Module 2: The Security Shield
What you will learn: How to recognise and protect yourself from the most common scams targeting Canadians. By the end of this module, you will feel empowered — not frightened — when it comes to online safety.
Dorothy, 72, lives in Ontario. One morning, she received a phone call from someone who said they were from the Canada Revenue Agency (the CRA — that is the government office that handles taxes). The caller said Dorothy owed $4,200 in unpaid taxes and that the police would come to her home within two hours unless she paid immediately using iTunes gift cards.
Dorothy's heart was pounding. She had always paid her taxes on time. But the caller was so convincing — he knew her full name, he sounded official, and he even gave her a "badge number." Dorothy drove to the her local pharmacy and bought $500 in iTunes cards before she called her daughter, who told her to hang up immediately.
Dorothy lost that $500. But she learned something powerful that day: scammers are professional liars. They practise sounding real. They use fear and urgency as weapons. And once you know their tricks, you can spot them from a mile away.
This module is Dorothy's gift to you — everything she wishes she had known before that phone call.
The Truth About Scams in Canada
Before we look at specific scams, here are some facts that might surprise you:
- The Canadian Anti-Fraud Centre reported that Canadians lost over $530 million to fraud in a recent year. The real number is likely much higher because many people feel too embarrassed to report it.
- Scammers do not target people who are foolish — they target people who are trusting, polite, and law-abiding. Those are good qualities. Scammers exploit them.
- Being scammed is not your fault. These are professional criminals who do this for a living.
- The best defence is not technical skill — it is knowing what to look for. That is exactly what we are about to learn.
The 3-Second Rule
Use this every time something feels "off" — on your phone, in your email, or on a website.
The 3-Second Rule
When something suspicious appears online — Stop, take your fingers off the screen. Breathe slowly once. Then Verify — ask yourself: is this real, or is someone trying to frighten me?
Confidence Check: Learning about scams is not scary — it is empowering. You are building armour right now.
Take your time with this module. There is a lot of information, but every piece makes you stronger.
Remember the 3-Second Rule
Stop. Breathe. Think before you tap. If something feels urgent or too good to be true, that is your signal to pause.
Scam 1: The CRA Phone Scam
This is the most common scam targeting Canadians. Here is how it works:
"This is Officer James Wilson, badge number 4471, calling from the Canada Revenue Agency. Our records indicate you have an outstanding tax debt of $4,200. A warrant for your arrest has been issued. To avoid immediate arrest, you must make a payment today. We accept payment through iTunes gift cards, Bitcoin, or wire transfer. Press 1 to speak with a payment agent."
Red Flags to Watch For:
- The CRA will never call and threaten arrest. If you owed taxes, they would send you a letter in the mail first — multiple letters, in fact.
- No government agency accepts iTunes gift cards as payment. This is the biggest giveaway. Gift cards are untraceable — that is exactly why scammers want them.
- They create false urgency. "You must pay today" or "the police are on their way" — real government agencies give you time to respond.
- They get angry or threatening when you ask questions. A real CRA agent would be patient and professional.
- They ask you to stay on the phone. They do not want you calling someone else to check if this is real.
Applying the 3-Second Rule:
Stop: Hang up the phone. You do not need to be polite to a criminal. Breathe: Remember that the CRA sends letters, not threatening phone calls. Verify: If you are worried, call the CRA directly at 1-800-959-8281 (this is their real number — you can find it on canada.ca).
No real government agency will ever ask you to pay using gift cards, Bitcoin, or wire transfers. If someone asks for payment this way, it is always a scam — no exceptions.
Remember the 3-Second Rule
Stop. Breathe. Think before you tap. If something feels urgent or too good to be true, that is your signal to pause.
What to Do If You Already Responded:
If you gave them gift card numbers, contact the gift card company immediately — they may be able to freeze the funds. Report the scam to the Canadian Anti-Fraud Centre at 1-888-495-8501. Do not feel embarrassed; you are helping protect others by reporting.
Unknown Caller
When your screen shows an unfamiliar number with no name attached, let it go to voicemail. Legitimate callers leave messages; phone scammers almost never do.
Confidence Check: You can now spot a CRA scam. That puts you ahead of the curve. Well done.
Save the real CRA phone number (1-800-959-8281) in your phone's contacts list right now. That way, if you ever receive a suspicious call about taxes, you can ring the real CRA directly to check.
You are doing great, and your device is safe. You have just learned to spot one of Canada's most common phone scams. Take a breath — you are in control.
Scam 2: The Grandparent Scam
This scam is particularly cruel because it targets your love for your family.
