Digital Cybercrime in Canada: How Criminals Are Weaponizing the Emergence of Artificial Intelligence

by AK

Introduction

Artificial intelligence (“AI”) has transformed the world as we know it. Whether it be the economy, academic research, science, finance, or healthcare, every facet of life has been touched by AI. Unfortunately, like all new inventions, AI can fall into the wrong hands. Indeed, the use of AI by criminals is a growing challenge for law enforcement and policymakers in Canada. Criminals are now utilizing AI to engage in what is coined “cybercrime.”[i] Such examples include fraud and identity theft–these have been revolutionized by criminals with the use of AI, and the data supports this. While there are legislative protections against such crimes, there have been recent efforts by governments to modernize Canadian policy. Thus, this blog explores the rise of AI in cybercrime, what policy safeguards are currently in place, and what is being explored for the future.

Canada’s Legal Framework: Fraud and Identity Theft

As detailed in s. 380 of the Criminal Code (Code), fraud is broadly defined as any act which, through deceit, falsehood or any other fraudulent means, deprives a person of money, property or any valuable security or service (with a mandatory minimum of two-years in prison when the value exceeds $1 million).[ii] Likewise, if the value of the offence is less than $5,000, the convicted person would face either a prison sentence of up to 2 years or a summary conviction.[iii] There is also a maximum prison sentence of up to 14 years if the value of the offence exceeds $5,000, or, if the offence involves a will/testamentary instrument.[iv] Fraudulently manipulating public markets or shares is also a significant offence, as it can result in imprisonment for up to 14 years.[v] It is clear that there are significant prohibitory consequences for engaging in fraud. Relatedly, identity theft is also a serious crime in Canada, and it is closely linked to fraud. As per s. 402.2(1) of the Code, the legal definition of identity theft is as follows: “every person commits an offence who obtains or possesses another person’s identity information with intent to use it to commit an indictable offence that includes fraud, deceit or falsehood as an element of the offence.”[vi] Further, under the Code, the sale or distribution of another person’s identity information is illegal.[vii] A conviction of identity theft can result in imprisonment of up to five years.[viii] The key difference between identity theft and fraud is that identity theft involves someone’s personal information being compromised or stolen, with the intent to use it to commit a crime, whereas fraud involves deceiving someone to gain or cause loss, regardless of the method used.

Canada’s rigorous legislative protections against fraud and identity theft have been around for a long time and for good reason. Yet, while the Code provides a solid legal foundation for addressing these crimes, the rise of AI and its manipulation by criminals has posed significant challenges to this traditional legal framework.

A New Era of Cyber Deception: The Weaponization of AI  

While it is true that Canada has a strong legal framework of deterrence for fraud and identity theft, there has been an increase in both of its occurrences in recent years. Fraud, for instance, has been growing on a larger scale. As per the Canadian Anti-Fraud Centre (CAFC), a total of $643 million was stolen from Canadians by means of fraud in 2024–a nearly 300% increase since 2020.[ix] In 2024, the total number of fraud reports received and processed was 51,999.[x] That same year, the total number of victims of fraud were 36,248.[xi] Canadians are also growing more frustrated with the risk of fraud, as a recent Equifax survey found that 89% want there to be stronger protection for personal data.[xii] What’s even more striking is that, according to CAFC, most victims do not report fraud. Moreover, CAFC estimates that the numbers reported only represent 5 to 10% of total fraud losses in Canada.[xiii] At the same time, identity theft, like fraud, is also on the rise in Canada. In 2022, the CAFC observed an increase in identity theft reports, receiving 19,543.[xiv] Seniors and people in vulnerable communities in Canada are especially at risk of identity theft.[xv] Almost every facet of these victims’ life has been affected. Such examples are those seeking to get mortgages for a new home, or loans for a new car.[xvi] There is a strong link between fraud and identity theft. As recently reported by the RCMP, the highest proportion of victims of fraud in Canada in 2024 were those who experienced identity theft.[xvii]

