It's very bad from a privacy standpoint but at least nobody will be able to log-in to my account and send all my money offshore.

Instead they can steal your identity and open accounts in your name. Banks can automate the changing of passwords and PINs by requiring the former information to change the latter. But once it's out there, it's gone forever.

I know identity theft is not a joke, but (I'm too lazy to check how does it work in Canada, this is for the US):

• Under most state laws, you're not responsible for any debt incurred on fraudulent new accounts opened in your name without your permission.

https://www.consumer.ftc.gov/articles/pdf-0009_identitytheft...

That still requires work on the behalf of the person whose identity was stolen. Affidavits signed, letters mailed, etc. Also vigilant monitoring of your credit details afterwards.

Even if you are not monetarily charged, it's still a giant pain to recover from.

How easy would it be to recover funds from an account that has been compromised and emptied? Honest question, I have no idea.

Anyway, I don’t know how many fraudulent accounts are opened in Quebec each year using stolen identities but if the fraudster has three millions of identities to choose from (one third of the population) you may have bigger risks to worry about.

Unsure about how it would work on a very large sum, or in Canada, but I had a wallet stolen several years ago and had to sign an affidavit describing what happened. Someone had gone to Best Buy and spent like $400, and the bank returned it after a few weeks.

But on whom rests the burden of proof?