September 19, 2017 12:58 pm

Equifax hack: When to give out your Social Insurance Number (it’s less often than you might think)

The credit report company Equifax today revealed it was targeted by a major cyber-attack earlier this year. Equifax says hackers may have stolen personal information -- including social security and credit card numbers -- from as many as 143 million customers.


The recent disclosure of a massive data breach at Equifax, a credit monitoring firm, has highlighted a vital issue for Canadians – when, and to whom, is someone actually required to divulge their Social Insurance Number?

Story continues below

In the wrong hands, the confidential number can lead to identity theft and fraud leaving the SIN’s rightful owner on the hook for additional taxes, interest payments and debt, and ruin a credit rating or result in lost government benefits and tax refunds –to name just a few potential consequences.

READ MORE: Equifax hack may have exposed 100,000 Canadians’ personal info

After almost two weeks of near silence on the hack, Equifax on Tuesday said approximately 100,000 Canadian consumers may have had their personal information compromised.

The credit data company had been tight-lipped about any effects the breach had on Canadians, offering little in terms of concrete information on the data breach discovered almost two months ago but only made public within the past two weeks.

WATCH: Equifax reportedly knew for months about cyber-security vulnerability

“Only a limited number of Canadians may have been affected. We are working to find out how many,” the credit monitoring firm’s site says.

“At this point, it seems the personal information that may have been breached includes name and address and Social Insurance Number.”

Equifax has committed to contacting any potentially affected Canadians, in writing, as soon as possible, and provide them with free credit monitoring – a service offered to its American customers immediately after announcing the breach on Sept. 7.

Meanwhile, the company is facing investigations in both Canada and the U.S.

WATCH: Massive cyber-attack at Equifax could leave millions vulnerable

When to give out your SIN

Did Equifax require the Social Insurance Numbers of the affected Canadians? Not necessarily, but they did nothing wrong in asking for and collecting them.

Lots of people – in fact, anyone – can ask for your Social Insurance Number. Perhaps a landlord, potential employer or utility company has asked for it in the past.

But only a few people and institutions are actually required to collect it.

READ MORE: Canada’s privacy watchdog opens up probe into Equifax hack

“Although only specific government departments and programs are required to collect and use the SIN, there is no legislation that prevents private sector organizations from requesting it,” the federal government wrote in its Social Insurance Number Code of Practice.

“Except with required-for government programs and services, it is your decision when to share your SIN information and with whom.”

According to the federal government, which issues Social Insurance Numbers, the average Canadian uses their SIN to:

  • Obtain employment
  • Pay into and receive benefits from certain federal and provincial programs such as the Canadian Pension Plan, Old Age Security, Quebec Pension Plan, child care benefits and veterans’ benefits
  • Pay income tax and receive income tax refunds

Additionally, any financial institution with which an individual holds an interest-bearing account (investments, for example), needs a SIN on record in order to fulfil its obligation to report earnings to the government.

WATCH: Yahoo data breach of 1 billion users largest in history

When to not give out your SIN

Though “strongly discouraged,” there is nothing illegal about a private-sector organization asking for someone’s SIN, according to Employment and Social Development Canada.

Some examples of when a private institution might ask for (but doesn’t require) a SIN include: during a job application, on a rental or credit card application, while getting a mortgage approval or line of credit, on any medical questionnaires, on college or university applications, when subscribing for cellphone services, and when writing a will.

READ MORE: Tips for Canadians whose info may have been affected in Equifax hack

In each of the situations above, it is an individual’s choice whether to provide a SIN because none of those institutions or individuals legally require it. The safer thing to do, however, is to explain you’d rather not provide it, and offer a different proof of identity, according to the federal government.

“If the organization refuses to provide the product or service unless you provide your SIN, ask to speak to the person in charge,” according to Employment and Social Development Canada.

“Many organizations don’t know about the appropriate uses of the SIN. Once they understand, they may willingly change their practices.”

Tips from Service Canada

Here are some more tips from the federal government on protecting your Social Insurance Number and, in the process, protecting yourself from potential fraud.

  • Never provide your SIN over the phone unless you made the call and are confident you know who’s on the other end.
  • Never reply to emails asking for personal information such as your SIN.
  • Shred paper records on which your SIN is recorded once you no longer need them.

— With files from the Canadian Press

© 2017 Global News, a division of Corus Entertainment Inc.

Report an error


Want to discuss? Please read our Commenting Policy first.