Knowing how to recognize phishing is one of the most useful skills you can have online. Phishing is a scam that tries to trick you into handing over personal or financial information so criminals can steal money or your identity. It can reach you by email, text message, phone call or a fake website, and scammers often pose as a bank, a government agency, a utility or a well-known company. This guide shows the warning signs and what to do if you are targeted.
How to recognize phishing: the classic warning signs
Most phishing messages share a handful of tell-tale features. Learn to spot them and you will avoid the majority of attempts.
- Generic greetings: “Dear Customer” or “Dear Taxpayer” instead of your real name.
- Spelling and grammar mistakes: awkward sentences and odd formatting are common.
- Mismatched sender details: the email address, phone number or link does not match the organization it claims to come from.
- Urgency and pressure: threats that your account will be closed or that you must pay immediately.
- Offers that seem too good to be true: surprise refunds, prizes or deals you never entered for.
- Requests for sensitive data: passwords, card numbers, banking details or social insurance numbers.
Common types of phishing
Email phishing
The best-known form. A message imitates a trusted brand and pushes you to click a link or open an attachment. The link often leads to a copy of a real login page designed to capture your password.
Smishing (text messages)
Fake delivery notices, toll or parking fines and bank alerts sent by SMS. Short messages make it harder to spot errors, so treat unexpected links in texts with extra caution.
Vishing (phone calls)
A caller claims to be from your bank, the police or a government department and asks you to confirm details or move money. Legitimate organizations will not pressure you to act on the spot.
Fake websites and shopping pages
Phishing often overlaps with online shopping fraud. Our guide on how to spot and avoid online shopping scams covers fake stores in more detail.
How to protect yourself
- Do not reply to unexpected messages from unknown senders. Delete them without clicking links or opening attachments.
- Verify independently: contact the organization using the phone number on your statement or by typing its official address yourself.
- Remember the golden rule: legitimate organizations do not ask for personal information by email or text.
- Use strong, unique passwords and turn on two-step verification wherever it is offered.
- Keep devices updated, including connected devices at home. Our article on smart technology in modern homes explains why that matters.
- Ask someone you trust, or your local police, if you are unsure whether a message is genuine.
What to do if you clicked or shared information
- Contact your bank and credit card company immediately.
- Change the passwords of any affected accounts.
- Ask Equifax Canada (1-800-465-7166) or TransUnion Canada (1-877-713-3393) to add a fraud alert to your credit file.
- Report the incident to your local police.
- Report the fraud to the Canadian Anti-Fraud Centre at 1-888-495-8501.
For a wider look at how online habits are evolving, read how digital marketplaces are changing consumer behavior.
FAQ
What is the main goal of phishing?
To obtain personal or financial information that can be used to steal money or commit identity theft.
Will my bank ever ask for my password by email?
No. Legitimate organizations do not request sensitive information by email or text.
Where do I report phishing in Canada?
To the Canadian Anti-Fraud Centre (1-888-495-8501) and your local police, after contacting your financial institution.