View all practice areas
Credit cards and an open wallet on a dark wooden desk in low light — identity theft lawyer Alberta

Identity Theft and Personation Charges in Alberta: What You're Actually Facing

Legal Review By: Brad Kraus, Criminal Defence Lawyer, KJR Law

Last Updated: May 23, 2026

"Identity theft" in everyday speech covers a wide range of conduct. Under Canadian criminal law it covers a wider range still. The 2009 reform package enacted by Bill S-4 — An Act to amend the Criminal Code (identity theft and related misconduct), S.C. 2009, c. 28, assented to October 22, 2009 and brought into force on January 8, 2010 — created a modern, integrated framework of identity-related offences spanning the obtaining, trafficking, possession, and use of identity information, identity documents, and credit card data, alongside the parallel offences of personating another person and personating a peace officer. The framework operates in three stages: obtaining or possessing identity information, trafficking it, and using it to defraud. Each stage is its own offence, and the Crown can charge at any one of them or all three at once. Sentencing exposure runs from a hybrid five-year maximum for some provisions through to ten years for the more serious credit-card and personation offences.

This page explains the eight principal identity-related offences in the Criminal Code — section 56.1 (identity documents), section 130 (personating peace officer), section 342(1) and 342(3) (credit card theft, forgery, and unauthorized use of credit card data), section 342.01 (instruments for copying credit card data), section 342.1 (unauthorized use of computer), section 402.2 (identity theft and trafficking in identity information), and section 403 (identity fraud) — what the Crown must actually prove under each, how modern data-breach and dark-web-marketplace investigations are conducted, the s. 738(1)(d) victim-restitution framework that follows convictions, and the Charter and substantive defences that engage. KJR Law represents people facing identity-related charges across Calgary and Southern Alberta.

Do Not Give a Statement Before You Speak with a Lawyer

Identity-related investigations are technical, document-heavy, and often have been running for months by the time charges are laid. The Crown's case is typically built on financial records, electronic device contents, surveillance, and statements the accused has made to police, banks, or fraud investigators. Statements offered to "clear things up" — about how the accused came to possess a piece of identification, about a credit card transaction, about a relationship with the named complainant — frequently supply the very elements the Crown would otherwise have to prove. The right to remain silent under s. 7 of the Canadian Charter of Rights and Freedoms and the right to retain and instruct counsel without delay under s. 10(b) apply at the door, at the bank's fraud-investigation office, and at any police interview. Call a lawyer first. Anything beyond that conversation can be prepared properly later.

What Counts as "Identity Information" — Section 402.1

Section 402.1 of the Criminal Code defines "identity information" as "any information — including biological or physiological information — of a type that is commonly used alone or in combination with other information to identify or purport to identify an individual." The statutory definition is non-exhaustive — it lists twenty examples but does not limit the section to those examples. The phrase "of a type commonly used" is the threshold that constrains the breadth: not every personal data point falls within the section, only data of a type commonly used to identify a person.

For navigation, the enumerated examples can be grouped (the groupings are presentational; the statute itself lists them as a single sequence):

  • Biological and physiological data — fingerprints, voice prints, retina images, iris images, DNA profiles.
  • Personal identifiers — names, addresses, dates of birth, written signatures, electronic signatures, digital signatures.
  • Account credentials — user names, passwords.
  • Financial identifiers — credit card numbers, debit card numbers, financial institution account numbers.
  • Government-issued numbers — passport numbers, Social Insurance Numbers, health insurance numbers, driver's licence numbers.

The breadth of the definition matters because s. 402.1 governs the elements of both identity theft under s. 402.2 and identity fraud under s. 403. A person whose computer or storage device contains an aggregation of identity information for multiple other persons — even fragmentary information — is in the territory the statute is designed to reach. The defence-side reading of what the Crown has actually established as "identity information of another person," and whether the information in question is "of a type commonly used" for identification within the meaning of the section, is often where the case is contested.

The Eight Principal Offences

The Criminal Code provides eight principal identity-related offences. Crown charging decisions almost always involve more than one of them, and the choice of which provisions to lay can substantially affect sentencing exposure. Every offence below is hybrid; the summary-conviction maximum across all eight defaults to two years less a day plus a fine of up to $5,000 under s. 787(1) of the Criminal Code, because none of the provisions specifies an offence-specific summary penalty. The indictable maxima vary by provision and are stated below.