Statistics and public data make it clear that these crimes are on the rise. However, what is significant is the role AI has played in driving these trends. As detailed by the Competition Bureau of Canada, an independent law enforcement agency, the increase of fraud in Canada “shows that fraudsters are becoming more skilled, and technology like AI is helping them improve their old tricks.”[xviii] This sentiment has been echoed across the country. The Royal Bank of Canada declared on September 24, 2025, for instance, that “artificial intelligence is a useful tool for everyday productivity, but it has also become a weapon for cyber criminals who are targeting Canadians’ personal data with increasingly sophisticated threats.”[xix] Indeed, the use of AI in Canada has been weaponized by criminals to engage in fraud and identity theft, turning these crimes into “cybercrime.”[xx] CGI, the largest IT and business consulting firm in the world, recently noted that in Canada, “fraudsters are now leveraging real-time deepfakes–AI generated video and audio that mimic a person’s voice, appearance, and movements in real time–to execute various fraudulent schemes.”[xxi] This has had major repercussions for private enterprise in Canada, as many are now questioning whether modern software is adept enough to handle criminals who use AI. A 2024 Gartner report predicted that by 2026, “30% of enterprises will no longer consider identity verification and authentication solutions reliable in isolation due to deepfakes.”[xxii] It is worthwhile to mention that the profound effects of AI-driven crime have not been confined to Canada. Rather, there have been some notable examples seen on an international scale. In Hong Kong, for instance, a financial executive was tricked by a deepfake impersonating his CFO, which resulted in $25 million dollars being stolen.[xxiii] In the United Kingdom, it was reported by British universities that students were fraudulently getting admission into schools by using deepfakes during online interviews.[xxiv]

Policy Responses: The Fight Against AI Cybercrime

Currently in Canada, there is no regulatory framework or specific federal law governing AI and cybersecurity. However, policy makers are moving fast to develop concrete solutions to address the growing threats relating to cybercrime, fraud, and identity theft. In June 2022, the Artificial Intelligence and Data Act (AIDA) was tabled in the House of Commons.[xxv] This comprehensive legislation was embedded within Bill C-27, also known as the Digital Charter Implementation Act.[xxvi] Although AIDA died when Parliament prorogated in early 2025,[xxvii] its framework remains important and serves as a valuable example of a proactive and creative policy response to the threats posed by artificial intelligence and cybercrime. AIDA was founded on the premise that, while the Code codifies most of the criminal offences in Canada, its application to the uses of new and modern technology “involves some uncertainty and novelty.”[xxviii] Thus, recognizing a legislative gap in the Code, AIDA targeted AI-specific conduct by introducing three new criminal offences in Canada which “directly prohibit and address specific behaviors of concern” relating to the use of AI by criminals.[xxix]

Each of these three new offences includes unique mental elements. The first offence addressed the issue of where someone knowingly possesses or unlawfully uses personal information with the goal of designing, developing, using or making available to use for an AI system.[xxx] Such an example would be “knowingly using personal information obtained from a data breach to train an AI system.”[xxxi] Furthermore, this offence requires that the offender possess knowledge that the personal information was unlawfully obtained.[xxxii] The second offence prohibited making an AI system “available for use, knowing, or being reckless as to whether it is likely to cause serious harm or substantial damage to property, where its use actually causes such harm or damage.”[xxxiii] Here, the mental element required is the offender possessing knowledge or recklessness with relation to the risk of serious harm.[xxxiv] Lastly, the third criminal offence related to anyone who makes an AI system available for use and has the intention to defraud the public and cause economic loss to a specific individual.[xxxv] This third offence required there to actually be economic loss as a result.[xxxvi] In this case, the mental element is the intention to defraud, combined with the intention to cause economic loss.[xxxvii] All three of these offences would have been investigated by law enforcement and the Public Prosecution Service of Canada would have jurisdiction to prosecute such crimes.[xxxviii]

