is rarely the emergency. What you need to figure out in the first hour is what else you said and whether any money moved. Most of the standard advice treats every case the same and sends you everywhere at once. Triage works better. Start with whatever can still be stopped, which is money, and work down from there.
Step zero: work out what the caller actually got
Before you call anyone, write down what you shared. It takes two minutes and decides the rest of the day. Use this table.
| What you gave or did | What it puts at risk | Do first |
|---|---|---|
| Sent money (Interac e-Transfer, cryptocurrency, gift cards, cash) | That money, right now | Call your bank or card issuer using the number on the back of your card |
| Gave banking details, card numbers or online banking sign-in | Your accounts | Call your financial institution, change your sign-in details |
| Gave your SIN plus name, date of birth or address | Your identity and credit file | Check your credit reports and consider a fraud alert |
| Gave your SIN only | Lower, but not zero | Credit check, then watch for CRA and bank changes |
| Clicked a link or installed an app | Your phone and accounts | Treat it as a banking-details case |
The first 24 hours, in order
- Stop the money. If you sent anything or shared banking details, call your bank or card issuer first, at the number printed on the back of your card, not one the caller gave you. Say plainly that you were the target of a phone fraud and ask what they can freeze or flag. Every other step on this list can wait an hour. This one cannot.
- Stop talking to the caller. Don't call back, don't answer a follow-up text and don't "just ask one more question". The CRA lists recovery scams, aimed at people who already lost money, among its scam examples, so a second story is a real possibility.
- Pull your credit reports. Service Canada's page on SIN fraud and data breaches tells you to request your reports from TransUnion Canada and Equifax Canada and look for accounts you didn't open and inquiries you didn't make. It notes a fee may apply. It also suggests considering a fraud alert on your credit files, which asks creditors to contact you before opening new accounts. Equifax Canada is 1-800-465-7166 and TransUnion Canada is 1-800-663-9980, as listed on that Service Canada page.
- Secure your CRA account. If the call was dressed up as the CRA, or if you shared enough for someone to try your tax account, tell the CRA. Its report-a-scam page offers an online form, a phone line for personal accounts at 1-833-995-2336 (Monday to Friday, 8 a.m. to 4 p.m. local time) and a fax option. It says protections can be placed during the call, and that you can ask the CRA to disable online access if you see suspicious activity.
- Report it to the Canadian Anti-Fraud Centre. Use the online Report Cybercrime and Fraud system or call 1-888-495-8501. The CRA's own guidance says to report to the CRA first, then to the CAFC, and to report even if the caller got none of your personal information.
- Call your local police. Both the CAFC and the RCMP say victims should also contact local police. For identity theft, Service Canada says a police report should include your name and your SIN (the full number or the last three digits), and you should ask for a case reference number and a copy of the report.
Our ranking: what matters most and what is theatre
The honest answer is that the order above is a ranking, not just a sequence. In our view:
- Number one is money. A SIN is a long-term risk. A sent e-Transfer or a drained account is a loss that is happening now, and your bank can only act on what you tell it quickly.
- Number two is your credit file. The reports are the only way to see whether your SIN has already been used. Until you look, you are guessing.
- Number three is the CRA account. It matters because a SIN plus personal details can be a way into tax and benefit records. It is a precaution, not a sign that something has happened.
- The reports to the CAFC and police are important but slow. They create a record, which helps if you later need to prove you were a victim. They will not get your money back by tomorrow, so don't let them delay steps one to three.
What is theatre? Spending the evening hunting for the caller's number to look it up, changing every password you own before you have called the bank, or drafting an angry text to a number that will never read it.
Should you ask for a new SIN?
The instinct is understandable: if the number is burned, replace it. Here's the thing - the government does not see it that way. The Service Canada SIN program says a new SIN may be issued only with proof that your current one was used for fraud, and its own page does not recommend getting one. It warns that having multiple SINs can increase fraud risk, and that a new SIN does not erase or protect the old one. You also remain responsible for the old number and may have to prove you weren't involved if it is misused.
The same page says you do not have to report suspected SIN fraud or a data breach to the SIN program itself. So the realistic plan after sharing your SIN is monitoring and, if you choose, a fraud alert, not replacement. A new SIN becomes a conversation only if someone has actually used the old one, and then you'll need the police report and creditor letters to apply.
The week after: a short watch list
- Review bank and credit card statements for charges you don't recognize, and watch your mail for opened envelopes or missing financial statements, as Service Canada advises.
- Look for CRA or Service Canada notices about changes you didn't make. If your SIN is being misused, the CRA lists Service Canada's line as 1-866-274-6627.
- Expect more calls. Treat any follow-up about "your file" as the same script, and see how a CRA scam voicemail is built to spot it quickly.
- Don't pay anyone who offers to "fix" the problem or recover your money for a fee. The CRA lists recovery scams as a known pattern.
This is general information based on what the Government of Canada and the CRA publish, not legal or financial advice. Your bank, the credit bureaus and the police can tell you what applies to your case.
Questions people ask next
Is giving my SIN over the phone always a mistake?
Not always, but Service Canada says to never provide your SIN by phone unless you made the call and know it is legally required. If the caller started the conversation, treat the request itself as the red flag.
I only gave the last few digits. Does that count?
It is less than the whole number, but treat it as a partial exposure. You can follow the same steps with less urgency: check your credit reports, review statements and report the call. The CRA says to report even when the caller got none of your personal information.
Who do I tell first if I didn't send money?
The credit bureaus and your CRA account come first, then the CAFC. If you are not sure how reporting works in practice, our guide to reporting a scam phone call covers the options.
The bottom line
Sharing your SIN is a problem to manage, not a verdict. Spend the first hour on what can still be stopped, which is your money, then look at your credit, secure your Canada Revenue Agency account and file your reports. Don't chase a new SIN, because the official guidance points toward monitoring instead.