Cybersecurity & Internet Fraud
How scams and hacking really work — and the calm habits that defeat them.
Starter edition · Last reviewed 13 Nov 2026The challenge
Most internet crime is not clever hacking — it is deception. Criminals impersonate banks, government agencies, employers and even family members, then create urgency so you act before you think. Investment scams, fake invoice and email-compromise schemes, romance scams and phishing messages all run on the same fuel: trust, hurry and secrecy.
Seniors are targeted heavily, small businesses are hit through fake invoices and payroll changes, and AI voice cloning now lets a criminal imitate a loved one's voice. The good news: a small set of habits defeats most of it.
What the evidence says
Practical solutions
- Pause and verify. Any urgent request for money, gift cards, crypto or passwords gets checked through a separate channel — call the number on your card or the official website, never the number in the message.
- Use a unique password for every account, kept in a password manager, and turn on multi-factor authentication (or passkeys) everywhere it is offered — email and banking first.
- Treat "guaranteed returns" as a confession. No legitimate investment guarantees quick, high profits. Pressure to keep it secret is another confession.
- Read addresses letter by letter. Scammers register look-alike domains and email addresses with one character changed.
- Keep phones and computers updated — updates close the holes criminals walk through.
- Back up what matters (photos, documents) in two places, one offline, so ransomware and theft cannot take everything.
- Agree a family code word. If a "relative" calls in a panic asking for money, ask for the word. A cloned voice cannot know it.
- Report fast. In Canada: the Canadian Anti-Fraud Centre, 1-888-495-8501, or reportcyberandfraud.canada.ca. Speed is what makes recovery possible.
If you think you have been scammed — the first 24 hours
- Call your bank immediately using the number on your card. Ask them to freeze what they can — transfers are sometimes reversible in the first hours.
- Change passwords from a clean device (not the one you suspect), starting with email, then banking. Turn on multi-factor authentication as you go.
- Keep the evidence — screenshots, messages, receipts, wallet addresses. Do not delete the conversation.
- Report it to the Canadian Anti-Fraud Centre (1-888-495-8501) and, if money was lost, your local police. Reporting protects others and feeds the intelligence banks use to block the next attempt.
- Tell your family. Scammers sell the names of people who responded once. Warn the people around you, without shame — these schemes are engineered by professionals.
- Watch for the second scam: "recovery agents" who contact victims offering to get money back for a fee are usually the same criminals returning.
Test yourself
Questions people ask
Will my bank ever call and ask for my password or PIN?
No. Banks, the CRA and police do not ask for full passwords, PINs or one-time codes by phone, text or email. If someone does, it is a scam — hang up and call the official number yourself.
Is antivirus software enough to keep me safe?
It helps against malicious software, but most losses today come from deception, not viruses. Verification habits, unique passwords and MFA protect you where antivirus cannot.
I sent money to a scammer. Is it gone for good?
Not always — wire and e-transfer recalls sometimes succeed when the bank is alerted within hours. Call immediately, keep every receipt, and report to the Anti-Fraud Centre. Beware anyone who later offers to "recover" it for a fee.
References
- FBI IC3 — 2024 Internet Crime Report (April 2025)
- RCMP — National Cybercrime and Fraud Reporting System (Canadian Anti-Fraud Centre figures, Nov 2025)
Facts above are labelled with their sources and dates. Where this centre offers guidance, it is educational information to help you decide — not a substitute for advice about your own situation.