AIDA represented a pivotal moment in Canada’s effort to modernize its response to the weaponization of AI. Unfortunately, AIDA failed on September 16, 2024, when the federal election was called.[xxxix] As a result of the election being called, the House of Commons was dissolved, and thus all legislation which had not passed at that specific time were discarded.[xl] Although AIDA did not become law, and though it received some scrutiny from media for its lack of public consultation process and what was seen as a lack of scope,[xli] it offered serious and profound changes to the regulation of AI and its relation to criminal prohibitions in Canada. If enacted, this legislation would have directly targeted the ways in which criminals utilize AI to engage in fraud and identity theft. The current Government of Canada is currently in the process of advancing initiatives which build on the innovative spirit of AIDA. This includes the 2025 National Cyber Security Strategy, a strategic framework which focuses both on public awareness campaigns and introducing enhancements to threat monitoring and intelligence sharing.[xlii] This is currently in force in Canada. Another example is the National Anti-Fraud Strategy, which, through legislative amendments, combats financial fraud by amending the Bank Act to be more rigorous in its personal data security.[xliii] Though no legislative change has been announced yet, the Minister of Finance has recently noted that the government is currently reviewing this initiative as part of Budget 2025.[xliv] Lastly, the AI Compute Access Fund is a fiscal initiative which invests up to $300 million in scaling Canada’s AI industry, increasing productivity in AI, and creating “groundbreaking, made-in-Canada AI solutions.”[xlv] This is currently being implemented as part of Budget 2025.[xlvi] All three initiatives seek to build off AIDA and introduce innovative solutions to the emergence of AI.

While Canada has taken encouraging steps in its response to the increasing threats of cybercrimes, significant gaps remain. Canada requires a comprehensive AI framework which both targets the crimes being committed and proactively discourages them. This framework should include clear definitions and high standards. Law enforcement will require long-term funding for keeping up with the rapidly changing digital landscape, and the federal government should work with the provincial governments across Canada to ensure efficient resources are being provided. On-going reform is needed, and it must be maintained by clear oversight and benchmarks to assess results and success.

It is also important to note that while AI has been weaponized by criminals, it also offers innovative benefits for counteracting crime. Financial institutions in Canada, for instance, are beginning to use AI-based anomaly detection and automatic risk scoring to quickly identify threats.[xlvii] These new tools enable institutions to flag suspicious transactions and help verify identities. Yet, utilizing AI in itself cannot fully counter the rise in digital crime, and the need for government reform and regulatory safeguards remains essential going forward.

Conclusion

The exponential growth of AI is a  both an opportunitiyopportunity and amounting issue in Canada and is playing a significant role in the increase in cybercrimes. While Canada has protective measures against crimes such as fraud and identity theft, policymakers are moving quickly to both introduce and amend laws to combat the increasing threat of AI. While AIDA had the right intentions, it also failed to come to fruition. Nevertheless, its spirit continues to influence the federal government’s policies and strategies. In the digital era, these initiatives reflect a trend that shows more and more Canadians are thinking about how the use of AI should be safeguarded and secure. However, legislation only goes so far, and thus Canadians must be adaptable and prepared for the ever-changing evolution of AI and the risks it poses to cybersecurity.

Endnotes

[i] Canadian Anti-Fraud Centre, Annual Report 2022 (Canada: Canadian Anti-Fraud Centre, 2022) [Report].

[ii] Criminal Code, RSC 1985, c C-46, s 380.

[iii] Ibid.

[iv] Ibid.

[v] Ibid.

[vi] Ibid, s 402.2(1).

[vii] Ibid, s 402.2(2)

[viii]Ibid, s 402.2(5).

[ix] Department of Finance Canada, News Release, “Combatting financial fraud, protecting Canadians against scams and abuse” (20 Oct 2025), online: < https://www.canada.ca/en/department-finance/news/2025/10/combatting-financial-fraud-protecting-canadians-against-scams-and-abuse.html> [Combatting].

[x] Canadian Anti-Fraud Centre, “Recent Scams and Frauds” (30 Sept 2025), online: < https://antifraudcentre-centreantifraude.ca/index-eng.htm>.

[xi] Ibid.

[xii] Equifax, News Release, “Fraud Concerns are Escalating with 89 per cent of Canadians Saying Companies Must Do More” (4 March 2025), online: < https://www.equifax.ca/about-equifax/newsroom/-/intlpress/fraud-concerns-are-escalating-with-89-per-cent-of-canadians-saying-companies-must-do-more/>.