Section 56.1 — Identity documents (5 years on indictment)

Section 56.1 makes it an offence to procure, possess, transfer, sell, or offer for sale an identity document that relates or purports to relate to another person, without lawful excuse. "Identity document" is defined narrowly at s. 56.1(3) — Social Insurance Number cards, driver's licences, health insurance cards, birth certificates, death certificates, passports, documents that simplify the process of entry into Canada, certificates of citizenship, documents indicating immigration status in Canada, certificates of Indian status, employee identity cards bearing photograph and signature, and any similar document issued or purported to be issued by a department or agency of the federal, provincial, or foreign government. Section 56.1(2) carves out conduct done (a) in good faith, in the ordinary course of the person's business or employment, or in the exercise of the duties of their office; (b) for genealogical purposes; (c) with the consent of the person to whom the document relates, of a person authorized to consent on their behalf, or of the entity that issued the document; or (d) for a legitimate purpose related to the administration of justice. Hybrid offence. Maximum 5 years on indictment; 2 years less a day on summary conviction.

Section 130 — Personating a peace officer (5 years on indictment)

Section 130 makes it an offence to falsely represent oneself as a peace officer or public officer, or — not being a peace or public officer — to use a badge, article of uniform, or equipment in a manner likely to cause persons to believe one is a peace officer or public officer. Before the 2009 amendments enacted by S.C. 2009, c. 28, s. 2, s. 130 was a summary-conviction-only offence with the then-default six-month maximum under s. 787(1). It is now a hybrid offence with a maximum of 5 years on indictment and 2 years less a day on summary conviction. The provision reaches outright impersonation and conduct that creates the impression — police-style uniforms, marked vehicles, deployment of authority that would normally be reserved for legitimate officers. Section 130.1 of the Criminal Code, added in 2014, makes it an aggravating circumstance at sentencing that the personation was carried out to facilitate the commission of another offence.

Section 342(1) — Theft, forgery, or fraudulent use of credit card (10 years on indictment)

Section 342(1) creates four discrete offences: (a) stealing a credit card, (b) forging or falsifying a credit card, (c) possessing, using, or trafficking in a credit card or forged or falsified credit card knowing it was obtained or altered by the commission of an offence, and (d) using a credit card knowing it has been revoked or cancelled. Hybrid offence. Maximum 10 years on indictment; 2 years less a day on summary conviction. Where the credit card was physically taken from a wallet, found and used, or fabricated from skimmed information and re-encoded onto blank card stock, s. 342(1) is the operative provision.

Section 342(3) — Unauthorized use of credit card data (10 years on indictment)

Section 342(3) is the provision the Crown most often relies on in modern card-fraud files. It makes it an offence to fraudulently and without colour of right possess, use, traffic in, or permit another person to use credit card data — including personal authentication information (PINs, passwords, security codes) — whether or not the data is authentic, that would enable a person to use a credit card or to obtain the services that are provided by the issuer of a credit card to credit card holders. Section 342(4) defines "personal authentication information" as a personal identification number or any other password or information that a credit card holder creates or adopts to authenticate their identity in relation to the credit card, and defines "traffic" as selling, exporting from or importing into Canada, distributing, or dealing in any other way with the credit card or credit card data. The provision reaches situations where there is no physical card at all: card numbers stored in a phone, card data sold on a dark-web marketplace, card-not-present transactions conducted online, BIN attacks, skimmer data, and stored credentials. Hybrid offence. Maximum 10 years on indictment; 2 years less a day on summary conviction.

Section 342.01 — Instruments for copying credit card data (10 years on indictment)

Section 342.01 targets the apparatus side of card fraud. It makes it an offence to make, repair, buy, sell, export, import, or possess any instrument, device, apparatus, material, or thing known to have been used or adapted for use in copying credit card data, or in forging or falsifying credit cards. Skimming devices, magnetic stripe writers, blank card stock with magnetic strips, point-of-sale overlays, ATM skimmers, and "carding" software all fall within the section. Hybrid offence. Maximum 10 years on indictment; 2 years less a day on summary conviction.

