Recognizing Phishing and Scams Course: Lessons 2026

Lesson 1: How scams work: tactics and warning signs

A scam is a trick to get your money, your information or access to your accounts. Most scams work on people, not computers. This is called social engineering: the scammer tells a story that makes you want to help, or makes you afraid not to.

The Canadian Centre for Cyber Security (the Cyber Centre) says in its National Cyber Threat Assessment 2025-2026 that fraud and scams are almost certainly the most common form of cybercrime affecting Canadians. Phishing is one of the most reported types of fraud, and spear phishing (a message aimed at a chosen person or group) has one of the highest reported levels of financial impact on victims.

The pressure tactics

The Cyber Centre says attackers use familiarity, sympathy, urgency, threats, authority cues or a casual tone to lower your defences, often several at once.

Pretexting uses a made-up story. Baiting offers something tempting, like a prize. Quid pro quo offers a service or benefit in return for information or a task, such as "free tech help" in exchange for your password. Scareware tries to scare you into believing your device is at risk, so you click a harmful link or call a fake help line.

Red flags in any channel

• You did not expect the contact, and it asks you to act now.
• It asks for passwords, PINs, your Social Insurance Number (SIN) or a one-time code.
• It asks you to sign in through a link or to give someone remote access to your device.
• It asks you to keep it secret, even from your bank or family.
• It asks you to pay in an unusual way: gift cards, prepaid cards, cryptocurrency, a money service business, or cash picked up by a courier.
• It changes a normal process, such as new banking details.

This money is hard to trace and hard to get back. The Canadian Anti-Fraud Centre (CAFC) warns that a cryptocurrency payment in most cases cannot be reversed.

Why AI makes scams harder to spot

The Cyber Centre says cybercriminals are almost certainly using large language models (AI chatbots) to improve social engineering attacks. AI helps them write polished, personal messages and create realistic audio and video of trusted people. Perfect grammar proves nothing.

• A deepfake is AI-generated audio, video or images that imitate a real person.
• Voice cloning uses AI to copy a voice from a short audio sample.
• Get Cyber Safe's warning signs: overly polished messages, voice calls that sound robotic or "off", and suspiciously urgent content.
• In videos, watch for people who do not blink, or shadows, blurs and flickering light where there should not be any. In audio, listen for a flat tone or choppy sentences. Do not rely on AI detection tools.

Get Cyber Safe warns that fraudsters use facts you made public on social media to make requests seem real. Share less.

Themaquiz 1: How scams work: tactics and warning signs

Lesson 2: Phishing emails, links, QR codes and fake websites

Phishing emails pretend to come from a bank, a store, the government or a coworker. The Cyber Centre warns that sender addresses can be spoofed (faked) and that a known sender isn't necessarily a trusted sender.

Check the sender and the story

• Does the address match the organization's official address? Look for misspellings, extra words or hyphens.
• Thread hijacking: an attacker who has taken over an email account replies inside a real conversation, so the request looks normal.
• Consent phishing: a real-looking request asks you to let an app access your account. Approving it lets the attacker in without your password.

Read the web address

The owner of a web address is the name just before the first single slash ( / ), together with its ending. Anything in front of it can be chosen by whoever owns the site.

Short links and small phone screens make fake sites harder to spot. The Cyber Centre advises using bookmarks or a search engine to reach websites, rather than clicking links in messages.

Attachments

Do not open attachments from unknown senders, or files with strange names or more than one file extension.

Fake websites and online stores

Pharming sends people to fake websites that look identical to real ones. The Cyber Centre says not to rely on a padlock icon or how a site looks to decide if it is real.

• Check for clear contact information. The CAFC says fake stores often have no customer phone number or email.
• Be careful with deals that seem too good to be true.
• Treat any request to pay outside the official checkout, such as by e-transfer, as a red flag.
• Pay with a credit card from a major financial institution, which may offer fraud protection or a chargeback.
• A different business name on your card statement is a warning sign. If you think you were scammed, act quickly and contact your card issuer.