"Grandma? It's me... [sobbing]... I'm in trouble. I was in a car accident in Montreal and I got arrested. Please don't tell Mom and Dad. My lawyer says I need $3,000 for bail. Can you send money through Western Union? Please, Grandma, I'm so scared."
Red Flags to Watch For:
- They never say their name first. They wait for you to say "Is that you, Michael?" and then they say "Yes, it's Michael!" Now they know your grandchild's name.
- They beg you not to tell other family members. They need to isolate you so no one can verify the story.
- The "lawyer" calls back. A second person calls pretending to be a lawyer, confirming the fake story. This makes it feel more real.
- They need money urgently through untraceable methods. Wire transfers, gift cards, or cryptocurrency.
- Their voice sounds "off." They often explain this by saying they have a cold, or that the phone connection is bad.
Applying the 3-Second Rule:
Stop: Do not send money. Breathe: Fear for a loved one is the most powerful emotion scammers can use. Take a moment. Verify: Hang up and call your grandchild directly at the phone number you already have. Call their parents. If your real grandchild answers and says "What are you talking about, Grandma?" — you have just avoided a scam.
Consider creating a family code word — a secret word that only your family knows. If someone calls claiming to be a relative in trouble, ask for the code word. A scammer will not know it.
Scammers can now use artificial intelligence to clone voices. Even if a caller sounds exactly like your grandchild, always hang up and call your family member directly at the number you already have saved.
Remember the 3-Second Rule
Stop. Breathe. Think before you tap. If something feels urgent or too good to be true, that is your signal to pause.
Scam 3: Fake Bank Emails (Phishing)
Phishing (pronounced "fishing") is when a scammer sends you a fake email or text message pretending to be from a company you trust — like your bank. They are "fishing" for your personal information, hoping you will take the bait.
From: security-alert@rbc-banking-secure.com
Subject: URGENT: Unusual Activity on Your RBC Account
Dear Valued Customer,
We have detected unusual activity on your RBC Royal Bank account. Your account has been temporarily locked for your protection. To restore access, please verify your identity by clicking the link below:
[Verify My Account Now]
If you do not verify within 24 hours, your account will be permanently closed.
RBC Royal Bank Security Team
Phishing Email Red Flags
Scam emails use addresses that look almost right (support@apple-helpdesk.net instead of @apple.com), create fake urgency, and ask you to click a link immediately.
Red Flags to Watch For:
- The email address is wrong. Look carefully: "rbc-banking-secure.com" is NOT a real RBC address. The real one would end in "@rbc.com" — nothing else.
- It says "Dear Valued Customer" instead of your actual name. Your real bank knows your name.
- "URGENT" and deadline pressure. "You have 24 hours" is designed to make you panic and act without thinking.
- They want you to click a link. That link leads to a fake website that looks like your bank but is controlled by the scammer. If you type your password there, you are handing it to a thief.
- Threatening language. "Your account will be permanently closed" — your bank would not close your account over one missed email.
Applying the 3-Second Rule:
Stop: Do not click any links in the email. Breathe: Your bank account is fine. Real security issues are handled by phone, not email links. Verify: Open a brand-new web browser window (do not use any links from the email) and go to your bank's real website by typing the address yourself. Or call the number on the back of your bank card.
From: td-easyweb-security@td-bank-alert.net
Subject: Action Required: Your TD EasyWeb Access Has Been Suspended
We noticed a login attempt from an unrecognised device. For your safety, we have suspended your TD EasyWeb access. Click below to confirm your identity and restore your account:
[Restore TD EasyWeb Access]
Failure to act within 12 hours will result in account suspension.
TD Canada Trust Digital Security
Notice the same pattern: fake email address ("td-bank-alert.net" is not a real TD address), urgency ("12 hours"), and a link that wants your login information. The real TD website address is td.com — anything else is fake.
Real vs Fake Website Address
Your bank website shows its exact name in the address bar (td.com). A fake site adds extra words: td-secure-login.com or td-bank-verify.net — these are not your bank.
Confidence Check: You are becoming a scam detective. These patterns are the same every time — once you see them, you cannot unsee them.
Scam 4: Romance Scams
Romance scams often begin on social media or dating apps. Someone sends you a kind message, you start chatting, and over weeks or months they build a relationship with you. Then the requests for money begin.
Week 1: "Hello, I noticed your lovely profile photo. My name is Robert, I'm an engineer working in Alberta."
Week 3: Daily messages, phone calls, deep personal conversations. He is kind, attentive, everything you could want.