Section 342.1 — Unauthorized use of computer (10 years on indictment)

Section 342.1 covers the cyber side of modern identity-related conduct. It makes it an offence to fraudulently and without colour of right obtain any computer service, intercept any function of a computer system, use a computer system with intent to commit an offence under those paragraphs or under s. 430 in relation to computer data, or use, possess, traffic in, or permit access to a computer password that would enable any of the foregoing. The section reaches credential-stuffing attacks, account takeovers, SIM swapping, and unauthorized access to email or financial accounts. Hybrid offence. Maximum 10 years on indictment; 2 years less a day on summary conviction.

Section 402.2(1) — Identity theft (5 years on indictment)

Section 402.2(1) makes it an offence to knowingly obtain or possess another person's identity information in circumstances giving rise to a reasonable inference that the information is intended to be used to commit an indictable offence that includes fraud, deceit, or falsehood as an element of the offence. The provision targets the preparatory stage — obtaining or holding identity information before any fraud has actually been attempted. The Crown does not have to prove a completed fraud or even an attempt. It must prove the possession or obtaining, and circumstances supporting a reasonable inference of intended fraudulent use. Hybrid offence. Maximum 5 years on indictment; 2 years less a day on summary conviction.

Section 402.2(2) — Trafficking in identity information (5 years on indictment)

Section 402.2(2) is the parallel trafficking provision. It targets transmission, making available, distribution, sale, offering for sale, or possession for any of those purposes of another person's identity information, knowing or being reckless as to whether the information will be used to commit an indictable offence including fraud, deceit, or falsehood. The provision is built for the modern data-breach economy — identity information moves through dark-web marketplaces, encrypted channels, and forums in volume, and s. 402.2(2) is the Crown's tool for prosecuting participation in that economy at the trafficking stage. Hybrid offence. Maximum 5 years on indictment; 2 years less a day on summary conviction.

Section 403 — Identity fraud (personation) (10 years on indictment)

Section 403 — formerly "personation with intent" — is the use-stage provision. It makes it an offence to fraudulently personate another person, living or dead, with intent to (a) gain advantage for oneself or another person, (b) obtain any property or interest in property, (c) cause disadvantage to the person being personated or another person, or (d) avoid arrest or prosecution, or to obstruct, pervert, or defeat the course of justice. Section 403(2) makes clear that "personating" includes pretending to be the person or using the person's identity information as if it pertains to the user. The provision reaches everything from credit-card-not-present fraud using stolen data, to opening bank accounts in another's name, to giving a false name on arrest. Hybrid offence. Maximum 10 years on indictment; 2 years less a day on summary conviction.

The Three-Stage Architecture: Obtain → Traffic → Use

The Bill S-4 reform package was designed around a three-stage understanding of how modern identity-related crime operates. Identity information is first obtained — through data breach, phishing, skimming, theft of physical documents, social engineering, or unauthorized access to systems. It is then trafficked — sold on dark-web marketplaces, transferred between groups, packaged with other data points to create more complete identity sets. And finally it is used — to open fraudulent accounts, apply for credit, conduct card-not-present transactions, file false tax returns, or personate the victim in other dealings. Section 402.2(1) targets the obtain-and-possess stage. Section 402.2(2) targets the traffic stage. Section 403 targets the use stage. A single accused can be charged at any one stage or at all three, and the Crown frequently lays charges at multiple stages on the same information. Understanding which stage the Crown's case actually rests on, and where the evidence is thinnest, is the defence-side starting point.

The "Reasonable Inference" Threshold Under Section 402.2(1)

The single most-litigated element of s. 402.2(1) is the "reasonable inference" requirement. The Crown does not have to prove the accused actually intended to commit a specific fraud. It must prove the accused obtained or possessed the identity information in circumstances giving rise to a reasonable inference that the information was intended to be used to commit an indictable offence involving fraud, deceit, or falsehood. The inference flows from the circumstances of the possession.

Circumstances that strengthen the inference. Identity information held in volume (multiple persons' data), held in conjunction with apparatus (skimming devices, card-writing equipment), held alongside other indicia of fraud preparation (counterfeit document templates, instruction lists, lists of merchant targets), or held by a person who has no plausible legitimate reason to possess it (not a family member, not an employer, not a legal representative).

