Identity theft (section 402.2 of the Criminal Code) criminalizes obtaining or possessing someone else's identity information with intent to use it for an indictable offence involving fraud or deceit — even before any fraud is completed. Identity fraud (section 403) criminalizes actually impersonating someone, living or dead, to gain an advantage, obtain property, or cause disadvantage. Both differ from general fraud charges, which focus on the dollar value of a completed scheme rather than the misuse of identity itself.
- Identity theft (section 402.2) criminalizes obtaining or possessing someone's identity information with intent to use it in a fraud-related indictable offence.
- This offence captures preparatory conduct — the underlying fraud does not need to have been completed, or even attempted yet.
- Identity fraud (section 403) criminalizes actually personating another person, living or dead, to gain an advantage, obtain property, or cause disadvantage.
- Both offences are hybrid, giving the Crown a choice between summary and indictable procedure.
- These charges differ from a general fraud charge, which focuses on the dollar value of a completed scheme rather than the misuse of someone's identity.
- Common scenarios include card and ATM skimming, phishing and online account takeovers, and using someone else's information to open credit.
Two Related but Distinct Offences
Identity theft and identity fraud are two separate Criminal Code offences, built specifically to address the misuse of someone’s personal information in the digital age. They are closely related, often arise from the same set of facts, and are frequently charged together — but they target different conduct.
Identity Theft: Section 402.2
Section 402.2 criminalizes obtaining or possessing another person’s identity information in circumstances that give rise to a reasonable inference that the information is intended to be used to commit an indictable offence involving fraud, deceit, or falsehood. Critically, this offence captures preparatory conduct — the underlying fraud does not need to have happened, or even been attempted, for this charge to apply.
Section 402.2 also includes a related offence of trafficking in identity information — transmitting, making available, selling, or otherwise distributing it — which can reach people who supply stolen information without personally using it.
Because identity theft captures preparatory conduct, a person can be charged well before any actual fraud or financial loss occurs — simply possessing someone else’s identity information with the required intent is enough.
Identity Fraud: Section 403
Section 403 criminalizes fraudulently personating another person, living or dead, with one of three specific intents: to gain advantage for oneself or another, to obtain property or an interest in property, or to cause disadvantage to the person being personated or someone else. Unlike identity theft, identity fraud requires an actual act of impersonation, not just possession of information.
How This Differs From General Fraud
| Charge | What It Targets |
|---|---|
| General fraud (s. 380) | The dollar value obtained or placed at risk through a completed or attempted scheme |
| Identity theft (s. 402.2) | Obtaining or possessing identity information with intent to commit a fraud-related offence |
| Identity fraud (s. 403) | Actually impersonating a real person to gain an advantage, property, or cause disadvantage |
A single scheme — such as using stolen card data to make purchases — can potentially support charges under more than one of these sections, plus a general fraud charge, depending on exactly what was done at each stage.
Common Scenarios
These charges arise from a wide range of fact patterns, including:
- Card and ATM skimming — using devices to capture payment card data for later use
- Phishing and online account takeovers — harvesting login credentials or personal information through deceptive messages or websites
- Opening credit or loans in someone else’s name using their personal information
- Creating fake documents or accounts that impersonate a real person
A person is found with a list of stolen credit card numbers and personal details, but has not yet made any purchases. This can still support an identity theft charge under section 402.2, since possession with the required intent is enough on its own.
Defending These Charges
Defending identity theft or identity fraud charges often focuses on:
- Whether the accused genuinely knew the information was improperly obtained, or intended to use it fraudulently
- Whether the evidence actually meets the specific legal definitions in sections 402.2 or 403, as opposed to a lesser or different charge
- How the evidence was gathered, including whether any search or seizure was conducted lawfully
Facing an identity theft or identity fraud charge in Toronto or anywhere in Ontario? Call our Toronto criminal defence lawyers at 416-274-2222 for a free consultation.
Frequently Asked Questions
Identity theft, under section 402.2 of the Criminal Code, criminalizes obtaining or possessing someone's identity information in circumstances suggesting it is intended for use in a fraud-related indictable offence — the fraud itself does not need to have happened yet. Identity fraud, under section 403, criminalizes actually impersonating a real person, living or dead, to gain an advantage, obtain property, or cause disadvantage.
Yes. Section 402.2 is specifically designed to capture preparatory conduct — obtaining or possessing someone's identity information with the required intent is enough on its own, even if the planned fraud was never carried out or completed.
A general fraud charge under section 380 focuses on the value obtained or placed at risk through deceit. Identity theft and identity fraud charges focus specifically on the misuse of another person's identity or identifying information, regardless of a precise dollar value, and can apply earlier in a scheme, before any money actually changes hands.
Common scenarios include card and ATM skimming devices used to capture payment card data, phishing scams designed to harvest login credentials or personal information, using someone else's identity to open credit cards or loans, and creating fake accounts or documents in another person's name.
Yes. Section 402.2 also includes a separate offence for transmitting, making available, selling, or otherwise distributing another person's identity information, which can apply to people further up a fraud supply chain who never personally used the information.
Both identity theft and identity fraud are hybrid offences, meaning the Crown can choose to proceed summarily or by indictment depending on the scope and seriousness of the conduct involved.
Common defences include disputing knowledge or intent — for example, that the accused did not know the information was obtained improperly or did not intend to use it fraudulently — challenging how the evidence was gathered, and disputing whether the conduct actually meets the specific legal definitions in sections 402.2 or 403.