Markham Identity Theft Lawyer

Home › Markham Criminal Defence › Identity Theft Lawyer

On a Markham charge sheet, identity theft is really one of two different offences. Possessing another person's identity information with intent to use it is identity theft under s. 402.2 of the Criminal Code and carries up to five years. Actually pretending to be that person is identity fraud under s. 403 and carries up to ten. Which one you face changes what the Crown has to prove, the sentence you are exposed to, and even your immigration position. This page walks through both charges and through how these files are really built, and beaten, in York Region.

By Fadi Matthew Kazandji, Founding Partner, Kazandji Law. Serving Markham and York Region from our Thornhill office. Updated July 2026.

Two charges, one accusation: s. 402.2 against s. 403

Clients arrive at our Thornhill office saying they have been charged with identity theft. The first job is almost always to correct the label, because the Criminal Code splits that accusation into two offences with different shapes. Identity theft is the preparation offence: obtaining or possessing someone else's identity information with intent to put it to dishonest use. Identity fraud is the use offence: actually holding yourself out as another person. They are charged together constantly, they are proven differently, and they punish differently.

	Identity theft, s. 402.2	Identity fraud, s. 403
The conduct	Obtaining or possessing another person's identity information	Personating another person, living or dead
What the Crown must prove	Intent to use the information to commit an indictable offence that includes fraud, deceit or falsehood as an element	One of four intents: gain an advantage, obtain property, cause a disadvantage, or avoid arrest or prosecution
Maximum on indictment	5 years	10 years
Typical evidence	Data on phones and laptops, lists, cards, mail	Transactions, account applications, statements to police, video of the impersonation
Immigration exposure	Serious criminality generally only if the sentence imposed exceeds six months	Serious criminality for permanent residents and foreign nationals regardless of sentence
Role in the file	The preparation count	The use count

Keep that last row in mind as you read. Prosecutors stack the preparation count and the use count on the same information, then resolve the file by trading one against the other. Understanding what each count is worth, to the Crown and to you, is the core of defending these charges.

What counts as identity information

Section 402.1 defines identity information as any information, including biological or physiological information, of a type that is commonly used alone or in combination with other information to identify or purport to identify a person. That is deliberately wide, and the section's own list shows how wide.

Notice what is not required: secrecy. A name and date of birth are identity information even though both might be public. What turns ordinary data into a criminal file is the combination of whose information it is, how much of it there is, where it was found and what the Crown says you meant to do with it. A phone or a notebook holding other people's account numbers and credentials is where nearly every Markham identity file starts. It is never where the legal analysis ends.

The 2018 change most websites missed

Here is the point on which more of these cases turn than any other. Since Parliament amended the section in 2018, identity theft under s. 402.2(1) requires the Crown to prove that you obtained or possessed another person's identity information with intent to use it to commit an indictable offence that includes fraud, deceit or falsehood as an element. Intent to use. Not curiosity, not carelessness, not the bare fact that the data sat in your downloads folder.

Plenty of older summaries still circulating online describe a looser standard from the pre-2018 version of the section. That is not the law anymore, and a defence run on the current wording attacks the gap between possession and purpose. What does proven intent actually look like? Templates for false documents sitting beside the data. Accounts opened in the names on the list. Messages discussing what the credentials are worth. Staged profiles matching stolen details. When the Crown has that, the fight is elsewhere. When all it has is data on a device, the intent element is exposed, and files get won there.

The trafficking branch, s. 402.2(2), works differently: transmitting, making available, distributing, selling or offering the information of another person, knowing or being reckless as to whether it will be used for such an offence. Recklessness is a lower bar, which is why sharing a list can be treated more seriously than holding one.

Possession in the data-breach era

The uncomfortable modern reality is that other people's identity information ends up on ordinary devices in ordinary ways. Breach dumps and leaked credential lists circulate freely online and get downloaded out of curiosity. Families share laptops for years and nobody remembers whose accounts live in the browser. A second-hand phone arrives with the previous owner's digital life still in its corners. A small business keeps customer records, invoices and scanned ID on the same machine the owner takes home.

The Canadian Anti-Fraud Centre reported that identity fraud was among the top three most reported fraud types in 2025, part of a year in which Canadians lost more than $704 million to fraud. Police and prosecutors are under real pressure to treat found data as guilt. The Criminal Code says otherwise: the Crown must still prove knowledge that the data was there, control over it, and the intent to use it dishonestly.

The defence anatomy of a possession explanation has three layers. Where did the data come from, and can the arrival be dated and sourced? Who else had access to the device or the account, and can that be corroborated? And what did you actually do with the information, because months of inactivity sit awkwardly beside an allegation of intended use. Built early and supported by records rather than assertions, that anatomy has ended a lot of files before trial.

Personation under s. 403: the use offence

Identity fraud is older law with a modern engine. Section 403 makes it an offence to fraudulently personate another person, living or dead, with intent to gain an advantage for yourself or someone else, to obtain any property or an interest in property, to cause a disadvantage to the person personated or anyone else, or to avoid arrest or prosecution, or to obstruct, pervert or defeat the course of justice.

