The email looks official. It has the logo. It says there’s a problem with your account, a package you missed, or a refund waiting for you. All you have to do is click the button.
That button is the trap. Phishing emails are designed to look like they come from a company you trust — your bank, Canada Post, Netflix, Amazon, the CRA — so that you’ll click a link and type in your password, your card number, or other personal information.
The good news: a phishing email can’t do anything on its own. It only works if you click.
The Warning Signs
The Government of Canada’s Get Cyber Safe program lists the signs to watch for. A phishing email often:
- Asks you to “verify” or “validate” your account by clicking a link
- Says there’s a problem with your account that needs fixing right away
- Threatens you — your account will be closed, your service cut off, legal action taken
- Offers something too good to be true — a prize, a refund, a free gift
- Has small mistakes — spelling errors, a blurry logo, or a sender address that’s slightly off
⚠ Check the sender’s address — not just the name
The name at the top of an email can say anything. Look at the actual email address beside it or underneath it. An email “from your bank” that comes from a Gmail address, or from a misspelled company name, is not from your bank.
Three Things to Do Instead of Clicking
Pause
Phishing emails are written to make you hurry. Any message that makes you feel panicked, rushed, or excited is a message to slow down on. Nothing real will disappear in the next ten minutes.
Check where the link really goes
On a computer, rest your mouse pointer on the link without clicking — called hovering — and the real web address will appear, usually in the bottom corner of the screen. If it doesn’t match the company, don’t click. On a phone or tablet, it’s harder to check, so it’s safest not to tap at all.
Go to the company yourself
If you’re worried the message might be real, don’t use anything in the email. Type the company’s website address yourself, open their app, or call the number on your bank card or a real bill. If there’s truly a problem with your account, you’ll see it there.
✓ A rule worth keeping
Real companies don’t ask you to confirm your password, PIN, or card number by email. If an email asks for any of them, it’s a scam — even if everything else looks right.
The Same Trick, by Text
Scammers send the same kind of message by text, too — it’s called smishing. Missed delivery notices, toll charges, and bank alerts are common. The same rules apply: don’t tap the link, and go to the company yourself.
You can report a scam text to your phone company for free by forwarding it to 7726 — the numbers that spell SPAM on a phone keypad. It helps them block the same message for everyone.
If You Already Clicked
It happens to careful people every day. What matters is what you do next:
- If you typed in a password, change it right away — by going to the real website yourself, not through the email. If you use that password anywhere else, change it there too.
- If you entered banking or card details, call your bank using the number on the back of your card.
- Report it to the Canadian Anti-Fraud Centre at 1-888-495-8501. The CAFC estimates only 5 to 10 per cent of fraud is ever reported — every report helps.
⚠ Disclaimer
This article is for general information and awareness only and does not constitute legal, financial, or cybersecurity advice. Information is drawn from publicly available sources including the Government of Canada’s Get Cyber Safe program and the Canadian Anti-Fraud Centre. The Lady Tech is not affiliated with any company or organization mentioned and assumes no liability for outcomes resulting from the application of information in this article. Phone numbers were current as of November 18, 2026.