Week 6: "I'm stuck overseas on a job. I need $2,000 for a plane ticket home. I'll pay you back as soon as I arrive. You're the only person I can trust."
Red Flags to Watch For:
- They cannot video call. Their camera is always "broken" or the connection is always "bad." They use photos stolen from other people's social media.
- The relationship moves very fast. They say "I love you" within days or weeks.
- They have a dramatic reason they cannot meet in person. They are overseas, in the military, working on an oil rig, or some other story.
- They eventually ask for money. It starts small and grows. Medical emergency, travel costs, business problems.
- They ask you to keep the relationship private. They do not want your family or friends to ask questions.
Applying the 3-Second Rule:
Stop: Never send money to someone you have not met in person. Breathe: This is emotionally difficult. It is okay to feel hurt or confused. Verify: Do a reverse image search of their profile photo (your family member or a tech helper can show you how), or ask them for a video call. If they always have an excuse, that is your answer.
Scam 5: Tech Support Scams
This scam usually starts with a phone call or a pop-up on your screen.
"Hello, this is John from Apple Support. We have detected a security breach on your iPad. Hackers have accessed your device and we need to fix it immediately. I will need you to give me remote access to your iPad so I can remove the threat. There is also a $299 security service fee."
Red Flags to Watch For:
- Apple, Microsoft, and Google will never call you about a problem you did not report. If you did not contact them first, the call is fake.
- They ask for remote access to your device. Never let a stranger control your iPad or computer.
- They charge a fee to "fix" a problem that does not exist.
- They found you — you did not find them. Real tech support waits for you to contact them.
Applying the 3-Second Rule:
Stop: Hang up. Breathe: Apple did not call you. Your iPad is fine. Verify: If you are worried about your device, visit your nearest Apple Store or call Apple directly at 1-800-275-2273.
"Hello, this is James from Google Support. We have detected a security breach on your Android device. Hackers have accessed your tablet and we need to fix it immediately. I will need you to give me remote access to your device so I can remove the threat. There is also a $299 security service fee."
Red Flags to Watch For:
- Google, Samsung, and other device makers will never call you about a problem you did not report. If you did not contact them first, the call is fake.
- They ask for remote access to your device. Never let a stranger control your phone, tablet, or computer.
- They charge a fee to "fix" a problem that does not exist.
- They found you — you did not find them. Real tech support waits for you to contact them.
Applying the 3-Second Rule:
Stop: Hang up. Breathe: Google did not call you. Your Android device is fine. Verify: If you are worried about your device, visit the support website for your device manufacturer (such as support.google.com for Google Pixel, or samsung.com/ca/support for Samsung), or ask a trusted family member or friend to take a look.
"Hello, this is David from Microsoft Support. We have detected a virus on your Windows computer. Hackers are stealing your banking information right now and we need to fix it immediately. I will need you to give me remote access to your computer so I can remove the threat. There is a one-time $299 security fee."
Red Flags to Watch For:
- Microsoft will never call you about a problem you did not report. If you did not contact them first, the call is 100% fake.
- They ask for remote access to your computer. Never let a stranger connect to your Windows computer. This would give them full control and access to all your files.
- They charge a fee to "fix" a problem that does not exist.
- They create urgency. "Hackers are stealing your information right now" is designed to panic you into acting before you think.
Applying the 3-Second Rule:
Stop: Hang up immediately. Breathe: Microsoft did not call you. Your Windows computer is fine. Verify: If you are genuinely concerned about your computer, contact Microsoft directly at support.microsoft.com or call a local, trusted computer repair shop — never the person who called you.
Everything you have learned so far is stored safely in your memory. You are building real skills — every scam you can name is one you can dodge. Keep going.
Scam 6: Fake Package Delivery Texts
Canada Post: Your package could not be delivered. A shipping fee of $2.65 is required. Pay now to reschedule delivery: http://canadapost-redelivery-fee.com/pay
Red Flags to Watch For:
- Canada Post does not text you about delivery fees. If there is a fee, they leave a notice card in your mailbox.
- The link looks almost right but is not. "canadapost-redelivery-fee.com" is not a real Canada Post website. The real one is canadapost-postescanada.ca.
- The amount is small on purpose. They hope you will think "$2.65 is no big deal" and enter your credit card number without thinking. Then they have your card number.
Applying the 3-Second Rule:
Stop: Do not tap the link. Breathe: If you are expecting a package, check the real Canada Post website directly. Verify: Go to canadapost-postescanada.ca and use the tracking number from your order confirmation email.
Confidence Check: You have now learned about six major scam types. You are building a powerful security shield around yourself.
