​​Secure Canada’s Digital Identity to Combat Fraud

Summary

Proving identity online is already a routine part of most people’s lives and Canadians expect to have secure, privacy-preserving and fraud-proof ways to show who they are online. But, today's systems are failing to deliver. AI-powered tools can fool not only most laypeople but also trained professionals, leading to massive fraud that costs billions and undermines trust in digital services. The deepfake threat in particular - where AI tools are used to impersonate real people - is exploding, with incidents increasing tenfold in recent years¹.

The federal government can address a core part of this problem quickly and with little cost by recognising credential standards that use existing forms of physical ID in the digital world, partner with major tech platforms like Apple and Google, and launch pilot programs at major airports in support of these changes. These technologies will transform and streamline how Canadians interact with government and business online while dramatically reducing criminal activity like fraud and money laundering.

Background and Motivation

Identity verification is already part of every life. Every day, Canadians prove their identity to access banking, healthcare, government services, transportation, and professional accounts. You have likely verified yourself online in the last year by scanning a government ID, or inferring identity through a digital bank or government account. But, these systems aren’t perfect and can be exploited by criminals. In 2024, fraud and cybercrime cost individual Canadians $638 million² with the majority of this coming from identity theft. And, the impact is worse for businesses. One-in-six Canadian businesses were impacted by cyber security incidents in 2023 costing $1.2 billion in direct fraud - with almost a third of incidents coming from identity fraud. And, as a result, they spent an additional $11 billion in preventative measures³. 

Artificial intelligence is poised to make this problem much worse. These new technologies are undermining the ID verification tools that have been used successfully for over a decade. Fraudsters can now easily produce synthetic identities, and use free software to create deepfakes with convincing voices and video from just minutes of recordings.

The problem is growing fast. Deepfake fraud incidents increased tenfold in just one year from 2022 to 2023. And, the impacts are serious. Globally, companies have lost on average almost half a million dollars USD to deepfake scams⁴. One company lost $25 million USD when criminals used a deepfake video call to impersonate their CFO⁵. In the first quarter of 2025 alone, over $200 million USD was stolen globally through deepfake fraud⁷.

The problem isn't just money. When people and businesses don’t know with certainty who they are communicating with or if the content they are interacting with is authentic, the trust that is essential for our society to operate collapses.

But there are new international standards for digital identity, like mobile documents (mDocs), that can solve these problems. mDocs works by turning existing government IDs into secure digital credentials that can be stored on your phone using military-grade encryption⁷. When someone needs to verify identity, the phone proves authenticity through cryptographic signatures that are impossible to fake.

This not only avoids the need for new databases or tracking systems, meaning no costly government-run software projects. It also creates a standard that is technically impossible for the government to see where Canadians use their ID, meaning no impacts to privacy.

The technology is already proven. Apple's iOS 26, coming this fall, supports TSA-approved digital passports⁸. Amazon plans to accept mobile driver's licenses this year⁹. Over 37 of the world's 50 largest economies have implemented similar systems mostly through linking physical IDs to a digital counterpart, although few yet have broad deployment¹⁰.

Today, when opening a bank account online Sarah might prove her identity by uploading photos of her driver's license, completing a liveness check - through the phone’s front-facing camera - and perhaps having a video call with a bank representative. But, with faked physical ID documents, imagery and deepfakes, criminals could easily create an account unbeknownst to a real impersonated identity, or under the name of a fabricated person. This account could then be used to facilitate fraud or money laundering.

Cryptographically provable digital identity makes these crimes much more difficult. Instead of uploading document photos, Sarah would receive a request on her phone. She'd tap “approve”, and her device would prove her identity directly from a digital copy of her government-issued documents. A liveness match could be paired with this to ensure the person using the phone is biometrically matched to the identity. The bank gets instant, fraud-proof confirmation that she's really Sarah, and Sarah never shares more personal information than is necessary.

The Canadian federal government can be the global leader in safe, secure, private digital ID while simplifying every Canadian’s life and it won’t require any investment in new software, complex technical work to create new standards, or impacts to privacy. The changes could be made in three steps: officially recognize digital passports as equivalent to physical ones, partner with tech companies to make them work seamlessly in Canadian smartphones, launch high-visibility pilots at major airports to build public trust and familiarity, and upon successful testing, promote broad adoption across the country.

What Must Be Done

Create the Digital Credentials Recognition Act authorizing Parliament to designate government-issued digital credentials as legally equivalent to physical documents for federal purposes such as voting under the Canada Elections Act, compliance under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, and travel under the Canadian Passport Order. Immigration, Refugees and Citizenship Canada would issue an ICAO-compliant Digital Travel Credential alongside passports. Parliament would amend the Elections Act, PCMLTFA regulations, and Passport Order to explicitly recognize digital credentials, creating clear legal authority for their use in voting, financial services, and border control.

Innovation, Science and Economic Development Canada should negotiate technical partnerships with Apple, Google, and Microsoft to integrate Canadian digital passports into their wallet platforms. This mirrors successful arrangements between US federal and state governments and tech companies for passports and state IDs. The Canadian Centre for Cyber Security will oversee security compliance and cryptographic key management.

Transport Canada and the Canadian Air Transport Security Authority should launch pilot programs at Toronto Pearson, Vancouver, and Montreal airports accepting digital passports for domestic and international travel. This creates the high-visibility use case needed to drive public adoption while demonstrating the technology's reliability and convenience.

Common Questions

Isn't this just creating a surveillance system that tracks everything Canadians do online? Digital passports enhance privacy compared to current methods. The system uses the same information already on physical passports to create a tamper-proof copy of your existing identity document on your phone. This means no new ways of tracking individuals and the government doesn't receive any additional information when citizens use their digital credentials. Canadians will control exactly what they share.

What happens when hackers inevitably break into this system and steal everyone's identity? The cryptographic design makes this scenario nearly impossible. Digital credentials are stored in the secure element of smartphones, the same technology protecting banking apps and mobile payments. Even if someone steals your phone, they need your biometrics or PIN to access credentials. The distributed nature means there's no central database to hack, unlike current systems where a security breach could impact many users..

Why should taxpayers support tech company partnerships when we could build our own Canadian solution? Building a separate Canadian platform would cost billions in development and ongoing maintenance and take years while citizens and businesses remain vulnerable to fraud and money laundering. In addition, a myriad of proprietary ‘identity wallets’ delivered by different levels of government with limited interoperability and support by businesses is wasteful and unnecessarily complex. Partnering with existing ecosystems delivers results immediately at minimal cost, and ensures broad support by ecosystem partners. Governments that tried building their own systems, like Ontario's delayed digital ID project, often face years of setbacks and budget overruns of hundreds of millions, as seen with Quebec's SAAQclic digital transformation. In this scenario there would be little cost to the government beyond making explicit their support for the system.

Conclusion

The deepfake revolution has made Canada's current identity systems dangerously obsolete. Every month of delay costs Canadians millions in criminal activity while undermining trust in digital services that power modern economic life and society. But, solutions exist today through proven international standards and technology already deployed by leading nations and companies.

The federal government should recognize digital passports, partner with major tech platforms, and launch airport pilots to establish Canada as the global leader in secure digital identity. These actions will protect citizens from sophisticated AI-powered criminal activity, restore trust in online interactions, and position Canada at the forefront of the next generation AI-driven digital economy.

‍

If these ideas resonate and you want help to build Canada sign up to join the movement today to be the first to hear about events and volunteer opportunities.