Protect your identity during a loan application
To protect your identity during a loan application, you need to control who receives your identification, your Social Insurance Number and your banking details, and why. A loan form asks for exactly the information that identity thieves want, which is why the weak points are the forms, uploads, links and phone calls rather than the loan itself.
What is at stake
With a name, date of birth, address and SIN, a criminal may open accounts, apply for loans or redirect mail in your name. With online banking access, they can empty an account. The damage often appears months later as unfamiliar accounts on a credit report or collection letters for debts you never took.
Legitimate lenders also need data
Applying for credit does require you to share some information. The goal is not to refuse everything, but to share what a verified business reasonably needs, through secure channels, and to keep a record of where it went.
What lenders may ask for and what to question
Typical requests include proof of identity, address and income, and details of a bank account for deposit and repayment. Treat each as a separate decision.
Common requests
- Government photo identification, such as a driver's licence or passport.
- A document that confirms where you live, for example a recent hydro or water bill.
- Pay stubs, tax documents or benefit statements.
- A void cheque or direct deposit form.
- Your Social Insurance Number, for identity matching and credit reporting.
Ask before you hand over
Ask the lender why each item is needed, how it will be stored and when it will be deleted. If you cannot get a clear answer, that is a reason to look elsewhere. Canada's federal privacy law for private-sector organizations sets out principles of fair information handling and is enforced through complaints and investigations, so you can ask a business about its practices.
Paper, email or portal
A secure upload portal is generally safer than an attachment sent by regular email, because email can be forwarded, intercepted or left in an inbox for years. If a lender asks you to send a photograph of your licence by text message, ask for a secure alternative or an in-person visit. If only an unsecured route exists, weigh that against how much you need the loan.
Provide the minimum, in the safest form
If a form works without your SIN, ask whether it can be skipped for the initial quote. Cover or blur parts of documents that are not needed, such as a second address on a utility bill, when the lender allows it.
Sharing bank information safely
Many online lenders verify income through a service that connects to your bank account and reads recent transactions. The convenience is real, but it gives a third party wide visibility into your finances.
Before you connect an account
- Read the consent screen to see exactly what data is collected and for how long.
- Check that the web address is the lender's and that the page is secure.
- Never share your online banking password by phone, text or email.
- Ask whether a void cheque and pay stubs would work instead.
- Review your bank's list of linked services afterward and remove any you no longer need.
Pre-authorized debits
Providing a void cheque lets a lender withdraw payments. Make sure the amounts and dates match the contract, and know how to cancel authorization with your bank if a lender withdraws more than agreed.
Illustrative example
A borrower applies for a $1,800 loan and connects a bank account through an online tool. Two weeks later, he notices a monthly $19.99 charge from an unfamiliar company. It was a subscription he had agreed to in the fine print. He cancels it, asks his bank to review the authorization and checks his other accounts. The example is made up, but it shows why reading the screens matters.
Spotting fake lenders and phishing
Fraudsters imitate lenders to harvest identification and passwords. They use convincing emails, texts and websites.
Typical tricks
- A text claims your loan is approved and asks you to click a link to confirm your details.
- An email imitates a bank and asks you to verify your account.
- A caller says your application needs a fee or a security deposit.
- A website looks like a known lender but has a different address.
Defences that work
- Type the lender's address yourself instead of clicking links.
- Check the sender's real address and the spelling of the domain.
- Hang up and call back using a number you found independently.
- Use strong, unique passwords and turn on two-step verification where offered.
- Keep your devices and apps updated.
Look at the pressure, not just the page
Phishing works because it hurries you. Messages that say an offer ends today or that your account will be closed unless you respond are designed to prevent you from checking. Take a few minutes, verify through an independent channel and only then decide whether to continue.
Unsolicited approvals
If you never applied, you were never approved. A message that begins with congratulations for a loan you did not request is a phishing attempt until proven otherwise.
Monitor your file after you apply
Applications leave traces. A lender inquiry may appear on your credit report for up to three years at Equifax or six at TransUnion, and the accounts opened under your name show there too. Checking your report soon after applying and again a few months later helps you spot anything unexpected.
Free tools
Equifax and TransUnion let you view your report online without charge, and checking your own file does not affect your score. TransUnion's online service lets you add alerts, and Equifax lists credit alert tools on its consumer page, though some are paid products. Compare what is free with what is subscription-based.
What to look for
- Accounts you did not open.
- Inquiries from lenders you did not contact.
- Address or employer changes you did not make.
- Collection notices for unknown debts.
Keep records
Keep a simple list of the lenders you applied to, the dates and the documents you provided. If a problem emerges later, the list helps you trace its source.
Storing and disposing of documents
The risk does not end when the loan is approved. Papers and files linger in drawers, inboxes and phone galleries.
Good habits
- Keep copies of loan documents in a secure folder, not in your general photo gallery.
- Shred paper with your SIN, account numbers or signature before disposal.
- Delete emailed attachments you no longer need.
- Lock your phone and computer, and avoid public wifi for applications.
- Collect mail promptly, and ask the post office to hold or forward it when you travel.
When you close an application
If you decide not to proceed, tell the lender in writing and ask it to delete your documents where it is allowed to. The business may have to retain some records for legal reasons, but you can ask what it keeps and for how long.
If something goes wrong
Contact the lender, your bank and both credit bureaus, and report identity theft to the police and the Canadian Anti-Fraud Centre. Quick action limits damage. If the cost of the problem is straining your budget, a non-profit credit counsellor can help you plan, and 2-1-1 can point you to local assistance.