Circumstances that weaken the inference. Information that came into possession through a plausible legitimate channel (a relative's documents during estate administration, a former employer's records held following separation, documents found and not yet returned), information held in a context consistent with the lawful purpose for which the accused acquired it, or information whose presence is genuinely inadvertent (data accidentally received in a forwarded email or shared cloud drive). The defence work involves engaging with the totality of the circumstances and contesting the inference the Crown invites the court to draw.

Modern Investigation Patterns

Identity-related prosecutions in Alberta typically originate in one of a small number of investigation patterns:

  • Bank fraud-investigation referrals. Financial institutions' fraud-investigation units routinely refer files to police where unauthorized transactions, account takeovers, or suspected identity-information misuse have occurred. The internal bank investigation will typically have produced a substantial document set before any criminal investigation begins.
  • Canadian Anti-Fraud Centre referrals. The Canadian Anti-Fraud Centre, operated jointly by the RCMP, Competition Bureau, and Ontario Provincial Police, receives and analyzes complaints of fraud and identity theft and refers actionable matters to local police of jurisdiction.
  • Traffic-stop or arrest discoveries. Identity-related charges frequently arise from unrelated investigations. A vehicle search incident to an unrelated arrest produces a stack of credit cards in other persons' names; a phone seizure produces a screenshot folder of identity information; a residence search produces a notebook of credentials.
  • Cybercrime unit investigations. The RCMP's National Cybercrime Coordination Centre and the Calgary Police Service's Cybercrime Unit conduct proactive investigations into dark-web marketplaces, credential-stuffing operations, and organized identity-information trafficking.
  • Victim complaints. A person notices unauthorized accounts in their name, unauthorized charges, or evidence of personation, and reports the matter to police, triggering an investigation that traces the misuse back to a suspect.

In every pattern, the investigation typically produces voluminous digital and documentary disclosure: financial records, device contents, surveillance footage, statements from the victim, statements from bank investigators, and increasingly, expert evidence from cybercrime analysts. The defence-side scrutiny of how each piece of evidence was obtained — and what it actually establishes — is the core of these files.

The Defences in Play

The defence-side arguments most often engaged in identity-related files:

Knowledge — the accused did not know. Possession-based offences (ss. 56.1, 342, 402.2) all require the Crown to prove the accused knew of the presence of the information or document. Where the documents or information were on a shared device, in a shared residence, or in a vehicle the accused did not exclusively control, the knowledge element is open to argument. The Crown may attempt to bridge the gap with the doctrine of wilful blindness — but wilful blindness has its own elements and is itself contestable on the facts.

Lawful excuse — section 56.1. Section 56.1(2) explicitly carves out conduct that is good-faith business, employment, or in the exercise of the duties of office; genealogical; consensual (consent of the person, of someone authorized on their behalf, or of the issuing entity); or related to the administration of justice. Where the accused's possession of an identity document fits one of these categories, the defence is available and is statutory.

Colour of right and absence of fraudulent purpose — section 342(3). Section 342(3) requires the Crown to prove the conduct was "fraudulently and without colour of right." Where the accused had an honest belief in lawful entitlement to use the credit card data — for example, in a family or business context where authorization was understood — the Crown's case is weaker. Colour of right is not a defence to s. 342(1) physical-card theft but is available for s. 342(3) data-misuse charges.

The reasonable-inference threshold — section 402.2(1). The Crown must prove the possession was in "circumstances giving rise to a reasonable inference" of intended fraudulent use. Defence work on this element involves engaging with the totality of the circumstances, presenting the legitimate context for the possession, and contesting the inference the Crown asks the court to draw. The threshold is not low — circumstantial cases that are consistent with both lawful possession and intended fraud do not automatically meet it.

Identification. Where credit card transactions occurred remotely, where dark-web activity is attributed by IP address, or where the Crown's identification of the accused as the user of an account is circumstantial, identification can be contested. IP attribution is itself contestable — shared connections, VPNs, compromised home networks, and proxy servers all introduce reasonable doubt.

