Spot junk and phishing without panicking

Outlook tries to keep unwanted mail out of your Inbox. Microsoft’s junk-email page (opened 10 November 2026) says mail identified as possible junk can be moved automatically to the Junk Email folder, and that any malware — potentially harmful software or code — is disabled. That folder is worth a calm look, because a real message can land there by mistake — do not click every link “just in case.”

If you keep getting unwanted mail from the same address, Microsoft describes a blocked-senders list. In the view that page covers (new Outlook and similar web views), you open Settings, then Mail > Junk email, and add an address or a whole domain to Blocked senders and domains. Messages from those senders go to Junk Email. You can also add a person or domain to Safe senders so their mail is less likely to be treated as junk. The exact Settings labels can differ in classic Outlook. Ask a tutor if you cannot find Junk email.

Microsoft’s junk page opened on 10 November 2026 said junk is kept for 30 days and then deleted automatically. That detail can change, so check the folder sooner rather than later.

Phishing is different from ordinary junk. Junk is often advertising you did not ask for. Phishing is a message that tries to trick you into clicking a link, opening a file, or giving away a password, a PIN, or other private details. Canada’s Skills for Success Digital skill includes knowing how to avoid phishing emails. Get Cyber Safe, a Government of Canada site, says cyber criminals often use fear or intimidation, and that it can be hard to tell a real message from a scam — which is what the sender is counting on.

Deeper scam practice belongs in *Email & Online Safety Basics in Canada*. Today you learn how to pause inside Outlook so you do not panic and click.

Get Cyber Safe’s page “What to do about a suspicious-looking message” (opened 10 November 2026) offers a simple set of questions. Do you even have an account with the organization named in the message? If you do not, Get Cyber Safe says it is a phishing or scam message and you should delete it. If you do, check whether the sender’s address matches who they claim to be, including the spelling of the domain. Look for spelling mistakes or blurry logos. Notice urgent or threatening language, such as a demand to act immediately or a threat to close an account. Notice odd requests, such as asking for personal information, demanding payment, or telling you not to use the official app or the number on your card.

Get Cyber Safe also flags generic greetings such as “Dear sir or madam,” mismatched domains (a “bank” writing from a free mail address, or a look-alike name that swaps a letter for a number), and unexpected attachments or links. If you are unsure about a link, Get Cyber Safe says to hover your mouse over it to see where it really goes — and not to open it if you suspect a scam. Even a “probably legitimate” message is safer if you open the organization’s official website yourself instead of clicking the link in the email.

The sample-messages file includes Message 4, a made-up practice phishing note, not from a real bank. The sender uses a zero in “acc0unts” and a strange domain. The subject says “Account Rest.” The body has typos, a 24-hour threat, and an odd order not to call the number on your card. Do not click the practice link or type a password — Message 4 is there so you can practise noticing the signs.

A Canadian Anti-Fraud Centre feature opened in October 2026 adds that a message can be well written and still be fraud. Slow down, and do not let urgency, fear, or excitement push you into a quick decision.

If a message looks suspicious, pause. Do not click the link. Do not open an unexpected attachment. Do not reply with a password, a PIN, or a one-time code. The Canadian Anti-Fraud Centre says you should never give those secrets to an unsolicited contact. Verify an unexpected request using contact details you find yourself — the official website or a phone number you already trust — not the details printed in the message.

At work or on a practice account that belongs to an organization, tell staff or your tutor. Get Cyber Safe says that if you think you have been a victim on a work computer, you should report the incident to your organization right away. Workplace IT may also want you to report phishing inside Outlook; Get Cyber Safe notes that you can report phishing to Microsoft in Outlook.com or the Outlook app. Ask staff how your workplace wants that done. This lesson will not invent extra ribbon buttons we did not confirm on every version.

You can report fraud or cybercrime to the Canadian Anti-Fraud Centre whether you were tricked or you only witnessed the attempt. The CAFC report page (opened 10 November 2026) points to reportcyberandfraud.canada.ca and to a toll-free phone line, 1-888-495-8501. You may report anonymously online. If you have been a victim, the CAFC also says to contact your local police as soon as you can. Local police investigate; the CAFC keeps a central record that helps law enforcement. Phone hours are listed on that official page and can change, so check the page.

If you already clicked or shared details, Get Cyber Safe’s victim page says to contact your financial institution if money information was involved, change passwords on affected accounts, and report the incident. Ask a person you trust, and use the email-safety course for more practice.

Everyday Computers already covers locking a shared machine and signing out when you leave a library desk.

1. Open Message 4 in the sample-messages file. Do not click any link. Do not type a password.
2. Mark the warning signs: sender, subject, urgency, typos, odd request.
3. Write what you would do next: pause, tell staff, and verify only through official details you find yourself.
4. Look at Junk Email in a practice account if your tutor agrees. Do not click links there “just to see.”
5. Write the CAFC report address (reportcyberandfraud.canada.ca) and the toll-free number in your notes.
6. Remember that *Email & Online Safety Basics in Canada* goes deeper than this lesson.

If you are in a study group: without clicking anything, list three warning signs you see in Message 4. Then name one thing you would *not* do (click, reply with a password, or forward the link).