Phishing emails and fake websites

Phishing means a fake message that tries to get your passwords, SIN, banking details, or to make you install harmful software. The Canadian Anti-Fraud Centre (CAFC) warns that phishing can look like a bank, a store, or a government agency.

Typical tricks:

• “Your package could not be delivered — click here.”
• “Your account will close today — update now.”
• “You have a tax refund waiting — sign in.”
• A QR code in a surprise email or poster that leads to a fake sign-in page.

Fake websites often use look-alike addresses: extra words, odd endings (.info, .su), or small spelling changes. CRA guidance: official pages start with canada.ca or end with cra-arc.gc.ca. When unsure, do not click. Type the address yourself.

Quick habits:

1. Do not click links or open attachments in surprise messages.
2. Do not “confirm” passwords by email or text.
3. Hover or long-press a link on your phone to preview the address (still be careful).
4. If you clicked by mistake, change your password on the real site, turn on stronger sign-in if available, and watch your accounts. Report the attempt.

Reporting helps others. CAFC wants reports even if you did not lose money.