Each scam follows the same basic formula: create fear or urgency, then ask for money or personal information. Once you see the formula, you see through the disguise.
Scam 7: "Microsoft" Computer Warnings
While browsing the web, a full-screen warning suddenly appears:
Fake Virus Warning
This full-screen alarm is always fake. Real warnings from your device are small calm notifications — not flashing alarms with a phone number to call. Use your Escape Hatch to close it.
MICROSOFT SECURITY ALERT!
Error # DW6BD36
Your computer has been locked!
Suspicious Activity Detected. Your browsing and personal data (including banking passwords) are being stolen. Call Microsoft Certified Technicians immediately: 1-877-555-0142
DO NOT SHUT DOWN YOUR COMPUTER
Red Flags to Watch For:
- Microsoft does not send warnings through your web browser. This is a webpage, not a real system alert.
- Error codes that look official but mean nothing. "Error # DW6BD36" is made up to sound technical.
- It tells you NOT to close the window. The opposite of what you should do — close it immediately using your Escape Hatch from Module 1.
- A phone number. Real warnings from your operating system never include a phone number to call.
Applying the 3-Second Rule:
Stop: Take your fingers off the screen. Breathe: This is a fake website, not a real warning. Verify: Press the Home button on your iPad (your Escape Hatch!) to close the browser. When you reopen Safari, the warning will be gone. Your device was never in danger.
Stop: Take your fingers off the screen. Breathe: This is a fake website, not a real warning. Verify: Press the Home button on your Android device (the circle or pill shape at the bottom of the screen) to close the browser. When you reopen Chrome, the warning will be gone. Your device was never in danger. If the fake warning page is still showing when you reopen Chrome, simply close that browser tab by tapping the small "X" on the tab, or clear your recent tabs.
Stop: Take your hands off the keyboard and mouse. Breathe: This is a webpage, not a real Windows warning. Your computer was never in danger. Verify: Close the browser window using the X button in the top right corner, or press Alt + F4. If the warning will not let you close it, press Ctrl + Alt + Delete → Task Manager → find your browser (Edge or Chrome) → End Task. When you reopen your browser, the fake warning will be gone. Real Windows security alerts appear as small notifications in the bottom right corner of your screen — never as full-screen browser pages with phone numbers.
Your Master Scam-Spotting Checklist
You can use these questions to evaluate any suspicious message, email, phone call, or website. If the answer to any of these is "yes," it is very likely a scam:
- Does it create urgency? ("Act now!" "You have 24 hours!")
- Does it create fear? ("Your account is locked!" "The police are coming!")
- Does it ask for unusual payment methods? (Gift cards, wire transfers, cryptocurrency)
- Does it ask you to click a link to fix a problem?
- Did they contact you first, rather than you contacting them?
- Does it ask you to keep it secret from family?
- Does the email address or website look almost right but not quite?
- Is the greeting generic ("Dear Customer") rather than using your name?
Security Video Tutorials
Spotting Phishing Emails
Learn the red flags that indicate a scam email and how to protect yourself.
Watch TutorialsOnline Safety Tips
Essential security practices to keep your personal information safe online.
Watch TutorialsThese links open YouTube in a new tab. YouTube is safe and free to use — you can watch as many videos as you like without signing in.
📚 New to YouTube? Learn how to spot quality videos and avoid ads
You have now studied seven of Canada's most common scams. That is genuine expertise. Take a breath — you are in control and more protected than most people ever become.
Practical Exercise: The Red Flag Detector
For the next week, practise the 3-Second Rule with every unexpected message or call you receive. Keep a small notebook by your phone and write down:
- What was the message or call about?
- Did it create urgency or fear?
- Did it ask me to click something or pay something?
- Did they contact me first, or did I contact them?
- What did I do? (Hung up, deleted it, ignored it — all great choices!)
Quick Check: Test Your Knowledge
1. You receive a call from someone claiming to be from the CRA, saying you owe taxes and must pay with iTunes gift cards. What should you do?
2. An email from "RBC" says your account is locked and you need to click a link to verify your identity. The sender's email address is security@rbc-alert-canada.com. What do you notice?
3. Your grandchild calls crying, saying they are in jail and need bail money. They beg you not to tell their parents. What is the best response?
4. What is the 3-Second Rule?
Module 2 Progress Checklist
Protecting Your Device: Antivirus and Real Tech Support
After learning about all these scams, you may be wondering: "What should I actually do to protect my device?" Here is the straightforward answer for each device type.