Charter section 8 — search and seizure. Device searches, account-information production orders under s. 487.014 of the Criminal Code, IP-to-subscriber resolutions under R v Spencer, 2014 SCC 43 and R v Bykovets, 2024 SCC 6 (the latter extending Spencer upstream to the IP address itself), computer-search authorizations under R v Vu, 2013 SCC 60, phone searches incident to arrest under the narrow limits in R v Fearon, 2014 SCC 77, shared-device consent under R v Reeves, 2018 SCC 56, and warrants generally under R v Garofoli, [1990] 2 SCR 1421 are all reviewable. For text-message evidence, R v Marakah, 2017 SCC 59 establishes that the subject matter of the search is the electronic conversation itself, and that a sender retains a reasonable expectation of privacy in sent messages even when they are recovered from the recipient's device. Its companion decision R v Jones, 2017 SCC 60 extends the privacy framework to historical text-message records held by a service provider under a s. 487.014 production order. R v Campbell, 2024 SCC 42 reaffirms Marakah and refines the analysis: the Charter inquiry is content-neutral, focused on the potential of an electronic conversation to reveal biographical core information rather than on whether the actual content turns out to be mundane or criminal. Campbell also holds that police impersonation of a participant in a text-message conversation is itself a "search" requiring lawful authority. Where Crown disclosure shows the foundational authorizations were obtained on overstated or insufficient information, or that the digital-evidence chain was acquired in breach of one of these frameworks, exclusion under s. 24(2) becomes available — and exclusion of seized devices and digital evidence typically collapses the file.

Limits on the Charter framework — identifying information voluntarily provided to commercial counterparties. The Charter does not protect every piece of personally-identifying information held by a third party. In R v Neumann, 2023 ABCA 200, the Alberta Court of Appeal held that a name and cell phone number voluntarily provided to commercial businesses in the ordinary course of a transaction (a motel registration, a vehicle purchase) does not, on its own, attract a reasonable expectation of privacy at the level the Spencer/Bykovets line establishes for subscriber information held by a telecommunications provider. The Charter analysis is sensitive to the specific information at issue, the nature of the third-party relationship, and the contractual privacy framework that governs the holding of the information. Defence-side framing of Charter applications in identity-related files needs to engage Neumann alongside the broader privacy line, not assume that all third-party identifying information is equally protected.

Warrantless commercial-counterparty information requests and pinging. At the trial level in Ontario, R v Campbell, 2024 ONSC 3924 (a separate case from the SCC decision above, involving a different accused) held that a warrantless request to a service provider for subscriber information, followed by location-pinging without judicial authorization, was not saved by "exigent circumstances" where the police waited eight hours to contact the provider and where the asserted exigency was, on the facts, expediency rather than imminent risk. The Charter line between exigent and expedient is one that defence counsel litigate when the disclosure shows time was available to obtain a warrant.

Charter sections 9 and 10 — detention and right to counsel. Statements taken without proper advice of rights, prolonged interrogations conducted in disregard of the right to silence, and detentions effected without lawful authority all engage exclusion. R v Grant, 2009 SCC 32 governs the admissibility analysis. Where the Crown's case rests substantially on statements the accused made during the investigation, Charter litigation on the admissibility of those statements can substantially reshape the file.

Sentencing, Restitution, and Collateral Consequences

Identity-related sentencing ranges widely, depending on the provision charged and the scale of the conduct. A first-offence s. 402.2(1) conviction for a small-scale possession can attract a non-custodial disposition — suspended sentence with probation, conditional sentence, or fine. A serious s. 403 personation involving large-value fraud, sophisticated planning, and multiple victims can attract multi-year penitentiary sentences. The Crown's election and the breadth of the file are determinative.

Conditional sentences — section 742.1. Following the Act to amend the Criminal Code and the Controlled Drugs and Substances Act, S.C. 2022, c. 15 (Bill C-5), the conditional sentence framework at s. 742.1 of the Criminal Code is available for any of the identity-related offences on this page. None of them sits in the s. 742.1(c) exclusion list (advocating genocide, torture, attempt murder, or terrorism offences), and none has a mandatory minimum. A conditional sentence may be imposed where the court is satisfied that serving the sentence in the community would not endanger the safety of the community, that it is consistent with the purpose and principles of sentencing in ss. 718 to 718.2, and that the sentence is one of less than two years. The availability of a community-based sentence in appropriate identity-related cases is a meaningful change from the pre-2022 framework and frames a substantial portion of the resolution conversation in these files.

