Scam protection
The Security Shield
About 25 minutes, at your own pace
You are in a safe place. Nothing on this page can harm your device.
How to recognise and protect yourself from the most common scams targeting Canadians, so you feel empowered, not frightened, when it comes to online safety.
Dorothy's story
Dorothy, 72, lives in Ontario. One morning, she received a phone call from someone who said they were from the Canada Revenue Agency (the CRA, that is the government office that handles taxes). The caller said Dorothy owed $4,200 in unpaid taxes and that the police would come to her home within two hours unless she paid immediately using iTunes gift cards.
Dorothy's heart was pounding. She had always paid her taxes on time. But the caller was so convincing. He knew her full name, he sounded official, and he even gave her a badge number. Dorothy drove to her local pharmacy and bought $500 in iTunes cards before she called her daughter, who told her to hang up immediately.
Dorothy lost that $500. But she learned something powerful that day: scammers are professional liars. They practise sounding real. They use fear and urgency as weapons. And once you know their tricks, you can spot them from a mile away.
This module is Dorothy's gift to you: everything she wishes she had known before that phone call.
If you have ever felt embarrassed about nearly falling for a scam, please let that feeling go. Scammers spend months studying psychology, voice techniques, and pressure tactics. They test their scripts on hundreds of people and keep refining what works. Feeling unsure for even a moment when someone creates urgency is not weakness. It is proof that your instincts are working.
The truth about scams in Canada
Before we look at specific scams, here are some facts that might surprise you.
- The Canadian Anti-Fraud Centre reported that Canadians lost over $704 million to fraud in 2025, the highest year on record. The real number is much higher: the CAFC estimates only 5 to 10 per cent of fraud is ever reported, often because people feel too embarrassed.
- Scammers do not target people who are foolish. They target people who are trusting, polite, and law-abiding. Those are good qualities. Scammers exploit them.
- Being scammed is not your fault. These are professional criminals who do this for a living.
- The best defence is not technical skill. It is knowing what to look for. That is exactly what we are about to learn.
The 3-Second Rule
- Stop Do not tap, click, or respond.
- Breathe One slow, deep breath. Urgency is the scammer's weapon.
- Verify Contact the real organisation directly using a number from their official website or your bank card.
Learning about scams is not scary, it is empowering. You are building armour right now. Take your time with this module. There is a lot of information, but every piece makes you stronger.
Scam 1: The CRA phone scam
This is the most common scam targeting Canadians. Here is how it works.
This is Officer James Wilson, badge number 4471, calling from the Canada Revenue Agency. Our records indicate you have an outstanding tax debt of $4,200. A warrant for your arrest has been issued. To avoid immediate arrest, you must make a payment today. We accept payment through iTunes gift cards, Bitcoin, or wire transfer. Press 1 to speak with a payment agent.
Red flags to watch for
- The CRA will never call and threaten arrest. If you owed taxes, they would send you a letter in the mail first, multiple letters, in fact.
- No government agency accepts iTunes gift cards as payment. This is the biggest giveaway. Gift cards are untraceable, that is exactly why scammers want them.
- They create false urgency. "You must pay today" or "the police are on their way." Real government agencies give you time to respond.
- They get angry or threatening when you ask questions. A real CRA agent would be patient and professional.
- They ask you to stay on the phone. They do not want you calling someone else to check if this is real.
Applying the 3-Second Rule. Stop: Hang up the phone. You do not need to be polite to a criminal. Breathe: Remember that the CRA sends letters, not threatening phone calls. Verify: If you are worried, call the CRA directly at 1-800-959-8281 (this is their real number, you can find it on canada.ca).
No real government agency will ever ask you to pay using gift cards, Bitcoin, or wire transfers. If someone asks for payment this way, it is always a scam, no exceptions.
If you already responded. If you gave them gift card numbers, contact the gift card company immediately, they may be able to freeze the funds. Report the scam to the Canadian Anti-Fraud Centre at 1-888-495-8501. Do not feel embarrassed; you are helping protect others by reporting.