QR codes

QR code phishing is called quishing. Codes can be in emails or posted in public places. The Cyber Centre advises:

• Do not scan codes in emails or texts unless you know they are real.
• If a code looks like a sticker covering another code, ask a staff member to check it.
• If the page asks you to sign in after scanning, check the web address very carefully.
• Set your phone to ask permission before it opens a QR code action.

At work, report suspicious email to your IT or security team and follow their instructions. Do not forward it to coworkers. At home, the CAFC says to report suspicious messages to the CAFC and then delete them.

Themaquiz 2: Phishing emails, links, QR codes and fake websites

Lesson 3: Texts, calls, social media and AI voice cloning

Text messages (smishing)

Scam texts often claim your account was compromised, a refund is waiting, or you won a contest you never entered. Get Cyber Safe suggests asking: would this organization really contact me by text? Legitimate organizations do not ask for passwords, PINs or your SIN by text or email.

• Do not tap the link and do not reply, not even to opt out.
• Forward the text to 7726 (SPAM on most keypads). This alerts your cellular provider. It is free and does not count toward your plan.
• Then delete the message and block the number.
• To check, use the phone number on the organization's official website.

Phone calls (vishing)

Scammers spoof caller ID so that a call seems to come from a bank, a government office or a local number. The Cyber Centre says calls with unusual delays, robotic voices, distorted audio or unnatural speech may be scams.

Hang up and call back using a known, trusted number. The Cyber Centre says not to use a number the caller gives you or your phone's callback (redial) option.

Voice cloning and deepfakes

AI can copy a voice from a short audio sample and can create realistic video of a real person. The Cyber Centre suggests safe words or call-back codes: agree on a word or code ahead of time, and ask for it when an urgent request comes in.

Emergency ("grandparent") scams

These scams prey on fear for a loved one. The caller may say a grandchild was arrested and needs bail, and that a "gag order" means you cannot tell anyone. They may arrange to pick up the money in person or ask you to mail cash. The CAFC says the Canadian criminal justice system does not allow someone to be bailed out of jail with cash or cryptocurrency.

• Hang up and call the family member, or their parents, using a phone number you already have.
• If the caller says they are police, call your local police using a number from a reliable source.
• Do not trust caller ID.

Social media and romance scams

Get Cyber Safe warns that phishing messages can come from people pretending to be your friends, and says not to click suspicious links even when they come from friends.

In a romance scam, the CAFC warning signs are: they profess love before meeting you, they always have an excuse not to meet, and they may guilt you into sending money. Some romance scammers later claim to be successful cryptocurrency investors and push you to invest. The CAFC says to never send money to someone you haven't met, and not to invest through platforms given to you by people you don't know.

SIM swap

In a SIM swap, a scammer moves your phone number to their own SIM card so they can receive your texts and codes. The CAFC says victims lose mobile service and are typically locked out of their email, social media and financial accounts.

Themaquiz 3: Texts, calls, social media and AI voice cloning

Lesson 4: Government, bank and tech-support impersonation

Scammers pretend to be the Canada Revenue Agency (CRA), other government departments, police, banks or utilities. They use authority and fear.

What the CRA may and will not do

A caller who asks for your SIN is not automatically real. Verify first.

Common CRA scams: an email saying your "revised Notice of Assessment" is not in My Account and must be downloaded quickly; a text with a Government of Canada logo offering an e-transfer "deposit"; and a text asking you to reply "HELP". Do not click or reply. Sign in to your CRA account yourself to check for mail.

How to verify a call from the CRA

1. Do not share personal information during the call.
2. Do not trust caller ID. Ask for the caller's name, office and callback number.
3. Say you will verify and call back, then end the call.
4. Check the callback number with the CRA's online verification tool.
5. If the tool cannot confirm it, call the CRA: 1-800-959-8281 for individuals and trusts, or 1-800-959-5525 for businesses.

Other government and utility threats

The CAFC describes extortion calls from fake CRA, Service Canada or immigration officers (pay now or be arrested or deported) and fake hydro companies (pay now or your power is cut off). Automated calls targeting the Asian community claim customs intercepted a package in your name. Law enforcement does not demand payment or threaten arrest by phone. Hang up and use official contact information.

