How to protect your passwords from fraud and identity theft

By Michael McCullough on September 4, 2025
Estimated reading time: 4 minutes

Using strong passwords—and different ones for every site—can help you protect yourself against digital fraud and identity theft. Here’s how to protect yourself.

At least until we are a completely passwordless society, however, usernames and passwords and an additional authentication factor are the best defense we have against the spread of digital fraud and identity theft. It’s worth putting in the effort to come up with and keep track of different passwords for each of our accounts.

“Enabling strong authentication methods is one thing that I fight with even my own family members about,” says Octavia Howell, vice-president and chief information security officer for credit bureau Equifax Canada.

Think of usernames, passwords, and multi-factor authentication as more lines of defense for your identity online, she advises. Multi-factor authentication adds an extra layer of protection by combining different authentication factors, such as something you know, something you have, or something you are. If one of the organizations you deal with suffers a data breach, enabling this extra layer of protection for your online identity can help contain the damage and prevent it from spreading to the other sites and accounts you use. They may help keep you from becoming a victim of identity theft.

“It’s not a matter of if, it’s a matter of when your information will be compromised. Most of your information is likely already compromised,” Howell says.

Good authentication practices make it harder for fraudsters to obtain more information about you and assume your identity for the purposes of fraud. Here are Howell’s tips and dos and don’ts.

Password practices to avoid

Too many users simply reuse the same username and password across multiple accounts, Howell says. Say criminals gain access to your streaming service account. If you use the same password for an email account, it’s as good as compromised. That may expose more information on you, your friends and your associates.

Another mistake is to use passwords that are easy to guess, such as your children’s name plus “123” and an exclamation point for a special character. Don’t include a pet’s name or a street address, either. Remember, hackers now get help from artificial intelligence (AI) to try thousands of combinations of these clues to gain access to your accounts. (Learn more about AI and identity theft.)

Best password practices

Howell recommends using multiple usernames and different passwords for all your online accounts. Here are some more tips to improve your password hygiene:

Article Continues Below Advertisement

Google yourself to get a sense of what information about you is readily available online—and don’t use any of it in your passwords.
Use phrases that are meaningful to you but no one else—for example, places, dates, or special numbers and activities that stick in your mind. Rearrange the words and numbers in ways that don’t repeat key phrases found online.
Consider using strong passwords provided by the platform, but only if you always access the site from the same device or if you use a password safe, also known as a password manager.
Use the strongest passwords for the sites containing the most sensitive information. An optometrist’s portal that just contains your eyeglass prescription need not be as complicated, but your online banking is a different matter. “You want to put the right level of security based on the information on each site,” Howell says.
If multi-factor authentication is available, take the time to enable it. This provides the extra layer of protection and can even serve as an early warning sign that your credentials have been compromised.

Equifax Complete Protection

Go to site

Equifax Complete Protection is a credit and cybersecurity protection service designed to help Canadians spot the signs of identity fraud faster.

Provides daily credit monitoring and alerts
Scans for your personal data on the dark web
Social media monitoring by industry leader ZeroFox

Subscription price: $34.95 per month

Go to site

For extra password protection

For added protection, consider subscribing to a broader suite of fraud prevention tools that includes a password manager. Equifax Complete^™Protection is a comprehensive identity protection service that includes credit monitoring, social media monitoring, device protection, and a password manager, among other features.

Equifax Complete Protection’s password manager keeps track of your usernames and passwords in a safe place not tied to your email or browser. Each time you register a new account or change your password, simply load the keys into the password manager for future reference.

A subscription to Equifax Complete Protection costs $34.95 per month.

This article is sponsored.

This is a paid post that is informative but also may feature a client’s product or service. These posts are written, edited and produced by MoneySense with assigned freelancers.

About Michael McCullough

Michael is a financial writer and editor in Duncan, B.C. He’s a former managing editor of Canadian Business and editorial director of Canada Wide Media. He also writes for The Globe and Mail and BCBusiness.

Linkedin Twitter