Our general fraud charges page touches briefly on credit card and identity fraud as one of many forms fraud can take. This page is the dedicated, in-depth guide to the specific provisions that target conduct built around another person's identity: identity theft under section 402.2 of the Criminal Code and identity fraud under section 403. It explains the distinction between these two related offences, how they are classified, common fact patterns, and what generally happens after this kind of charge in Ontario. It is general legal information, not legal advice about a specific case.
Identity Theft: Section 402.2
Section 402.2 of the Criminal Code makes it an offence to knowingly obtain or possess another person's identity information in circumstances giving rise to a reasonable inference that the information is intended to be used to commit an indictable offence involving fraud, deceit, or falsehood. A related part of the same section addresses trafficking in another person's identity information, meaning transferring, selling, or making it available to someone else for that same purpose. A key feature of this offence is that it can be complete before the identity information is ever actually used to impersonate anyone: simply obtaining or possessing it, in circumstances pointing to an intended criminal use, can be enough.
Identity Fraud: Section 403
Section 403 of the Criminal Code addresses the next step: actually using another person's identity information to impersonate them, or to assume their identity, for a fraudulent purpose. This can include using someone else's identity information to open a bank account or line of credit, obtain a document, gain access to property or a benefit, or avoid arrest or prosecution. Unlike section 402.2, which can apply even before information is used, identity fraud under section 403 specifically targets the act of assuming or using another person's identity for a dishonest purpose.
Classification and Penalties
Both identity theft under section 402.2 and identity fraud under section 403 are hybrid offences, meaning the Crown can elect to proceed by summary conviction or by indictment depending on the seriousness of the specific allegations.
Identity Theft and Identity Fraud at a Glance
- Identity theft – Criminal Code section
- Section 402.2 (obtaining, possessing, or trafficking in identity information)
- Identity fraud – Criminal Code section
- Section 403 (using identity information to impersonate another person for a fraudulent purpose)
- Classification – both offences
- Hybrid offence (Crown elects summary conviction or indictment)
- Maximum penalty – on indictment
- Up to 5 years imprisonment for each offence
- Mandatory minimum sentence
- None for a standard charge under either section
This overview reflects the general structure of the Criminal Code as of this page's last update. Actual sentences depend heavily on the scale of the conduct, the number of victims affected, and the person's record. A criminal lawyer can confirm the current state of the law for a specific case.
Common Fact Patterns
These charges arise from a wide range of conduct, including:
- Mail theft, where personal or financial documents are taken from a mailbox and later used or possessed with an apparent intent to misuse the information found in them.
- Data breaches and phishing schemes, where identity information is obtained through hacking, fraudulent emails or websites, or other digital means, then possessed or trafficked for later use.
- Using a lost, found, or stolen wallet, identification document, or set of financial details to open a credit account, obtain a loan, or make purchases in another person's name.
- Misuse of identity information obtained through a personal, family, or workplace relationship, where access to the information was originally legitimate but its later use was not.
Because these cases frequently involve digital records, such as account logs, IP addresses, and financial institution records, disclosure in identity theft and identity fraud cases can be extensive and take considerable time to review.
How This Relates to General Fraud
Identity theft and identity fraud are narrower, more specific provisions than the general fraud offence under section 380 of the Criminal Code, which covers a very broad range of deceptive conduct used to obtain property, money, or a service. Where conduct involves both misusing another person's identity information and directly obtaining money or property through that misuse, a person may face charges under section 402.2 or 403 alongside, or instead of, a general fraud charge, depending on how the Crown elects to proceed. Where property obtained through this kind of scheme is later found in the possession of another person, a separate possession of stolen property charge may also apply to that person. Because ordinary theft involves taking physical property, it is treated as a distinct offence from identity theft and identity fraud, which centre on a person's identity information rather than a physical item.
Possible Defences
Identity theft and identity fraud cases often turn on whether the Crown can prove the accused had the required knowledge and intent, as opposed to, for example, having innocently come into possession of information that later turned out to belong to someone else, or having been the victim of the same scheme rather than its author. Identification of who actually controlled a given account, device, or communication is frequently a central and contested issue, particularly in cases involving shared devices, compromised accounts, or multiple people. A criminal lawyer should review the full digital and financial disclosure before advising on which defences may apply.
What Happens After This Charge
As with general fraud cases, bail conditions in identity theft and identity fraud cases can include restrictions on internet use, device access, or holding certain financial accounts. The case then proceeds through the standard court process, including disclosure of often extensive digital and financial records, before moving toward a resolution or a trial. A conviction results in a criminal record; see our sentencing overview and criminal records overview for more general information.
Frequently Asked Questions
What is the difference between identity theft and identity fraud?
Identity theft, under section 402.2, covers obtaining, possessing, or trafficking in another person's identity information for use in committing a crime, even before that information is ever actually used. Identity fraud, under section 403, covers actually using another person's identity information to impersonate them for a fraudulent purpose, such as opening an account or obtaining credit in their name.
Can I be charged with identity theft even if I never used the information?
Potentially, yes. Section 402.2 targets the collection, possession, or trafficking of another person's identity information for use in an indictable offence, so the offence can be complete before the information is ever actually used to impersonate anyone.
How is this different from a general fraud charge?
General fraud under section 380 covers a very wide range of deceptive conduct used to obtain property, money, or a service. Identity theft and identity fraud are more specific provisions targeting conduct built around another real person's identity information, and can be charged instead of, or alongside, a general fraud charge depending on the facts.
Are these offences treated the same as ordinary theft?
No. Ordinary theft under section 322 involves taking physical property. Identity theft and identity fraud involve a person's identity information, such as their name, date of birth, or financial details, and are prosecuted under separate provisions specifically addressing this kind of conduct.
Do these charges often involve data breaches or phishing?
They can, though these charges also arise from lower-tech conduct such as mail theft, use of a found or stolen wallet, or misuse of information obtained through a personal or workplace relationship. The source of the identity information varies significantly from case to case.