[xiii] Combatting, supra note 9.

[xiv] Report, supra note 1.

[xv] Ibid.

[xvi] Ibid.

[xvii] Patricia Vasylchuk, “The cost of fraud exceeds financial lost, victims say” (14 March 2025), online: < https://rcmp.ca/en/gazette/cost-fraud-exceeds-financial-loss-victims-say>.

[xviii] Competition Bureau Canada, News Release, “The rise of AI: Fraud in the digital age” (4 March 2024), online: < https://www.canada.ca/en/competition-bureau/news/2024/03/the-rise-of-ai-fraud-in-the-digital-age.html>.

[xix]RBC, “RBC Urges Canadians to protect their digital persona in a new era of cyber risk” (24 Sept. 2025), online: < https://www.rbc.com/newsroom/news/article.html?article=126035>.

[xx] Report, supra note 1.

[xxi] CGI, “Defending against AI-driven threats: How to protect your bank from deepfake fraud” online: < https://www.cgi.com/canada/en-ca/article/emerging-technologies/defending-against-ai-driven-threats-how-protect-your-bank-deepfake>.

[xxii] Ibid.

[xxiii] Ibid.

[xxiv] Ibid.

[xxv] Government of Canada, “The Artificial Intelligence and Data Act (AIDA) – Companion Document” (31 Jan 2025), online: < https://ised-isde.canada.ca/site/innovation-better-canada/en/artificial-intelligence-and-data-act-aida-companion-document> [Companion].

[xxvi] Ibid.

[xxvii] Christopher Ferfuson and Dongwoo Kim, “Prorogation’s Digital Impact: Canada’s Digital Bills Set to Die on the Order Paper” (14 Jan 2025), online: < https://www.fasken.com/en/knowledge/2025/01/prorogations-digital-impact> [Prorogation].

[xxviii] Companion, supra note 25.

[xxix] Ibid.

[xxx] Ibid.

[xxxi] Ibid.

[xxxii] Ibid.

[xxxiii] Ibid.

[xxxiv] Ibid.

[xxxv] Ibid.

[xxxvi] Ibid.

[xxxvii] Ibid.

[xxxviii] Ibid.

[xxxix] Prorogation, supra note 27.

[xl] Ibid.

[xli] Blair Attard-Frost, “The Death of Canada’s Artificial Intelligence and Data Act: What Happened, and What’s Next for AI Regulation in Canada?” (17 Jan 2025), online: https://montrealethics.ai/the-death-of-canadas-artificial-intelligence-and-data-act-what-happened-and-whats-next-for-ai-regulation-in-canada/.

[xlii] Public Safety Canada, News Release, “Canada’s National Cyber Security Strategy” (24 March 2025), online: https://www.publicsafety.gc.ca/cnt/rsrcs/pblctns/ntnl-cbr-scrt-strtg-2025/index-en.aspx.

[xliii] Department of Finance Canada, News Release, “Combatting financial fraud, protecting Canadians against scams and abuse” (Oct 20 2025), online: < https://www.canada.ca/en/department-finance/news/2025/10/combatting-financial-fraud-protecting-canadians-against-scams-and-abuse.html>.

[xliv] Norton Rose Fullbright, “Canada announces new financial crimes agency: What US businesses need to know” (October 2025) online: https://www.nortonrosefulbright.com/en/knowledge/publications/383b5ba5/canada-announces-new-financial-crimes-agency-what-us-businesses-need-to-know.

[xlv] Innovation, Science and Economic Development Canada, News Release, “Government of Canada opens applications for the AI Compute Access Fund” (25 June 2025), online: < https://www.canada.ca/en/innovation-science-economic-development/news/2025/06/government-of-canada-opens-applications-for-the-ai-compute-access-fund.html>.

[xlvi] Ibid.

[xlvii] IBM, “AI Fraud detection in banking” online: https://www.ibm.com/think/topics/ai-fraud-detection-in-banking.