22 March 2019

Companies Must Safeguard Customer Information from Identity Theft

Growing concern about identity theft

Questions? Ready to get started?

Canadian businesses need to reassure customers they are doing enough to protect their personal information at a time when there is growing public concern about identity theft, according to the latest Canada Fraud survey conducted for CPA Canada1.

The survey found that 71 per cent of respondents fear identity theft, up from 66 per cent in 2017. Trust in the efforts of Canadian businesses to protect personal information is eroding: 68 per cent of people surveyed said they believe businesses are doing their best to safeguard customer information, down from 72 per cent last year.

Even though Canadians are transacting business and shopping online more than ever before, many are still unsure if the information they provide is protected. The survey found that 68 per cent of respondents believe electronic payment methods, such as tapping debit and credit cards or using smartphone apps, facilitate fraudulent activities, and 40 per cent report feeling uncomfortable buying online.

Doretta Thompson, director, corporate citizenship, CPA Canada says2 while companies face significant challenges associated with gathering, managing and protecting information, it’s also up to individuals to do as much as they can to protect themselves against fraud.

“Use trusted websites, reputable payment processors and check your bank or credit card statements regularly for discrepancies,” she suggests. “Be extremely cautious about what information you share online. Fraudsters are always looking for personal data.”

Most Canadian businesses must comply with the Personal Information Protection and Electronic Documents Act (PIPEDA)3. Innovation, Science and Economic Development Canada says having a sound privacy policy helps companies build stronger relationships with clients and employees, and offers the following tips4 to understand PIPEDA obligations:

  • Protect employee records: PIPEDA applies to your employee records if you are engaged in interprovincial and international transactions or conduct business within federally regulated sectors. Provincial privacy legislation may also apply
  • Processing personal data across borders: If you plan to transfer personal information to an organization in a foreign country for processing, you must take concrete steps to protect it
  • Customer ID: If you ask for a customer’s identification, you should know what information you can and cannot copy off a driver's licence
  • Determine the appropriate form of consent under PIPEDA: Find out how to get permission to collect, use or disclose someone's personal information depending on how sensitive it is and how it will be used
  • Privacy quiz: Take a quiz to better understand the privacy regulations that affect your business
  • Privacy toolkit: Get detailed information on the rules for the management of personal information in the private sector
  • The EU’s General Data Protection Regulation: If you handle the personal data of EU residents while exporting goods or services to them, these regulations may apply to you.

HSBC also advises you never disclose security details over the phone when receiving unsolicited calls. If you receive an unsolicited call from HCBC, for example, ask for the caller's contact details then call your HSBC Relationship/Account Manager to validate before calling back.

For information about how HSBC protects our customers, visit HSBC Safeguard


The information presented is not meant to be comprehensive and does not constitute financial, legal, tax or other professional advice. You should not act upon the information contained in this document without first obtaining specific professional advice. While reasonable care has been taken in preparing this document, HSBC does not make any guarantee, representation or warranty (express or implied) as to its accuracy or completeness. The information presented in this document is subject to change without notice.

Certain of the products and services offered by HSBC and its subsidiaries and affiliates are subject to credit adjudication and approval. This document does not constitute an offer to provide the services and products described and the provision of such services and products remains subject to contract.

Issued by HSBC Bank Canada ("HSBC")

You are leaving the HSBC Commercial Banking website.

Please be aware that the external site policies will differ from our website terms and conditions and privacy policy. The next site will open in a new browser window or tab.

You are leaving the HSBC CMB website.

Please be aware that the external site policies will differ from our website terms and conditions and privacy policy. The next site will open in a new browser window or tab.