Section 738(1)(d) — restitution for re-establishing identity. A feature of the 2009 reform package that distinguishes identity-related sentencing from most other offences is the special restitution provision at s. 738(1)(d) of the Criminal Code. On a conviction for an offence under s. 402.2 or s. 403, the court may order the offender to pay restitution to a person who, as a result of the offence, incurs expenses to re-establish their identity — including expenses to replace identity documents and to correct credit history and credit rating — in an amount that is not more than the amount of those expenses, to the extent that they are reasonable and the amount is readily ascertainable. The provision is reserved for s. 402.2 and s. 403 convictions; for the credit-card offences under s. 342, restitution for the underlying financial loss is sought under the general restitution provisions at s. 738(1)(a) and (b). The "reasonable and readily ascertainable" qualifier is where defence-side contest on quantum lives.

Section 380.1 sentencing framework — where companion fraud is laid. Identity-related files frequently include a companion fraud charge under s. 380 (typically fraud over $5,000, with a 14-year maximum). On a sentencing for an offence referred to in s. 380, 382, 382.1, or 400, s. 380.1(1) directs the court to consider as aggravating circumstances (a) the magnitude, complexity, duration, or degree of planning of the fraud; (b) any adverse effect or potential adverse effect on the stability of the Canadian economy, financial system, or financial markets; (c) a large number of victims; (c.1) significant impact on victims given their personal circumstances, including age, health, and financial situation; (d) the offender's taking advantage of the high regard in which the offender was held in the community; (e) non-compliance with any licensing requirement or professional standard normally applicable; and (f) concealment or destruction of records related to the fraud or the disbursement of its proceeds. Section 380.1(2) goes the other way: where the offender's employment, employment skills or status, or reputation in the community were relevant to, contributed to, or were used in the commission of the offence, the court "shall not consider" those circumstances as mitigation. These provisions apply to the companion fraud sentencing; they do not directly govern sentencing on the s. 402.2 or s. 403 conviction itself, but the factors animate the same sentencing record.

Beyond the criminal sentence:

  • Criminal record consequences. An identity-theft or personation conviction is a serious offence on a criminal record and affects employment, licensing, and travel for decades. Federal employment and many regulated professions are foreclosed.
  • Civil liability. The criminal conviction or admission supports parallel civil recovery actions by the financial institutions, the victims, and any business affected by the fraud.
  • Banking relationships. Conviction for credit-card or identity offences typically foreshortens banking relationships — accounts closed, credit lines withdrawn, refusal of future banking products.
  • Immigration consequences. For non-citizens, an identity-related conviction with a 10-year maximum (ss. 342, 403) is serious criminality under the Immigration and Refugee Protection Act and triggers inadmissibility analysis. Permanent residents face potential removal regardless of length of residence.
  • Travel. United States travel is generally foreclosed for identity-related convictions found to involve moral turpitude; a U.S. entry waiver is the standard pathway.
  • Computer-related prohibitions. A conviction under s. 342.1 can attract terms restricting computer use, internet access, or possession of unauthorized credentials during probation.

Companion Charges

Identity-related informations rarely contain only one count. Common companion charges:

  • Frauds. 380. Where the identity-theft conduct produced a completed fraud, the underlying fraud charge typically accompanies the identity charge. Fraud over $5,000 carries a 14-year maximum and engages the s. 380.1 sentencing framework discussed above.
  • Possession of property obtained by crimes. 354. Where the accused was found with goods purchased through the fraud, the parallel possession charge is laid.
  • Forgery and uttering forged documentss. 366 to 368. Where counterfeit documents (cheques, identification, contracts) are involved.
  • Possession of forgery instrumentss. 369. Where instruments used or adapted for forging documents are seized.
  • Mischief in relation to computer datas. 430(1.1). Where unauthorized access caused damage to computer data or systems.
  • Conspiracys. 465. Where the Crown alleges the conduct was part of an organized arrangement.
  • Criminal organization offencesss. 467.11 to 467.13. Where the alleged conduct is connected to organized identity-information trafficking.

