How not to get scammed: protecting your money in Canada

No real bank, police force, the CRA, Service Canada, a utility, a court or a border agency will ever phone you and ask you to send money, buy gift cards, move funds to a 'safe account', pay in cryptocurrency, or read out a verification code. Not once, not ever, in any circumstance.

If any of those things are being asked of you, it is a scam — no matter how convincing the caller sounds, no matter what number shows on your display, and no matter how urgent they claim it is. Caller ID is trivially faked, so a call that appears to come from your bank's real number tells you nothing.

Hang up. Then call back on a number you look up yourself — the one on the back of your bank card or on the official website you typed in — never a number the caller gave you and never by pressing a key on the call you are already on.

Bank investigator: someone claiming to be from your bank's fraud department says your account is compromised and asks you to move money to a 'secure' account or hand cash to a courier. Real banks freeze accounts themselves; they never send someone to your door.

CRA and immigration threats: a caller says you owe tax or that your SIN has been used in a crime, and that police are on the way unless you pay immediately, often by gift card or Bitcoin. The CRA sends letters and never demands payment in gift cards.

Romance and investment scams: a relationship built over weeks or months on a dating app or social platform leads to a 'can't-miss' crypto or forex opportunity on a slick website that shows fake gains. The site lets you withdraw a small amount early to build trust, then demands 'taxes' or 'fees' before releasing the rest. Those fees are the scam.

The grandparent and emergency scam: a caller pretending to be a grandchild or their lawyer says they were arrested and need bail money kept secret from the rest of the family. Secrecy is the tell. Hang up and call the family member directly.

Fake e-Transfer and delivery texts: a link claiming a payment or parcel is waiting takes you to a perfect copy of your bank's login page. Never reach your bank through a link in a text or email — open the app or type the address yourself.

Job and rental scams: an 'employer' overpays with a cheque you must partly wire back, or a landlord asks for a deposit sight-unseen. Cheques can bounce weeks after the bank makes the funds available, and you are on the hook for the whole amount.

Multi-factor authentication (MFA) means logging in needs two things: something you know (a password) and something you have (your phone or a security key). With MFA on, a stolen password on its own is useless.

Turn it on everywhere it exists, starting with your email, then banking, then anything holding money or personal identity. Your email account is the master key — whoever controls it can reset every other password you own, so protect it first.

Not all MFA is equal. A security key or an authenticator app (Google Authenticator, Microsoft Authenticator, Authy, or your phone's built-in passkey support) is much stronger than a code sent by SMS, because text messages can be intercepted through SIM swapping. Use an app or a passkey where you have the choice.

Never read a verification code out loud to anyone who calls you, and never approve a login prompt you did not personally trigger. Every legitimate code message says so in the text, and a scammer's entire plan often depends on you handing that code over.

The two things that matter are length and uniqueness. A long passphrase of four or five unrelated words is far stronger than a short password full of symbols, and much easier to remember.

Never reuse a password across sites. When any one company is breached, criminals take the leaked email-and-password pairs and try them everywhere else automatically. Reuse is how one small breach becomes a drained bank account.

Use a password manager — the one built into your browser or phone is fine, and dedicated apps like 1Password or Bitwarden are better. It generates a unique random password per site, fills them for you, and will not autofill on a fake look-alike domain, which quietly catches phishing sites you would have missed.

Avoid anything guessable from your life: birthdays, children's names, your street, your team, or a password you have used since school. Change the password on any account that appears in a breach notification, and check your email address at a breach-notification service.

Set up transaction alerts on every card and account so an unfamiliar charge reaches you in seconds rather than at month's end. Most Canadian banks let you cap e-Transfer limits — lower them to what you actually use.

Guard your SIN. It is needed for employment, banking and tax, and almost nothing else. A landlord, an employer before hiring, or a stranger on the phone has no right to it.

Place a free fraud alert or credit lock with Equifax Canada and TransUnion Canada if you suspect your identity has been exposed, and check your credit report once a year for accounts you did not open.

Shred financial mail, keep your devices and browser updated, and be careful with public Wi-Fi — do not log in to banking on a network you do not control unless you are using your phone's own data.

Speed matters. Call your bank immediately — funds can sometimes be recalled if the transfer is only minutes or hours old. Change the password on your email first, then on every affected account, and turn on MFA while you are there.

Report the fraud to the Canadian Anti-Fraud Centre at 1-888-495-8501 and to your local police. Report identity theft to both credit bureaus and ask for a fraud alert on your file.

Do not send more money to recover money. 'Recovery' offers that follow a scam — a lawyer, an agency, or a fee to release your funds — are almost always the same criminals coming back for a second pass.

Being scammed is not a sign of foolishness. These operations are professional, scripted and rehearsed, and they target everyone. Reporting it quickly is what limits the damage and helps the next person.