Some websites charge a fee to "help" with passports or birth certificates faster. The CAFC notes that government ID forms are free and no one can speed up the process.

Bank investigator scams

The caller pretends to be from your bank, the police, an online store or a credit bureau and asks for help with an "investigation". The CAFC says:

• Banks and online stores never ask you to move money to another account "for security reasons".
• Banks and police never ask you to hand over your bank card, even cut in half.
• Never share codes you receive by text or email, and never give remote access to your computer.
• Credit bureaus do not call you randomly unless you asked for a call back.
• End the call and dial the number on the back of your bank card, from a different phone if possible, or wait 10 minutes first.

Tech-support scams

A loud pop-up or a surprise call says your computer is infected. The fraudster then asks you to pay a fee to "fix" it, or to log in to your bank account. Never give remote access to someone you do not know. Do not call. Close the browser and get help from your IT team or a trusted local business.

Themaquiz 4: Government, bank and tech-support impersonation

Lesson 5: Job scams, invoice fraud and payment requests

Job scams

Fake jobs often arrive by text, email or messaging app after you post a resume. The CAFC describes several kinds:

Warning signs: fees to start or unlock earnings, a balance you cannot withdraw, moving money through your account, or recruiting others. The CAFC says to never send deposits or pay fees for a job, to check the company's official website and call its official phone number, and not to share ID documents with unverified contacts.

Payment fraud at work

In business email compromise, a scammer impersonates a leader, coworker, client or supplier. The CAFC describes:

• Executive spoof (gift cards): the "boss" is working offsite and needs gift cards for staff rewards or birthdays.
• Executive spoof (wire transfer): an urgent, large wire, often more than $100,000, to a foreign account.
• Financial industry client spoof: a fake client asks a financial firm for an urgent wire, usually to a foreign account.
• Payroll spoof: an "employee" asks to change their direct deposit details.
• Supplier or contractor swindle: a notice says future payments should go to a "new" bank account.

The defence is the same every time: verify using contact details you already have, such as your work directory or the supplier record on file, never the phone number or email in the request. Follow your approval process, even for "urgent" or "secret" requests. The same rule works at home: if your "landlord" emails new e-transfer details for rent, contact your landlord using the information you already have.

Selling online

The CAFC warns about buyers who are "out of town" and offer to buy unseen. They may send a fake payment notice, say a fee is needed to release the money, or send too much and ask you to send back the extra. Never send back an "overpayment".

Themaquiz 5: Job scams, invoice fraud and payment requests

Lesson 6: Verifying requests and reporting scams

A verification routine

1. Pause. A real request can wait a few minutes.
2. Do not use contact details from the message or call.
3. Find the contact yourself: the number on the back of your card, the official website, a bookmark, your work directory or your own records.
4. Check through a different channel. If the request came by email, call. If it came by phone, hang up and call back. This is called out-of-band verification.
5. Use your safe word or call-back code, and follow your workplace's approval rules for payments.
6. Ask someone you trust before you pay.

Where to report

The CAFC says to report a fraud whether you are a victim or not, and you can report online anonymously. The CRA notes that reports may help law enforcement with their investigations.

If you lost money or information

The CAFC suggests these steps for victims:

1. Stay calm and gather information: documents, receipts, and copies of emails or texts.
2. Contact your financial institution, especially the one that sent the money. For identity fraud, place flags on your accounts, change your passwords and report to both credit bureaus (Equifax and TransUnion).
3. Contact your local police and get a file number for future reference.
4. Report to the CAFC, and share any updates with them later.

If you shared card details with a fake store, act quickly, even if you are not sure, and ask your card issuer to cancel or reverse the charge. If you clicked a link or downloaded a file, the Cyber Centre suggests running an antivirus scan; at work, tell your IT team right away.

Watch out for recovery scams

Scammers may contact victims again, promising to recover money for a fee or asking for help with a "sting". The CAFC says it and the police will never ask you to transfer funds or make a payment of any kind. Never pay an advance fee to get a refund, and never give remote access to your device.

Themaquiz 6: Verifying requests and reporting scams