Good news: iPhones and iPads do not get traditional computer viruses. Apple's system is designed so that apps cannot interfere with each other or with the operating system. You do not need to buy or install antivirus software on your iPhone or iPad — it would not add protection and may actually be a waste of money.
What you should do instead:
- Keep your iOS software updated (Settings → General → Software Update)
- Only download apps from the official App Store
- Use a strong password or Face ID (covered in Module 3)
- Be careful about what you tap on — the Escape Hatch is your best tool
If you need real tech support for your iPad or iPhone: Go to your nearest Apple Store and ask for the free "Genius Bar" service. Appointments can be made at apple.com/ca/retail. No scammer will ever match the patient, professional help available there for free.
Your Android device already has built-in security called Google Play Protect. It automatically scans apps for harmful behaviour and runs silently in the background. For most users, this is sufficient.
What you should do:
- Keep your Android software updated (Settings → System → System Update)
- Only download apps from the official Google Play Store
- Check that Play Protect is on: Play Store app → your profile picture → Play Protect → turn on "Scan apps with Play Protect"
- If you want extra peace of mind: Malwarebytes Free is a well-respected, free security app available in the Play Store
Real tech support for Android: Best Buy's Geek Squad (paid, in-person) or the support website for your specific device (such as samsung.com/ca/support for Samsung).
Your Windows computer already includes Windows Defender (also called Microsoft Defender) — and it is genuinely excellent. Studies consistently show it performs as well as or better than most paid antivirus products. You do not need to buy Norton, McAfee, or other paid antivirus programs. Many of these products are overpriced, slow down your computer, and add unnecessary complexity.
How to confirm Windows Defender is protecting you:
- Click the Start menu (Windows logo, bottom left)
- Type "Windows Security" and press Enter
- The Windows Security centre opens — all sections should show a green checkmark
- If anything shows in red or yellow, click it and follow the instructions to resolve it
If you want a brand-name free option alongside Windows Defender, AVG Free Antivirus (avg.com) and Avast Free Antivirus (avast.com) are well-established, free, and used by hundreds of millions of people worldwide. However, Windows Defender alone is sufficient for most seniors — you do not need to install extra antivirus software.
Real in-person tech support for Windows:
- Best Buy Geek Squad — locations across Canada, paid service, generally trustworthy
- Staples Tech Services — similar to Geek Squad, available at Staples stores
- Your local library — many offer free tech help sessions; call and ask "Do you have technology help for seniors?"
- Senior centres — many community centres host free tech clinics; check your municipality's recreation guide
- Anyone who calls you offering to fix your computer — 100% scam
- Pop-up ads saying you have a virus and need to call a number — 100% scam
- Ads for "PC Cleaner" or "Speed Up Your Computer" software — almost always unnecessary at best, harmful at worst
- Door-to-door "computer repair" visitors — verify through official channels only
Real tech support is available at Apple Stores, Best Buy Geek Squad, and Staples. You find them — they never find you.
Where to Report Scams in Canada
Canadian Anti-Fraud Centre
The national reporting centre for fraud and scams. They track scams across Canada and help law enforcement investigate.
Phone: 1-888-495-8501
Official Government ResourceGetCyberSafe.gc.ca
The Government of Canada's official website for cyber security information. Written in plain language with practical tips.
Free & TrustworthyCongratulations! You have completed Module 2!
You now have a powerful security shield. The scammers do not stand a chance against someone who knows their tricks. Share what you have learned with a friend — you could protect them, too.
Feeling Stuck?
You do not have to figure this out alone. These free services are staffed by real, patient people who love helping:
Connected Canadians — 1-855-808-0505
Cyber-Seniors — 1-844-217-3057
Both services are free, Canadian, and specialise in helping older adults with technology at your own pace.
Quick Answers
Watch for four red flags: pressure to act immediately, requests for gift cards or e-transfer as payment, threats about arrest or account suspension, and requests to stay on the line. A real bank or government agency will never do any of these things.
Stop all contact immediately. Call your bank fraud line (the number on the back of your card). Report to the Canadian Anti-Fraud Centre at 1-888-495-8501. You are not in trouble — you are the victim.
The CRA does send letters by mail. They do not call to demand immediate payment, threaten arrest, or ask for gift cards. Hang up on any such call. You can call CRA directly at 1-800-959-8281 to verify any real balance owing.
When you receive an unexpected call or message creating urgency — pause for 3 seconds. Ask yourself: did I expect this? Is it asking me to act fast? Does it want money or personal information? If yes to any of these, it is likely a scam.
Learn exactly how the most common scams targeting Canadian seniors work — including the exact scripts criminals use and how to stop them.