Save the real CRA phone number (1-800-959-8281) in your phone's contacts list right now. That way, if you ever receive a suspicious call about taxes, you can ring the real CRA directly to check.
Scam 2: The grandparent scam
This scam is particularly cruel because it targets your love for your family.
Grandma? It's me... [sobbing]... I'm in trouble. I was in a car accident in Montreal and I got arrested. Please don't tell Mom and Dad. My lawyer says I need $3,000 for bail. Can you send money through Western Union? Please, Grandma, I'm so scared.
Red flags to watch for
- They never say their name first. They wait for you to say "Is that you, Michael?" and then they say "Yes, it's Michael!" Now they know your grandchild's name.
- They beg you not to tell other family members. They need to isolate you so no one can verify the story.
- The "lawyer" calls back. A second person calls pretending to be a lawyer, confirming the fake story. This makes it feel more real.
- They need money urgently through untraceable methods. Wire transfers, gift cards, or cryptocurrency.
- Their voice sounds "off." They often explain this by saying they have a cold, or that the phone connection is bad.
Applying the 3-Second Rule. Stop: Do not send money. Breathe: Fear for a loved one is the most powerful emotion scammers can use. Take a moment. Verify: Hang up and call your grandchild directly at the phone number you already have. Call their parents. If your real grandchild answers and says "What are you talking about, Grandma?" you have just avoided a scam.
Consider creating a family code word, a secret word that only your family knows. If someone calls claiming to be a relative in trouble, ask for the code word. A scammer will not know it.
Scammers can now use artificial intelligence to clone voices. Even if a caller sounds exactly like your grandchild, always hang up and call your family member directly at the number you already have saved.
Scam 3: Fake bank emails (phishing)
Phishing (pronounced "fishing") is when a scammer sends you a fake email or text message pretending to be from a company you trust, like your bank. They are "fishing" for your personal information, hoping you will take the bait.
From: security-alert@rbc-banking-secure.com. Subject: URGENT: Unusual Activity on Your RBC Account. Dear Valued Customer, We have detected unusual activity on your RBC Royal Bank account. Your account has been temporarily locked for your protection. To restore access, please verify your identity by clicking the link below: [Verify My Account Now]. If you do not verify within 24 hours, your account will be permanently closed. RBC Royal Bank Security Team.
Red flags to watch for
- The email address is wrong. Look carefully: "rbc-banking-secure.com" is NOT a real RBC address. The real one would end in "@rbc.com", nothing else.
- It says "Dear Valued Customer" instead of your actual name. Your real bank knows your name.
- "URGENT" and deadline pressure. "You have 24 hours" is designed to make you panic and act without thinking.
- They want you to click a link. That link leads to a fake website that looks like your bank but is controlled by the scammer. If you type your password there, you are handing it to a thief.
- Threatening language. "Your account will be permanently closed", your bank would not close your account over one missed email.
Applying the 3-Second Rule. Stop: Do not click any links in the email. Breathe: Your bank account is fine. Real security issues are handled by phone, not email links. Verify: Open a brand-new web browser window (do not use any links from the email) and go to your bank's real website by typing the address yourself. Or call the number on the back of your bank card.
From: td-easyweb-security@td-bank-alert.net. Subject: Action Required: Your TD EasyWeb Access Has Been Suspended. We noticed a login attempt from an unrecognised device. For your safety, we have suspended your TD EasyWeb access. Click below to confirm your identity and restore your account: [Restore TD EasyWeb Access]. Failure to act within 12 hours will result in account suspension. TD Canada Trust Digital Security.
Notice the same pattern: a fake email address ("td-bank-alert.net" is not a real TD address), urgency ("12 hours"), and a link that wants your login information. The real TD website address is td.com, anything else is fake. Your bank website shows its exact name in the address bar (td.com). A fake site adds extra words: td-secure-login.com or td-bank-verify.net. These are not your bank.
Scam 4: Romance scams
Romance scams often begin on social media or dating apps. Someone sends you a kind message, you start chatting, and over weeks or months they build a relationship with you. Then the requests for money begin.