The modern engine is s. 403(2): personating includes using the person's identity information, on its own or combined with anyone else's, as if it belonged to you. Type a real person's name and date of birth into a credit application and you have personated them, whether or not you ever said a word out loud. Answer a security question with someone else's mother's maiden name, same thing. The section was built for a world of paper introductions and it fits the online world disturbingly well.

The everyday example in York Region is the traffic stop. A driver under suspension gives a sibling's name and birthdate at the roadside, the ticket goes out in the sibling's name, and weeks later there is a s. 403 charge for avoiding prosecution. It feels to people like a lie, not a fraud. In law it is both, and because the maximum is ten years, the immigration consequences dwarf whatever the original driving matter was worth. A made-up name that belongs to no real person raises different issues than a real person's identity, and sorting out which happened is one of the first things we do.

The documents around the data

Identity files often carry a third passenger: the identity documents offence in s. 56.1. Possessing, transferring or offering for sale an identity document that relates to another person, a passport, driver's licence, health card, SIN card, birth certificate and the like, is an offence with a five year maximum. But Parliament wrote the exceptions into the section itself: possession with the consent of the person the document relates to, good-faith handling in the ordinary course of business, genealogical purposes, and purposes connected to the administration of justice. A spouse carrying a spouse's health card, a bookkeeper holding scanned licences for payroll, an executor sorting a parent's papers: the section itself answers those files, without lawful excuse ever becoming a jury question.

Where the documents were not genuine, the analysis shifts from identity law to forgery: making a false document, or using one as if it were real, under ss. 366 to 368. That is its own body of law with its own defences, covered on our Markham forgery lawyer page. And where what was possessed or used was card numbers rather than documents, the credit card data offences take over; our Markham credit card fraud lawyer page unpacks that stack. The boundaries matter because each cluster carries different maxima and different collateral consequences, and the count that survives resolution should be chosen, not accepted.

How identity files are built in York Region

These prosecutions follow a pipeline, and knowing where a file sits in it changes what a defence lawyer can do. Most start with a victim discovering an account they never opened. York Regional Police accepts identity theft and fraud reports through its online reporting system, which is expressly built for situations where personal information such as a name, date of birth or financial information has been obtained or used without permission. Other reports arrive through the Canadian Anti-Fraud Centre or directly from a bank's fraud team, which usually attaches its own investigation file before a detective ever opens the matter.

From there the work is digital. YRP's Investigative Services includes dedicated Cybercrime and Digital Forensics units, and identity files are precisely the files they exist for: production orders to banks, telecoms and platforms; IP and account records; and above all the seized phone or laptop, which is usually the centrepiece of the Crown's case. Markham itself is policed from 5 District at 8700 McCowan Road, but the device work happens at the regional level.

That centrepiece is also the pressure point. In R. v. Fearon the Supreme Court confined phone searches on arrest to what is truly incidental to the arrest, tailored in scope and documented in detail; broader examination generally requires a warrant, and warrants themselves can be challenged. When the search fails, the data goes, and identity prosecutions rarely survive the loss of the device evidence. Every one of these files deserves a search-and-seizure autopsy before anyone discusses a plea.

When the identity counts meet a fraud count

If the information alleges that money, credit or goods actually moved, expect a fraud count under s. 380 sitting beside the identity counts. The division of labour is simple: the identity sections punish the method, and the fraud section measures the money. Fraud over $5,000 is straight indictable with a fourteen year maximum; under $5,000 it is hybrid with far more room to move. And fraud has its own elements, dishonesty and deprivation, with deprivation including money merely put at risk, so the Crown does not need a completed loss.

For the defence, the combined information cuts both ways. It raises the stakes, because the fraud count can outweigh the identity counts on sentence. But it also multiplies the Crown's burdens: intent to use under s. 402.2, the personation intents under s. 403 and the dishonesty of the s. 380 count each have to be proven separately, and a crack in one often spreads. Our Markham fraud defence lawyer page maps that side of the file, including the $5,000 fork that decides how heavy the combined sheet really is.

If your identity was the one used

A short word for the other side of these files, because the calls come in and the answer matters. If someone has used your name, your SIN or your accounts, follow the sequence York Regional Police itself recommends: contact your bank, card issuers and any affected agency first, cancel what is compromised, and keep every paper and receipt. Then report it, through YRP's online reporting system and to the Canadian Anti-Fraud Centre. If the person responsible is convicted, the Criminal Code lets the court order them to repay your documented costs of re-establishing your identity, including replacing documents and correcting your credit history.

To be plain about what we do: Kazandji Law acts for people accused of these offences, not for complainants. But that restitution provision cuts across both sides, and our clients need to understand it from the defence chair, because a realistic restitution plan is often part of how an identity file resolves.