Where We Appear

We act on identity-related files in the Alberta Court of Justice, the Court of King's Bench of Alberta, and the Court of Appeal of Alberta. From our Calgary office we travel to court in Airdrie, Cochrane, Canmore, Okotoks, Diamond Valley, Didsbury, Strathmore, Drumheller, Hanna, Brooks, Medicine Hat, Lethbridge, Fort Macleod, Taber, Pincher Creek, and Cardston, and we appear in matters arising on the Tsuut'ina, Siksika, and Kainai (Blood Tribe) Nations.

The First Conversation Is Free.

Identity-related files reward careful work on the technical foundations of the Crown's case — what was actually obtained, what circumstances support the reasonable-inference threshold, what the digital forensics actually establish, and what the Charter status of the underlying searches and authorizations is. Early engagement gives counsel the time to review disclosure carefully, identify the seams in the Crown's theory, and frame the resolution conversation accordingly.

Call us today at 587-583-2808

Strictly confidential. Initial consultation at no charge.

Identity Theft and Personation Defence FAQ

Can I be charged with identity theft if I never actually used the information?

Yes. Section 402.2(1) of the Criminal Code targets the obtaining-and-possessing stage. The Crown does not have to prove the accused completed or even attempted a fraud. It must prove the accused knowingly obtained or possessed another person's identity information in circumstances giving rise to a reasonable inference that the information was intended to be used to commit an indictable offence involving fraud, deceit, or falsehood. The "reasonable inference" requirement is the central element — and is the element where defence work most often engages.

What's the difference between identity theft and identity fraud in Canadian law?

Identity theft under s. 402.2 is the obtaining, possessing, or trafficking of another person's identity information at the preparatory stage. Identity fraud under s. 403 is the actual use of identity information to personate another person with a fraudulent intent — to gain advantage, obtain property, cause disadvantage to the personated person, or avoid arrest. The two offences cover different stages of the same conduct and are frequently charged together on the same information. Identity theft carries a 5-year maximum on indictment; identity fraud carries a 10-year maximum.

What if I had someone else's ID for a legitimate reason?

Section 56.1(2) of the Criminal Code explicitly carves out from the identity-documents offence acts done (a) in good faith in the ordinary course of business or employment, or in the exercise of the duties of one's office; (b) for genealogical purposes; (c) with the consent of the person to whom the document relates, of a person authorized to consent on their behalf, or of the entity that issued the document; or (d) for a legitimate purpose related to the administration of justice. Where one of these statutory excuses applies, the offence is not made out. The defence work involves establishing the legitimate context with documentation and, where appropriate, witness evidence.

What is "personal authentication information" under section 342(3)?

Section 342(4) defines "personal authentication information" as a personal identification number or any other password or information that a credit card holder creates or adopts to be used to authenticate their identity in relation to the credit card. PINs, online banking passwords, security codes, security question answers, and biometric authentication settings all fall within the definition. Possession or use of this information without colour of right engages s. 342(3) and carries a 10-year maximum on indictment.

Can I be charged with possession of credit card data if I don't have a physical card?

Yes. Section 342(3) is built precisely for this scenario. It targets possession, use, or trafficking of credit card data — including card numbers, expiry dates, CVV codes, and personal authentication information — whether or not the data is authentic, that would enable a person to use a credit card or obtain card-issuer services. Card data stored in a phone, recorded in a notebook, listed in a spreadsheet, or held in any other form falls within the section.

What is "personating a peace officer" under section 130?

Section 130 makes it an offence to falsely represent oneself as a peace officer or public officer, or to use a badge or article of uniform or equipment in a manner likely to cause persons to believe one is a peace officer or public officer. The provision reaches outright impersonation but also less explicit conduct — wearing police-style uniform components, displaying badge-like insignia, deploying flashing lights on a vehicle to impersonate authority. The 2009 reform package made the offence hybrid, with a maximum of 5 years on indictment and 2 years less a day on summary conviction. Section 130.1, added in 2014, makes it an aggravating circumstance at sentencing that the personation was carried out to facilitate the commission of another offence.