Week 1: "Hello, I noticed your lovely profile photo. My name is Robert, I'm an engineer working in Alberta." Week 3: Daily messages, phone calls, deep personal conversations. He is kind, attentive, everything you could want. Week 6: "I'm stuck overseas on a job. I need $2,000 for a plane ticket home. I'll pay you back as soon as I arrive. You're the only person I can trust."
Red flags to watch for
- They cannot video call. Their camera is always "broken" or the connection is always "bad." They use photos stolen from other people's social media.
- The relationship moves very fast. They say "I love you" within days or weeks.
- They have a dramatic reason they cannot meet in person. They are overseas, in the military, working on an oil rig, or some other story.
- They eventually ask for money. It starts small and grows. A medical emergency, travel costs, business problems.
- They ask you to keep the relationship private. They do not want your family or friends to ask questions.
Applying the 3-Second Rule. Stop: Never send money to someone you have not met in person. Breathe: This is emotionally difficult. It is okay to feel hurt or confused. Verify: Do a reverse image search of their profile photo (your family member or a tech helper can show you how), or ask them for a video call. If they always have an excuse, that is your answer.
Scam 5: Tech support scams
This scam usually starts with a phone call or a pop-up on your screen. The caller claims to be from Apple, Google, Microsoft, or another well-known company.
Hello, this is John from Apple Support. We have detected a security breach on your iPad. Hackers have accessed your device and we need to fix it immediately. I will need you to give me remote access to your iPad so I can remove the threat. There is also a $299 security service fee.
Red flags to watch for
- Apple, Microsoft, and Google will never call you about a problem you did not report. If you did not contact them first, the call is fake.
- They ask for remote access to your device. Never let a stranger control your device or computer.
- They charge a fee to "fix" a problem that does not exist.
- They found you, you did not find them. Real tech support waits for you to contact them.
Applying the 3-Second Rule. Stop: Hang up. Breathe: Apple, Google, and Microsoft did not call you. Your device is fine. Verify: If you are worried about your device, visit your nearest Apple Store or call Apple directly at 1-800-275-2273. For an Android device, use the maker's support website (such as support.google.com or samsung.com/ca/support). For Windows, use support.microsoft.com or a local, trusted repair shop, never the person who called you.
Scam 6: Fake package delivery texts
Canada Post: Your package could not be delivered. A shipping fee of $2.65 is required. Pay now to reschedule delivery: http://canadapost-redelivery-fee.com/pay
Red flags to watch for
- Canada Post does not text you about delivery fees. If there is a fee, they leave a notice card in your mailbox.
- The link looks almost right but is not. "canadapost-redelivery-fee.com" is not a real Canada Post website. The real one is canadapost-postescanada.ca.
- The amount is small on purpose. They hope you will think "$2.65 is no big deal" and enter your credit card number without thinking. Then they have your card number.
Applying the 3-Second Rule. Stop: Do not tap the link. Breathe: If you are expecting a package, check the real Canada Post website directly. Verify: Go to canadapost-postescanada.ca and use the tracking number from your order confirmation email.
You have now learned about six major scam types. Each scam follows the same basic formula: create fear or urgency, then ask for money or personal information. Once you see the formula, you see through the disguise.
Scam 7: "Microsoft" computer warnings
While browsing the web, a full-screen warning suddenly appears. This full-screen alarm is always fake. Real warnings from your device are small, calm notifications, not flashing alarms with a phone number to call.
MICROSOFT SECURITY ALERT! Error # DW6BD36. Your computer has been locked! Suspicious Activity Detected. Your browsing and personal data (including banking passwords) are being stolen. Call Microsoft Certified Technicians immediately: 1-877-555-0142. DO NOT SHUT DOWN YOUR COMPUTER.
Red flags to watch for
- Microsoft does not send warnings through your web browser. This is a webpage, not a real system alert.
- Error codes that look official but mean nothing. "Error # DW6BD36" is made up to sound technical.
- It tells you NOT to close the window. The opposite of what you should do. Close it immediately using your Escape Hatch from Module 1.
- A phone number. Real warnings from your operating system never include a phone number to call.
