Suspicious messages
Before you click the thing.
Emails, texts, QR codes, notifications, attachments, links, and messages that suddenly want your money, login, code, or attention.
If a message wants you to act quickly, pause and verify through a known channel.
Why messages can look official
Logos, sender names, caller ID, and polished language are easy to copy. A message can look like it's from your bank, a delivery company, or the government and still be nonsense. The look of a message isn't proof of who sent it.
Common pressure patterns
Most suspicious messages lean on urgency, authority, fear, reward, relationship, or confusion. 'Act now,' 'your account will be closed,' 'you won,' 'I need help'—each is a reason to slow down, not a reason to act.
Links, attachments, QR codes, and logins
Don't rely on a link, attachment, QR code, email address, phone number, or app notification supplied by the message itself. If a message wants you to log in, type the official website address yourself or use the official app you already installed.
How to verify independently
Use a contact method you know is real: the number on your bank card, a statement, an official website you typed yourself, or the official app. Ask a trusted person to help you check if you're unsure. Compare the request against information from an official source.
If you already clicked
If you clicked something or shared information, don't panic. Stop, avoid entering more information, and use a known official route to check the relevant account or organization. See If something happened for next steps.
Try this now
Save one official bank, mobile-provider, or government login page in a place you can find later.
What not to assume
A logo, caller ID, email signature, profile photo, or professional tone doesn't prove a message is real.
Urgency can wait 30 seconds.
Official Canadian resources
If you're in immediate danger, call 911 or your local emergency number when it's safe to do so.