Equifax Canada survey exposes Canadians' cybersecurity confidence gap

Equifax Canada data shows 83% of Canadians feel scam-savvy, yet basic protections like MFA and unique passwords remain widely neglected.

By Disrupts Editorial Team Mon, 2 November 2026 AI level 2 of 5

AI level 2 of 5: drafted by our AI editorial assistant from the company's announcement; fact-checked, edited and signed off by Mark Walker, Editorial Director. What the levels mean

A modern control room features a large eight-screen display wall showing numeric lists, various charts, and complex network diagrams, with rows of empty office chairs and desks in the foreground, illuminated by natural light from large wind

Equifax Canada has published survey findings that lay bare a striking contradiction at the heart of Canadian consumer cybersecurity: four in five Canadians believe they can identify a scam, yet fewer than half use the basic defences that would protect them when they cannot.

The data, gathered by polling firm Leger across a panel of 1,525 Canadian adults in October 2026, found that 83 per cent of respondents expressed confidence in distinguishing fraudulent communications from legitimate ones. Only 22 per cent, however, described that confidence as "very confident." Meanwhile, 65 per cent reported encountering at least one fraudulent message or piece of online content in the preceding twelve months, suggesting scam exposure is close to universal.

The protection gap in numbers

The behavioural data is the sharper story. Just 58 per cent of respondents use multi-factor authentication (MFA) across their financial and social media accounts, and only half use unique passwords for important accounts. More than one in five admit to recycling the same two or three passwords across multiple sites, a practice that leaves them exposed to credential-stuffing attacks, where automated tools harvest login pairs leaked in one breach and test them against banking, e-commerce, and email platforms at scale.

The most frequently encountered scams in the past year were bank and government impersonation messages (37 per cent of respondents), fake account-access alerts (36 per cent), fraudulent investment solicitations (26 per cent), and deepfake-style social media content impersonating trusted brands or public figures (26 per cent). The regional spread is notable: 75 per cent of British Columbians reported encountering at least one fraudulent communication, compared with 53 per cent in Quebec.

Response behaviour after a breach notification reveals an equally concerning passivity. Nationally, 14 per cent of respondents said they would take a wait-and-see approach after receiving a data-breach alert, declining to act until suspicious activity appeared. Among 18-to-34-year-olds, that figure rose to 20 per cent. Only 24 per cent of all respondents said they would contact a credit bureau to place a fraud alert, a step that is often the most effective early intervention.

"One of the biggest mistakes consumers make is assuming that nothing needs to be done until suspicious activity appears," said Octavia Howell, Chief Information Security Officer at Equifax Canada. "If your personal information has been exposed, it's important to take the notification seriously, secure affected accounts and watch for unusual activity."

The macro convergence beneath the survey

For cross-sector strategists, the numbers carry implications beyond consumer awareness campaigns. The persistent gap between perceived and actual cyber hygiene maps directly onto systemic financial-sector risk. Canadian banks, insurance companies, and fintech platforms inherit the consequence of weak consumer credential practices: credential-stuffing attacks on financial services have risen in step with the volume of leaked password databases circulating on dark-web marketplaces. When a consumer reuses a password breached from a retail loyalty scheme, the downstream exposure lands on their bank.

The survey also arrives at a moment when AI-generated phishing content, voice cloning, and synthetic social-media impersonation are dramatically lowering the skill threshold for fraud. Equifax's own finding that 26 per cent of Canadians encountered deepfake-style impersonation content in a single year suggests the problem is scaling faster than consumer awareness programmes can address. For insurers, digital-identity platforms, and regulators, the convergence of generative AI with commodity fraud tooling is rewriting the threat model for retail financial crime at a population level.

Equifax Canada's commercial interest in the findings is transparent: the release closes with a recommendation that consumers consider its own subscription-based identity-protection product. That context should be held alongside the data. Even so, the underlying survey figures align with comparable research from cybersecurity vendors and government bodies across G7 markets, pointing to a structural, not merely Canadian, consumer-behaviour deficit that financial institutions and digital-identity investors are increasingly pricing into their risk frameworks.