Can the victim be required to be reimbursed for the cost of repairing their credit?

Yes. Section 738(1)(d) of the Criminal Code creates a special restitution power for sentencing courts on a conviction for an offence under s. 402.2 or s. 403. The court may order the offender to pay a person who, as a result of the offence, incurs expenses to re-establish their identity — including expenses to replace identity documents and to correct credit history and credit rating — an amount that is not more than the amount of those expenses, to the extent that they are reasonable and the amount is readily ascertainable. The Crown routinely seeks these orders on sentencing. For credit-card offences under s. 342, restitution for the underlying financial loss is sought under the general restitution provisions at s. 738(1)(a) and (b).

What if police got the information from my phone or computer?

Every device search engages s. 8 of the Charter. The Supreme Court of Canada in R v Vu, 2013 SCC 60 held that searches of computers and similar devices require specific authorization — a general warrant that authorizes a residential search does not automatically authorize a search of the devices found within. For text-message evidence specifically, R v Marakah, 2017 SCC 59 establishes that the subject matter of the search is the electronic conversation itself, and R v Campbell, 2024 SCC 42 reaffirms that the analysis is content-neutral. Where the device-search authorization was obtained on insufficient grounds, or the search exceeded the authorized scope, the resulting evidence is subject to exclusion under s. 24(2). For identity-related files where the Crown's case rests on digital evidence, this is frequently the most consequential piece of the defence work.

What if the police traced this back to my IP address?

IP attribution is one of the most heavily-litigated areas in modern identity-related Charter work. The Supreme Court of Canada in R v Spencer, 2014 SCC 43 held that a request to an internet service provider for subscriber information linked to an IP address engages s. 8 of the Charter and requires lawful authority. R v Bykovets, 2024 SCC 6 extends that framework upstream: the IP address itself attracts a reasonable expectation of privacy, and police can no longer obtain it from third parties on informal request without lawful authorization. Where the IP-attribution evidence in the disclosure was obtained outside this framework, exclusion under s. 24(2) is on the table. On the merits, IP attribution is also factually contestable — shared internet connections, VPNs, compromised home networks, and proxy servers all introduce reasonable doubt about who was actually operating an account at the relevant time.

Can I avoid jail on identity-related charges?

Outcomes vary widely. Small-scale, first-offence s. 402.2(1) possession files frequently resolve without custody — suspended sentences, conditional sentences served in the community, or fines are available. Larger-scale s. 342 and s. 403 files involving substantial financial loss, multiple victims, or sophisticated planning are typically prosecuted with custody in view. The Crown's election (summary or indictment), the file's place on the spectrum, the strength of any mitigating circumstances, and the success of any Charter applications all bear on the outcome.

Could I get a conditional sentence on an identity-related conviction?

Potentially, yes. Following Bill C-5 (S.C. 2022, c. 15), the conditional sentence framework at s. 742.1 of the Criminal Code is available for every identity-related offence on this page. None of the offences sits in the s. 742.1(c) exclusion list (advocating genocide, torture, attempt murder, terrorism), and none carries a mandatory minimum. A conditional sentence — sentence served in the community on strict conditions — may be imposed where the court is satisfied that serving the sentence in the community would not endanger the safety of the community, that it is consistent with the purpose and principles of sentencing under ss. 718 to 718.2, and that the sentence is one of less than two years. Whether a conditional sentence is appropriate on a particular file depends on the scale of the conduct, the offender's background, mitigating circumstances, and the Crown's position on resolution.

What does KJR Law charge to defend an identity-related file?

Fees depend on the provisions charged, the volume of digital and financial disclosure, whether expert evidence is required, whether Charter applications are brought, whether parallel civil or insurance proceedings are running, and whether the matter resolves before trial or proceeds to trial. We set out our fee, disbursements, and GST in a written retainer letter before any work begins. The initial consultation is at no charge.

The First Conversation Is Free.

Identity-related files reward careful technical work on what the Crown has actually established, where the inference threshold is genuinely met and where it is not, and on the Charter status of every search and seizure that produced the disclosure. The earlier counsel is involved, the more material there is to work with — particularly device and account-related evidence, where the time-sensitive authorizations and chain-of-custody issues are most consequential.