Applying the 3-Second Rule. Stop: Take your fingers off the screen. Breathe: This is a fake website, not a real warning. Your device was never in danger. Verify: On an iPad or iPhone, press the Home button or swipe up to close the browser. On Android, press the Home button, then close the browser tab. On Windows, close the browser window with the X button or press Alt and F4. When you reopen your browser, the warning will be gone.
Scam 8: Remote access and screen-sharing scams
Many of the scams in this module share one final, dangerous step: the caller asks you to let them see your screen or control your device from far away (this is called remote access). Screen sharing is a real, legitimate feature; families use it to help each other, and real companies use it when you call them for help. But in a scammer's hands, it is a window into your banking, your email, and your passwords, all at once.
The Canadian Anti-Fraud Centre received more than 112,000 fraud reports in 2025, with over $704 million in reported losses, the highest year on record. In 2024, Canadians aged 60 and over carried just over 40 per cent of all reported losses, about $179.9 million, with an average loss of roughly $21,604 per victim. Remote access and screen sharing show up across many of the worst of these frauds: fake tech support, fake bank security departments, and fake investment advisors alike all want to get onto your screen.
One question settles almost every case: who called who? Legitimate remote help only happens when you started it, with a person or company you contacted yourself, using a number you looked up or already had saved. If the contact came to you first, by phone, pop-up, email, or text, and that person wants to see or control your screen, it is a scam. There is no exception. Hang up.
This is the fraud department at your bank. Someone is moving money out of your account right now. Stay on the line, I will help you protect it. First, open your app store and download the screen-sharing app I name for you. Now read me the code it shows. Good. Now log in to your online banking so we can check whether the transfers went through.
Red flags to watch for
- No real bank, government office, or company will ever ask you to download an app so they can see or control your screen. Not your bank's fraud department, not the CRA, not your internet provider. Ever. This one rule stops the whole scam.
- They ask you to read out a code from your screen. That code is the key that lets them connect to your device. Reading it aloud is like reading out your house key's cutting pattern.
- They ask you to log in to your bank while they are connected. If they can see your screen, they can see your password as you type it and your accounts once you are in.
- A friendly "investment advisor" offers to guide you by controlling your screen. Investment fraud was the costliest fraud in Canada in 2025, at $351 million in reported losses, and many of these scams start with a helpful stranger steering your device toward a fake trading website.
- They insist you stay on the phone the whole time. Just like the CRA scam, they cannot let you pause and check with someone you trust.
Applying the 3-Second Rule. Stop: Hang up. Do not download anything a caller asks for. Breathe: Your money is not moving anywhere; that story is the scammer's pressure tactic. Verify: Call your bank yourself using the number on the back of your bank card. If the fraud department really needs you, that number reaches the real one.
Do not feel ashamed, act quickly instead. First, disconnect from the internet (turn off your Wi-Fi or unplug the router) so the connection is cut. Second, call your bank using the number on your bank card and tell them what happened. Third, using a different device if you can, change the passwords for any account you opened while they were connected. Fourth, have your device checked by a trusted family member or a local repair shop before you use it for banking again. Finally, report it to the Canadian Anti-Fraud Centre at 1-888-495-8501; the CAFC estimates only 5 to 10 per cent of fraud is ever reported, and every report helps protect someone else.
Screen sharing with your own family is still fine. The difference is simple: you chose the person, you started the call, and you can hang up any time. The danger is only when a stranger who contacted you asks to get onto your screen.
The safest way to get help with your device is to decide in advance, while nothing is going wrong. Pick one person, usually a family member, and write their name and number down near your computer. Agree that this is the only person you will ever let see your screen, and agree on how you will know it is really them. If anyone else asks, including someone claiming to be from your bank, the government, or a tech company, the answer is no. And if you are ever unsure about anything, hang up and call your named helper first.
Your master scam-spotting checklist
You can use these questions to evaluate any suspicious message, email, phone call, or website. If the answer to any of these is "yes," it is very likely a scam.
- Does it create urgency? ("Act now!" "You have 24 hours!")
- Does it create fear? ("Your account is locked!" "The police are coming!")
- Does it ask for unusual payment methods? (Gift cards, wire transfers, cryptocurrency)
- Does it ask you to click a link to fix a problem?
