Quebec provincial police say they've uncovered an intricate identity-theft scheme that took $1 million total from more than 10,000 people.

In what is called a "phishing" scam, the fraudster sent his victims massive amounts of fake emails purporting to be from financial institutions and asking the recipients to update their confidential information online, the Sûreté du Québec's financial crimes unit said Monday.

In a typical phishing scam, such as this one from late 2009, a swindler sends a fake email to a bank's customers in an attempt to have them visit a phony website and divulge their private info. (CBC)

He used that information — addresses, bank account data and credit card numbers — to apply for credit cards in the victims' names. He would fill out change-of-address forms at Canada Post to have the cards rerouted to him, before using them for purchases or cash withdrawals from bank machines, police said.

In other cases, the perpetrator used fake ID to set up dummy bank accounts in people's names and then transferred their money, the SQ said.

The scope of the fraud was enormous. "More than 10,000 victims and it was a fraud of over $1 million," SQ spokesperson Sgt. Geneviève Bruneau said.

At other times, the swindler took the guise of a computer technician to get access to companies' systems and install software that let him remotely access files containing credit card numbers, police said.

A 22-year-old computer expert from the village of Saint-Joseph-du-Lac, 30 kilometres northwest of Montreal, has been arrested and was arraigned Monday in a court in Laval on charges of identity theft, fraud and credit card theft.

The SQ said he had accomplices, but so far only he has been charged. The provincial police force began looking into the case in October 2009 and said it continues to investigate.