Process, penalties and the immigration asymmetry

Both offences are hybrid, so the Crown chooses between summary conviction and indictment. On indictment, identity theft carries up to five years and identity fraud up to ten. Neither reaches the fourteen year threshold that s. 535 sets for a preliminary inquiry, so there is none; the case proceeds at the Ontario Court of Justice, with a Superior Court election available on indictment. In York Region all of it, bail included, happens in one building at 50 Eagle Street West in Newmarket, and routine case-management appearances usually proceed virtually. Neither charge is in the small class of offences reserved for Superior Court bail, so any bail hearing happens quickly and locally.

Now the asymmetry that quietly runs these files for anyone who is not a Canadian citizen. Because identity fraud carries a ten year maximum, a conviction under s. 403 is serious criminality under immigration law for permanent residents and foreign nationals no matter what sentence is imposed. An absolute discharge of a permanent resident on a s. 403 count and a jail sentence can sit in the same immigration category. Identity theft under s. 402.2, with its five year maximum, generally reaches serious criminality only where the actual sentence exceeds six months. So for a non-citizen, resolving a two-count information to the s. 402.2 count instead of the s. 403 count is not horse-trading, it is the whole game. We build that analysis into the file from the first meeting, alongside the criminal defence.

The defences that actually work

Every identity file is a story about how data got where police found it, and the recurring winners track that story.

• No intent to use. The post-2018 shield. Data on a device is not a crime; the Crown must prove purpose, and gaps between possession and any dishonest step are defence territory.
• No knowledge or control. Shared computers, family tablets, second-hand phones, roommates on one wifi network. Possession in law requires knowledge and control, and multi-user devices raise real doubt about both.
• Consent and lawful excuse. For documents, s. 56.1 builds the defences into the section: consent, ordinary business, genealogy, administration of justice.
• Attribution. Proving an account was used is easy; proving who was at the keyboard is not. Logins, IP records and device fingerprints identify machines, not hands.
• Charter exclusion. Phone searches that overrun the Fearon limits and warrants that fail scrutiny take the core evidence with them when they fall.

Which defence fits depends on the disclosure, and identity disclosure rewards patience: extraction reports, audit logs and production-order returns tend to contain more doubt than the synopsis ever admits.

The early moves in a Markham identity file

What you do in the first two weeks matters more than anything that happens in the first two months of court dates. The pattern of these files rewards a handful of early moves.

• Do not explain the data. Not to the officer who calls, not to the bank investigator, not in a message to the person whose name came up. Identity files are intent files, and casual explanations get reread later as admissions about knowledge and purpose.
• Do not volunteer devices or passwords. If police have a warrant, comply with it; what you are not required to do is hand over accounts and unlock codes on request. Decisions about cooperation belong in a lawyer's office, made once, deliberately.
• Preserve, never delete. Wiping a device or scrubbing accounts after police contact looks like consciousness of guilt, can destroy the material that would have explained the data innocently, and can generate new allegations on its own.
• Write the access map. Who used the computer, who knew the wifi password, who owned the phone before you, which accounts were shared. In a possession case, that map is the defence, and it is far easier to build now than a year from now.
• Get counsel before any interview. The invitation to come in and clear things up arrives when the investigation is essentially complete. Treat it accordingly.

How identity files tend to resolve

Very few of these prosecutions end in a trial verdict. Files where the Crown cannot connect possession to purpose get withdrawn or resolve to lesser counts, and pushing the intent problem into the Crown's view early, on paper, is often what triggers that. Where the evidence is stronger, the work shifts to shaping the outcome: which count carries the plea, what the sentence protects, and what happens to the record.

The tools are the ordinary ones of criminal practice, applied with identity-specific judgment. A discharge, where guilt is found but no conviction registers, can preserve a career and, on the five year count, an immigration status. Restitution tied to the complainant's documented costs of re-establishing their identity speaks directly to what these offences actually do to victims, and courts take it seriously. And for non-citizens, the asymmetry between the two sections means the shape of the resolution is negotiated with one eye on immigration law throughout. None of this is automatic, and none of it should be promised by a website. It is what careful preparation makes available.

Why Markham clients call Kazandji Law

Identity files are technical twice over, once in the law and once in the evidence, and they punish generic defence work. Fadi Matthew Kazandji, our founding partner, runs these prosecutions personally, from the first review of the extraction report to the last submission at 50 Eagle Street West. Clients in Markham are served from our Thornhill office at 7191 Yonge Street, Suite 310, the closest of our four offices, alongside downtown Toronto at 180 John Street, Unit 320, North York and Oakville.

The related pages on this site work as a set. The Markham fraud defence lawyer page maps the s. 380 side of a combined file, and the Markham theft defence lawyer page covers property counts that often ride along. For the same identity offences charged downtown, see our Toronto identity theft lawyers page; for the provincial statutory picture, our Ontario identity theft lawyers page and the Ontario fraud defence lawyers hub.

Identity theft charges in Markham: your questions answered

This page is general legal information about identity theft, identity fraud and identity document offences in Canada, not legal advice about your situation. Criminal Code provisions described are current to July 2026. Every file turns on its own facts; speak with a lawyer before making decisions. Kazandji Law defends identity, fraud and forgery charges in Markham, across York Region and throughout the Greater Toronto Area. Call 647-588-3234 for a free consultation.