Your SIN is a 'master key.' Here's why you must protect it

Dave has learned the hard way that you don't want the wrong person getting a hold of your social insurance number. 

In 2024, he became a victim of identity fraud. Someone used his SIN to open a bank account and get their hands on some quick cash. And while he didn't lose any of his own money, his credit score tanked for a period.

"The most frustrating part was being told, 'Hey, there isn't much we could do about this. Your information is on the dark web. It will be used again.' And months later, it was used again," Dave, of Laval, Que., told Cost of Living. 

Dave isn't his real name. CBC has agreed to identify him by a pseudonym, as police have told him that further exposing his identity could lead to more challenges.

Dave was one of 4.2 million Desjardins customers that had their data leaked in 2019. And they aren't the only victims. Over the past few years, customers with Sobeys, Ticketmaster, London Drugs, Nova Scotia Power and the Canada Revenue Agency, to name a few, have had their data breached. 

And since more businesses and organizations have started asking for social insurance numbers, experts are cautioning people to be very selective about who they share their SIN with.

"It's the most sensitive, secret and unique identifier. Essentially, it's the master key to our identity in Canada," said Claudiu Popa, co-founder of KnowledgeFlow Cybersafety Foundation, which advocates for online safety for Canadians.

The social insurance number was created with the launch of the Canadian Pension Plan in the 1960s and used to track who was eligible, as well as for various employment insurance programs.

According to Popa, there aren't many places that actually need to know it. A new employer needs your SIN, as does your bank and some government agencies, like the CRA.

But more organizations are asking for people's SINs. Popa says that includes gyms, landlords, insurance companies and schools. He says none of these places need your SIN, but that doesn't stop them from asking.  

That's because it's an easy way to check someone's credit with a unique number. But some companies are also using it as an identifier for customers. 

"It has just become a lazy way of uniquely identifying people, and unfortunately it places people at the risk of privacy breaches," said Popa.

So what do you do if someone asks for your SIN? Just say no. 

But as the cliché goes, that's easier written into a CBC article than done in real life. Just ask Greg Pace.