Guides
SIM-swap and phone porting fraud in Canada, CRTC rules and carrier steps
SIM-swap fraud Canada: how porting fraud works, the CRTC porting rules, Bell, Rogers and Telus port-freeze and account-lock options, and how to report to the CAFC.
What to take away
- A SIM swap in Canada is usually porting fraudsomeone passes your carrier's identity check and moves your number to their SIM.
- The CRTC requires carriers to verify the account holder before a number moves, but leaves the method to each carrier.
- Bell, Rogers and Telus place a port freeze or account lock on request; regional carriers use their own names for it.
- Report to your carrier first, then the Canadian Anti-Fraud Centre at 1-888-495-8501.
How a ported number becomes someone else's phone
A SIM swap never touches your handset. The attacker gathers your name, address, date of birth and often card digits, then contacts your carrier as you.
How a SIM swap unfolds
- Attacker gathers your personal data
- Calls carrier pretending to be you
- Requests number move to new SIM
- Carrier accepts, your service drops
- Attacker receives calls and texts
- Resets passwords via SMS recovery
If the check passes, your service drops and their SIM receives your calls and texts. Your number is the recovery channel for email and banking.
A legitimate port usually completes within hours. A fraudulent one can finish in minutes when an agent skips the callback and releases the line.
The Office of the Privacy Commissioner treats identifiers as the raw material of impersonation. Its pages on identities and identity theft explain how a hijacked number fits.
Exposure is uneven. Our look at Halifax and St. John's SIM-swap risks covers smaller markets.
What the CRTC porting rules require
Wireless number portability went live across most of Canada on 14 March 2007. The CRTC framework requires carriers to keep numbers portable and to protect customer data during a transfer.
The rules do not publish one verification script. Carriers must confirm the request comes from the account holder, and the method is theirs to choose; typical checks are the phone number and a passcode or PIN.
PIPEDA obliges carriers to protect the personal information they hold and to give you access to it on request. The full text of PIPEDA sets out both duties.
After a fraud, ask for the account notes, the port request record and the verification method used. OPC guidance on access to personal information shows how to ask.
Port freezes at Bell, Rogers, Telus and regional carriers
A port freeze is a flag that stops your number moving until you lift it. Carriers do not share one name for it, and prepaid lines are often excluded.
Port freezes at carriers
Ask for
- Bell
- Port freeze or account lock
- Rogers
- Port freeze or account lock
- Telus
- Port freeze or port protection
- Regional carriers
- Varies by carrier
What it does
- Bell
- Blocks a port until you authorize it
- Rogers
- Locks the account and number behind a PIN
- Telus
- Adds a flag and extra identity checks
- Regional carriers
- SaskTel, MTS, Eastlink, Videotron and Freedom Mobile each run their own process
Ask two questions before you hang up. Does the freeze cover ports to another carrier, and SIM or eSIM changes inside your network?
Port-freeze options by carrier
Bell
- What to ask for
- Port freeze and account lock
- What it does
- Blocks port until you authorize
- Extra verification
- In-person or extra check
Rogers
- What to ask for
- Port freeze and account lock
- What it does
- Locks account and number
- Extra verification
- PIN or passcode required
Telus
- What to ask for
- Port freeze and account lock
- What it does
- Adds port protection flag
- Extra verification
- Additional identity checks
If the line is already gone, our walkthrough of account security problems sets out the order to work in.
Example: what to say when you request a freeze
I want a port freeze and an account lock on this number, so no port or SIM change can be processed without my authorization. Tell me which ID lifts the freeze, and send written confirmation.
Then, in order:
Requesting a freeze
- Call the number on your bill or in your carrier's app, never a number from a call or text.
- Ask for the fraud or security team and read the request above.
- Confirm that the freeze covers ports out and SIM swaps inside the network.
Reporting a swap: carrier, CAFC, police, regulator
- Carrier. Report the unauthorized port to the fraud team, ask for your number back or a replacement SIM, and record the ticket number.
- Canadian Anti-Fraud Centre. Report online or call 1-888-495-8501. The CAFC shares reports with police and is not an emergency service.
- Police. File a report if money or identity documents were used. A file number helps with banks and your carrier.
- Regulator. If a federally regulated business mishandled your data, complain to the OPC. Our guide to filing a privacy complaint in Canada covers the OPC and provincial commissioners.
Keep every reference number in one note. A dated timeline explains a messy week of calls faster than memory.
Recovering email, banking and two-factor
Email comes first because it is the recovery channel for everything else. Change the password, sign out other sessions, and check forwarding rules and recovery addresses.
- Emailnew password, other sessions revoked, forwarding checked.
- Two-factorreplace SMS with an authenticator app or a security key.
- Bankingcall the number on the back of your card and ask what moved.
- Governmentcheck your CRA account and provincial services accounts.
- Recordskeep one note with every call, ticket and reference number.
Banking deserves its own call: ask what the bank saw and whether it will flag the account.
