Experts say current protections offered by Equifax and TransUnion are ‘ineffective’
There’s no shortage of ways for thieves to steal your identity. From data breaches to phone scams seeking to collect your information to sell on the black market, it could happen to anyone.
But as some 27,000 Canadians report being victims of identity theft every year — a number that the Canadian Anti-Fraud Centre says is vastly underreported — a Marketplace investigation reveals Canada is doing little to match the strength of protections offered in the U.S.
Marketplace began looking into identity theft protections after receiving a leaked database of nearly 3,000 Canadians who fell victim to a low-interest credit card scam operating out of one overseas call centre.
As part of its research, Marketplace tested two services offered to identity-theft victims by Canada’s two credit-reporting bureaus, Equifax and TransUnion, and learned that they won’t necessarily prevent the risk of fraud.
Credit monitoring: ‘It’s a flaw in the system’
The top advertised product for both Equifax and TransUnion is credit monitoring — a service that costs between $11.95 and $29.95 a month, depending on the plan.
Marketplace tested each bureau’s recommended plan, at $19.95 a month, by having two producers sign up with both companies. Call-centre staff for the companies said that with these products, clients can expect an email notification whenever “key changes” occur to their credit reports, including any inquiries or new accounts opened.
The two producers then applied for six different credit cards — three apiece — with major banks across Canada. As each bank made inquiries into the producers’ files, an email notification was only received from one credit bureau — never both — and always one day after the application was submitted.
Equifax and TransUnion both declined requests for an on-camera interview, but each credit bureau told Marketplace through email that financial institutions typically pull credit reports from only one bureau.
This means that in order to ensure consumers are getting a full picture of their credit reports, they would need to sign up for monitoring with both bureaus, at a cost of nearly $500 a year.
“Definitely it’s a flaw in the system,” said Claudiu Popa, a cybersecurity expert and author of The Canadian Cyberfraud Handbook. “No amount of monitoring will give you 100 per cent guarantee that you’re going to be protected against identity theft.”
Even if a consumer does cough up the hundreds of dollars each year, Popa says credit monitoring won’t do anything to prevent identity theft.
“It’s a reactive system,” he said. “In many cases, these provide nothing more than a false sense of security.”
Fraud alerts: ‘They definitely didn’t protect me’
When Robert Darch had his wallet stolen, the North Vancouver man knew one of the first things to do was to alert both credit bureaus.
“I thought I was doing the proper due diligence that one needs to do when you have your ID stolen or your wallet stolen,” said Darch.
He says both Equifax and TransUnion placed a fraud alert on his account, which triggers a notice on someone’s credit report, saying they may have been a victim of identity theft.
Legislation in Ontario, Manitoba and New Brunswick says that if a fraud alert is placed on someone’s credit file, a lender must take reasonable steps to verify someone’s identity before a new account can be opened. All other provinces and territories have no legislation around fraud alerts.
With these alerts in place, Darch said he expected someone would call him if there was suspicious activity on his file. “I thought once you notify Equifax, once you notify TransUnion, there’s like a firewall in place and you are protected,” he said.
It wasn’t until CTV News knocked on his door, wanting to know why he was selling illegitimate phones on Craigslist, that he realized the fraud alerts hadn’t worked.
Someone using Darch’s identity had managed to open two phone accounts with his personal information, and was selling the phones online under Darch’s name.
While Darch was able to quickly clarify the situation with the news crew, he was left concerned that the protection offered by the credit bureaus didn’t work.
“I definitely wasn’t covered, wasn’t protected.”
Marketplace‘s producers also placed fraud alerts on their accounts in Ontario, where specific legislation exists. And while no credit cards were approved, producers only received phone calls to verify their identity three times out of five.
“I don’t think they have any teeth,” said Darch about fraud alerts. “I don’t think that they are going to protect Canadians. They definitely didn’t protect me.”
Both Equifax and TransUnion told Marketplace through statements that it is up to the lending organization to take steps to verify the identity of the applicant.
Equifax added: “We believe it would be a mistake to discourage consumers from signing up for fraud alerts. We believe fraud alerts are an effective way to help identify fraudulent activity and help better protect consumers against identity theft.”
Canada behind in identity theft protections
Several experts Marketplace spoke with agree one of the best ways to safeguard against identity theft is a credit freeze, which gives the consumer control of their credit by allowing them to lock their file.
Even the consumer won’t be able to access any credit until they unlock the freeze. As a result, potential lenders and fraudsters can’t open new accounts or even inquire about their credit.
The product is offered for free by Equifax and TransUnion in the U.S. by law — but it’s not available in Canada.
“Canadians have the right to know what’s happening with their personal information,” said Popa. “There’s absolutely no reason those same companies should not be offering credit freezes in Canada.”
The U.S. law to mandate free credit freezes passed in May 2018 after a public outcry following the 2017 Equifax data breach, though paid credit freezes had already been available there for more than a decade.
“In Canada, we have yet to catch up,” said Popa, who would like to see credit freezes applied by default and for free.
When asked why Equifax doesn’t offer credit freezes to Canadians, the company said: “We are monitoring recent changes made to this service in the United States to see how consumers are responding to changes in the lock/freeze capability, as well as changing Canadian consumer needs in order to create the solutions which best meet those needs.”
In a previous statement, Equifax told Marketplace that “unless it is an industry-wide requirement, it would present a false sense of security to consumers.”
TransUnion did not respond to questions about why it doesn’t offer credit freezes in Canada.
Lenders and creditors pay credit agencies to access customer credit reports. But major banks in the U.S. told Marketplace that if a customer has a credit freeze, they can’t access the data and don’t have to pay.
Darch believed a credit freeze would have saved him a lot of hassle and embarrassment.
“I don’t see a good reason why we can’t have that in our country,” he said. “And I really wish that would be fast-tracked into place, so other people don’t have the misfortune that I’ve had.”
Ontario credit freeze law in limbo
In Canada, provincial and territorial governments have the power to mandate that Equifax and TransUnion provide credit freezes for Canadians. Marketplace reached out to all 13 provinces and territories, and none have plans to introduce new legislation around the issue.
But Ontario has come close.
Just before 2018’s provincial election, the Wynne government had passed legislation that would have forced TransUnion and Equifax to offer free credit freezes to Ontarians. Bill 8, the Access to Consumer Credit Reports and Elevator Availability Act, received royal assent, but the Liberals were voted out of power before the law became active.
The current Conservative government has told Marketplace there are no plans to finalize the legislation.
While still in Opposition, Consumer Services Minister Bill Walker told the Legislature that he supported credit freezes during an April 2018 reading of the bill. “We have to have the ability to protect our information and know what’s being used or what’s being given to people out there,” he said at the time.
But after more than seven months in office, there are still no plans to push the law forward.
After Marketplace reached out to the minister’s office multiple times, it released a statement attributed to Walker that said the issue of consumer protection is on its department’s radar.
“Consumer protection, as well as ensuring consumers know they can trust the government to implement effective rules, is our top priority.”
When Marketplace approached Walker at a public event for further clarification, he responded: “I will commit to you that I will go and look at it.”
According to Popa, the issue is one that requires government intervention.
“When it comes to credit-monitoring bureaus, we cannot trust them to give us 100 per cent visibility into the risk of identity theft,” he said. “Canadians have the right to know what’s happening with their personal information.”
