If your SIN was stolen in the Capital One breach, getting a new one isn’t easy

Editor’s note: This story has been updated to reflect that credit freezes are available in the U.S. but not in Canada.

A recent Capital One breach that impacted more than six million Canadian accounts also compromised one million social insurance numbers (SIN).

In addition to six million Canadians, 100 million people in the United States were also impacted by the hack.

Additional information stolen included names, addresses, phone numbers, postal codes, email addresses and self-reported income. According to the company, the data stolen in the hack was largely linked to consumers and small businesses that applied for Capital One credit card products between 2005 and 2019.

The company said it’s “unlikely that the information was used for fraud or disseminated.”

If your SIN is stolen, however, it can allow hackers to fill out credit card applications or make large credit purchases in your name, such as applying for a mortgage or a car loan.

What’s more, Daveed Gartenstein-Ross, a counter-terrorism scholar and CEO of Valens Global, says that unlike credit card fraud, a compromised SIN is often harder for consumers to detect and address.

Here’s how to determine whether your SIN is compromised and what to do about it.

How do you know if my SIN has been stolen?

While credit card fraud will often present itself as a number of repetitive, smaller purchases on your monthly credit statements, the primary way to discover your SIN has been compromised is to request and review your credit report.

By doing this, consumers can see clearly which accounts are currently open under their name, and report this activity to the credit bureaus, Equifax or TransUnion, quickly.

“The danger in having a SIN stolen is that it’s used as a basic ID for you across a range of things that you do. A SIN can be used in government to unlock information and get further information to enable identity theft,” Gartenstein-Ross explained.

WATCH: Capital One banking breach compromises data of over 100 million people

2:05 Capital One banking breach compromises data of over 100 million people

“Other things your data is being used for are applications for credit cards or applications for loans,” he added.

Jeff Thomson, a senior RCMP intelligence analyst with the Canadian Anti-Fraud Centre, says individuals who still receive their credit card statements by mail should take note if these statements stop coming.

So you think your SIN has been compromised. Now what?

Once you’ve noticed unfamiliar accounts on your credit report, Gartenstein-Ross says the next step is to request a credit freeze from one of the two major credit-reporting bureaus.

While your first instinct may be to attempt to have your SIN number changed, Gartenstein-Ross says there are a number of things consumers should do before that, first and foremost of which is request a credit freeze.

“I think there’s other steps they can go to, to fulfil the same purposes. One of the most important steps to keep oneself safe from the kind of fraud that can occur is a credit freeze,” he explained.

A credit freeze, which is only available to American consumers, allows only a limited number of entities to see your credit-reporting file, including creditors of accounts you currently hold, certain government entities, like child support agencies, and companies that you’ve hired to monitor your credit file. Consumers have the option to temporarily unfreeze their credit (i.e., when they need to open a new credit account), using a specialized PIN number, Gartenstein-Ross explained.

However, this option is not available to Canadians due to Canada’s laws, but Paige Hanson, chief identity and education officer at Norton LifeLock, says there are other options available to Canadians who believe their SIN has been compromised.

“While credit freezes are not available in Canada, what you can do is set up fraud alerts with the credit bureaus, TransUnion Canada and Equifax Canada. To help protect your identity, it’s important to remain vigilant and take steps to help protect yourself and your personal information,” she said.

TransUnion told Global News in a statement that individuals who have had their SIN number breached can also report the activity to the bureau to request that an investigation take place or that their SIN be placed in a high-risk database.

“If fraudulent activity has occurred, consumers can request an investigation into any inaccurate information on their TransUnion credit file,” the statement read.

“They can also request their SIN be placed in TransUnion’s High-Risk Fraud Alert database. If a consumer registers for a High-Risk Fraud Alert for their SIN, then a lender who subscribes for that service will receive an alert if the SIN is used in conjunction with a request for credit.”

If you do decide to seek a replacement SIN, the process can be complicated.

After reporting a stolen SIN to the police, Canadians need to visit their local Service Canada and bring with them a number of documents to prove they’ve been a victim of fraud or identity theft.

“Service Canada does not generally go down the road of a new SIN other than in the case of fraud or data breaches, and there’s all kinds of complexities involved,” Thomson explained. He added that while Service Canada will inform the government of a replaced SIN, it’s up to the individual to report this change to any other relevant entities, such as banks, employers and insurers.

Documents to support your case with Service Canada include a printout of all the employers who issued a T4 slip for your SIN over the past three years, a clear photograph of yourself which Service Canada will send for verification to these companies to verify your employment, a list of every address where you lived over the last 10 years and proof that you have filed a complaint with the police.

Is it worth it to replace your SIN?

While it is possible — albeit difficult — to replace your SIN, many experts don’t believe it’s worth going through the trouble.

“I don’t know anybody who has had their SIN or social security number changed successfully,” Gartenstein-Ross said.

“There’s a lot that goes into changing it, and it isn’t clear, given the prospect of more data breaches, that your SIN would be safe for very much longer so, personally, I don’t see a need to recommend this.”

WATCH: Surveillance video revealed that shows raid on home of the suspect in Capital One breach

1:53 Surveillance video revealed that shows raid on home of the suspect in Capital One breach

He went on to explain that there are other steps individuals can take, such as credit monitoring and requesting a credit freeze, that fulfil the same purposes.

Michael Favere-Marchesi, a professor with Simon Fraser University, adds that getting a new SIN will not protect you from fraud or identity theft.

“If someone else uses your old SIN and the business does not check the person’s identity with the credit bureau, credit lenders may still ask you to pay the fraudster’s debts. Each time, you will have to prove that you were not involved in the fraud,” he said in a statement.

Thomson notes, however, that obtaining a new SIN is the most effective way to find the person trying to use your identity.

“If somebody is going in and using your SIN to try and open up a fraudulent account, that’s going to be an automatic red flag because you’ve got a new SIN attached to your credit report so I do see value in it,” he explained.

Hanson added that replacing your SIN does not erase your old one. Individuals who successfully replace their SIN number will need to monitor new accounts.

How can you protect yourself from SIN breaches?

Both Gartenstein-Ross and Thomson agree that the most effective way to protect your SIN card against identity theft is to regularly monitor your credit reports and be cognizant of any new accounts you don’t recognize.

Gartenstein-Ross additionally says that individuals who want to be extra cautious are advised to request a credit freeze ahead of realizing their SIN has been stolen to prepare for potential future breaches as well.