How to send a SIN or tax document securely

Sending a Social Insurance Number or tax slip by email puts it at real risk. Here is the safe way to send sensitive tax information, in plain steps.

By Privatt Inc.

A Social Insurance Number is a skeleton key. With it, plus a name and date of birth that are easy to find, someone can open credit, file a fraudulent tax return, or impersonate the person it belongs to. So when tax season arrives and you need to send a SIN, a T4, or a full return to your accountant, or your accountant needs to send documents back, how you send it matters more than almost anything else in the exchange.

The short version: do not put it in an email.

Why email is the wrong tool

Email feels private because only you and the recipient see it. In reality a message passes through and rests on several servers, usually is not encrypted end to end, and leaves readable copies in multiple inboxes indefinitely. The subject line and metadata stay exposed even if the body is encrypted. And you cannot take it back. For a single number that can unlock someone's financial identity, that is too much exposure.

The safe way, step by step

  1. Encrypt before you send. Use a tool that encrypts the file or message on your device, not just in transit. That way the only people who can read it are the ones with the passphrase.
  2. Split the link and the passphrase. Send the secure link one way (email is fine for the link alone) and the passphrase another way, such as a text message. A thief would need to compromise both channels.
  3. Set an expiry and a view limit. The document should disappear after it has been read, or after a few days, rather than live forever.
  4. Verify the recipient. Confirm you are sending to the right person before anything sensitive goes out.

Do this without making it complicated

The friction is the reason people fall back to email, so the fix has to be easy for both sides. With Send you drop in the document, set a passphrase, and send a link. The recipient opens it with the passphrase, with no account, no app, and nothing to install. You can expire it, cap the number of views, and revoke it at any time.

However you share it, the rule is short: never put the number itself in a plain email, split the link from the passphrase, and prefer links that expire on their own.