Don’t reply! Instead, pause & assess the situation

Ask Yourself

• Is the information request legitimate? (no reputable institution asks for personal information online)
• Is the sender legitimate? (check the “from” address carefully)
• Is the link legitimate? (hover over the link, to discover the hyperlink and check its validity)
• Is the attachment one that you have reason to expect to receive?
• Is this message demanding instant action, and threatening you with severe consequences if you don’t obey?
• Is the language vague (no specifics), or dramatic (big offer, big threat)?
• Might this be AI? (unnatural language, unnatural speech patterns)

Check that your financial assets — e.g. bank accounts, credit cards, mortgage — are still intact

If you notice any changes, contact your financial institution immediately.

• “Personal information” includes credit/debit card numbers, bank account numbers, financial institution logins/passwords, your SIN, your home address, your mother’s maiden name, any one-time online passwords, etc.
• “Online” includes text, email, instant messaging

Remember: reputable institutions (e.g., financial or government) will provide you with an alternative if you decline to provide information over the phone or email.

This helps protect other people as well

• Canadian Anti-Fraud Centre 
• Canadian Revenue Agency 
• your local police
• the national credit agencies (Equifax and TransUnion)
• your own financial institution(s) and legal advisors, especially if money transfer or attempted identity theft is involved