New Equifax Canada data exposes gaps between scam recognition and safe online behaviour — a timely opening for advisor-client conversations
Most Canadians think they can spot a scam. Few take the steps that would actually protect them if one succeeded. A new Equifax Canada survey, released October 27, 2026, puts that disconnect into focus. It also hands advisors a ready-made conversation for Cybersecurity Awareness Month.
The survey, conducted by Leger among 1,525 Canadian adults aged 18 and older, found 83 percent feel confident identifying fraudulent communications. Yet just 22 percent are “very confident” — and 65 percent have already encountered fraudulent messages or content in the past year.
What do the gaps in Canadians’ cybersecurity habits mean for advisors?
Password hygiene is a useful entry point for client conversations. Only half of Canadians surveyed use unique passwords for important accounts, and 22 percent reuse the same two or three passwords across multiple sites.
Equifax Canada noted that reuse has grown riskier as automated tools can exploit a single breach to access a wide range of accounts. Only 58 percent use multi-factor authentication on their financial and social media accounts.
Fraudulent contact is already widespread. Over the past 12 months, 37 percent of respondents encountered emails or texts pretending to be Canadian banks or government agencies. A further 36 percent received fake alerts claiming someone had accessed their banking or social media accounts.
Fraudulent investment opportunities were reported by 26 percent, as were fake social media messages impersonating trusted brands or public figures.
British Columbians showed the highest exposure nationally, with 75 percent reporting at least one fraudulent encounter in the past 12 months. In Quebec, that figure was 53 percent.
Fraud tactics are evolving — AI-driven scams are now among the most pressing concerns facing Canadian advisors.
What happens when Canadians receive a data breach notification?
The survey’s most striking finding may be how Canadians respond once a breach occurs — or don’t.
Among respondents aged 18 to 34, one in five say they would ignore a data breach notification. They would wait instead for suspicious activity to appear before taking action. That figure drops to 11 percent for Canadians aged 55 and older. Nationally, 14 percent take the same wait-and-see approach.
Even among those who say they would act, the response is uneven. Two-thirds — 66 percent — said they would reach out to their bank or financial institution.
Fewer than half (44 percent) would reset the password on the compromised account. Just 24 percent would call a credit bureau to set up a fraud alert.
“One of the biggest mistakes consumers make is assuming that nothing needs to be done until suspicious activity appears,” said Octavia Howell, chief information security officer at Equifax Canada. “If your personal information has been exposed, it’s important to take the notification seriously, secure affected accounts and watch for unusual activity.”
Younger clients are particularly likely to delay action after a breach notification. For advisors with a broad book, that demographic skew is worth addressing directly in cybersecurity conversations.
For Canadian advisors, the stakes extend well beyond individual client accounts - fraud protection has become part of their duty of care.
How can financial advisors use cybersecurity data to protect clients?
The Equifax Canada data offers advisors a concrete framework for proactive client conversations. The most relevant entry points are bank impersonation, fake account alerts, and cybersecurity breach response steps.
Advisors who address these topics directly can differentiate their practice and build lasting trust. Clients walked through breach response steps are better positioned to act quickly. They are also less likely to make a costly mistake under pressure.
The survey findings connect to a broader pattern in practice management. One advisor found her cybersecurity client event was among her best-attended sessions. The appetite for this guidance already exists — advisors just need to use it.
Equifax Canada recommends Canadians regularly review their credit reports and use unique passwords and multi-factor authentication. It also advises independently verifying unexpected communications before sharing personal or financial information. For advisors, relaying those steps in a client email or annual review is a low-effort starting point with measurable protective value.