- Did they contact you first, rather than you contacting them?
- Does it ask you to keep it secret from family?
- Does the email address or website look almost right but not quite?
- Is the greeting generic ("Dear Customer") rather than using your name?
Protecting your device: antivirus and real tech support
After learning about all these scams, you may be wondering what you should actually do to protect your device. The good news is that every modern device already includes strong, built-in protection.
- iPhone and iPad: these do not get traditional computer viruses, and you do not need to buy antivirus software. Keep your software updated, only download apps from the official App Store, and use a strong password or Face ID.
- Android: your device already has built-in security called Google Play Protect, which scans apps automatically. Keep your software updated and only download apps from the official Google Play Store. Malwarebytes Free is a well-respected free option if you want extra peace of mind.
- Windows: your computer already includes Windows Defender (also called Microsoft Defender), which performs as well as most paid antivirus products. You do not need to buy Norton, McAfee, or similar. To check it, open the Start menu, type "Windows Security", and look for green checkmarks.
For an iPad or iPhone, book the free Genius Bar service at your nearest Apple Store (apple.com/ca/retail). For Android and Windows, Best Buy Geek Squad and Staples Tech Services offer paid in-person help. Many local libraries and senior centres also offer free tech clinics. You find them, they never find you.
Anyone who calls you offering to fix your computer is a scam. Pop-up ads saying you have a virus and need to call a number are a scam. Ads for "PC Cleaner" or "Speed Up Your Computer" software are almost always unnecessary at best, harmful at worst. Door-to-door "computer repair" visitors should be verified through official channels only.
Where to report scams in Canada
- Canadian Anti-Fraud Centre: the national reporting centre for fraud and scams. Phone 1-888-495-8501. Website antifraudcentre-centreantifraude.ca.
- GetCyberSafe.gc.ca: the Government of Canada's official website for cyber security information, written in plain language with practical tips.
You do not have to figure this out alone. Connected Canadians (1-877-304-5813) and Cyber-Seniors (1-844-217-3057) are free, Canadian services staffed by real, patient people who specialise in helping older adults with technology at your own pace.
Quick check: test your knowledge
Tap the answer you think is correct. There is no score kept and nothing to sign in to.
1. You receive a call from someone claiming to be from the CRA, saying you owe taxes and must pay with iTunes gift cards. What should you do?
2. An email from "RBC" says your account is locked and you need to click a link to verify. The sender's email address is security@rbc-alert-canada.com. What do you notice?
3. Your grandchild calls crying, saying they are in jail and need bail money. They beg you not to tell their parents. What is the best response?
4. What is the 3-Second Rule?
5. A caller says they are from your bank's fraud department and asks you to download a screen-sharing app so they can "secure your account." What should you do?
Your progress
Tick each item as you feel confident with it. This is saved on this device only, with no account needed.
Go deeper: scam deep dives
If you would like to learn exactly how the most common scams targeting Canadian seniors work, including the exact scripts criminals use and how to stop them, these deep-dive pages open in the original site.
- Courier Fraud (opens the original site in a new tab)
- Call Forwarding Scam (opens the original site in a new tab)
- CRA Phone Scam (opens the original site in a new tab)
- Grandparent Scam (opens the original site in a new tab)
- Romance Scams (opens the original site in a new tab)
- Remote Access and Screen-Sharing Scams (opens the original site in a new tab)
Also available for kids
Running a family digital literacy session? DCC Kids has age-appropriate versions of this topic. These lessons open in the original site.
- Ages 10 to 12: Spotting a "please don't tell your parent" message (opens the original site in a new tab)
- Ages 7 to 9: Telling a grown-up when something online feels weird (opens the original site in a new tab)
- Ages 4 to 6: Secret stuff and share stuff (opens the original site in a new tab)
Send this lesson to someone
Helping a parent or friend? This page works on its own, with no account and nothing to install. Copy the link and text it to them.
Well done. You now have a powerful security shield. The scammers do not stand a chance against someone who knows their tricks. Share what you have learned with a friend, you could protect them too.