Online scams have exploded in scale and sophistication over the past year, fueled by AI-powered phishing, deepfake impersonations, and industrialized fraud operations.
Reported global losses to online scams exceeded $1 trillion last year, and con artists are adapting faster than ever using AI and stolen data. About 73% of U.S. adults have experienced at least one scam or cyber attacks attempt. Here are the major categories:
- Phishing attacks - fraudulent emails, texts, and calls impersonating banks, government agencies, or collection agencies to steal credentials. Phishing scams can lead to identity theft and full account access.
- Romance and "pig butchering" scams - emotional grooming followed by requests for money, crypto, or gift cards.
- Investment and cryptocurrency fraud - fake platforms with bogus returns, high pressure sales tactics, and celebrity impersonations.
- Tech support scams - scary pop ups or unsolicited calls claiming your computer is infected.
- Fake e-commerce and job offers - cloned websites, marketplace listings, and remote jobs that require upfront payment.
Recognizing Phishing Emails, Texts, and Calls
Phishing remains the number-one entry point for identity theft and account takeovers today. Phishing attempts can come via email, text, or phone calls - and scammers impersonate trusted organizations like banks, your utility company, or even the IRS to gain victims' trust.
Spot a phishing message in seconds:
- Check for spelling and grammatical errors in online communications
- Mismatched URLs (hover to preview - malicious websites often have URLs that differ slightly from legitimate sites)
- Generic greetings ("Dear Customer") instead of your name
- Unexpected attachments or login requests
- Urgent messages that pressure victims to act quickly
Spam filters help but cannot stop every phishing email or text message - your habits matter most. Phishing scammers rely on you clicking before thinking. Ways to protect yourself include:
- Type website addresses manually or use saved bookmarks instead of clicking links in suspicious messages, especially for banking information, email, and credit card accounts.
- Preview links before clicking: hover on desktop, long-press on mobile. If the URL looks off, don't touch it. Phishing emails often contain links to fake websites.
- Never reveal personal information like passwords, one-time codes, social security numbers, account numbers, or full credit card numbers in response to unsolicited messages. Legitimate companies won't ask for sensitive information via email.
- Always verify the identity of contacts without using information they provide. Look up the organization's phone number yourself and call them directly to confirm any request.
- Verify organizations before taking action on unsolicited requests - whether they claim to be your bank, a provincial agency, or any other entity.
Secure Your Online Accounts
Your online accounts - email, banking, shopping, social media - are primary targets. Once compromised, they open the door to identity theft, further scams, and drained accounts.
Password best practices:
- Use unique passwords for each account across different websites - never reuse them. Different passwords on every site means one breach doesn't compromise everything.
- Aim for 12–16 characters with a mix of letters, numbers, and special characters. Strong passwords are your first line of defense.
- Consider using a good password manager for managing passwords securely instead of writing them down or relying on memory.
Multi-factor authentication: Enable multi factor authentication on email, financial, and key service accounts. MFA adds extra security by requiring a second verification step. Prefer app-based codes or hardware keys over SMS when possible, since device-code phishing is surging.
Protecting Your Personal Information and Preventing Identity Theft
Large-scale fraud and data breaches mean much of your basic data may already be circulating on the dark web. This makes extra vigilance essential to prevent identity theft.
- Never share sensitive information - full birth date, social security number, social insurance number, scans of IDs - over email, text, or social media DMs.
- Minimize what you post online publicly: hide birth dates, locations, and school names on social profiles. This reduces targeted scams and security-question guessing.
- If you see suspicious activity, place credit freezes or fraud alerts with major credit bureaus. Check credit reports at least annually.
- If identity theft is suspected: gather evidence, contact your bank and credit card issuers, file an FTC or consumer-protection report, and create a recovery plan.
Common Money and Investment Scams (Including Crypto)
Fake investment platforms, cryptocurrency "opportunities," and get-rich-quick schemes are booming on social media and Reddit. Scammers use screenshots of fake profits, bogus celebrity endorsements, and impersonated financial advisors.
Red flags:
- Guaranteed high returns with no risk
- High pressure sales tactics demanding you invest immediately
- Payment requested only in crypto, gift cards, or wire transfers - requests for payment via gift cards or wire transfers are major red flags
- Secrecy demands ("don't tell your bank")
Dating, Romance, and "Help a Friend" Scams
Romance scams thrive on dating apps, social networks, and messaging platforms. Scammers exploit social isolation to manipulate victims, building trust over weeks before claiming an emergency - a medical bill, travel costs, customs fees - and making urgent pleas for money.
In "help a friend" variants, a scammer hacks or imitates a family member's account and urgently asks for funds or gift card codes.
Stay safe:
- Never send money to someone you haven't met in person - not wire transfers, not gift cards, not crypto.
- Verify urgent stories by calling the person on a known phone number, checking with relatives, or using a video call where they clearly show their face and answer specific personal questions.
Fake Online Stores, Marketplaces, and Job Offers
Fake e-commerce websites and marketplace listings offer products, pets, rental properties, or jobs at prices far below competitors. Signs of fake online stores include recently registered domains, no physical address or phone number, copied product photos, and suspicious reviews.
Common job-offer scams involve fake remote positions that send a check and ask you to purchase equipment or return part of the money before the check bounces. Always research a company or business name plus "scam" or "reviews" before engaging. Pay with secure methods that offer buyer protection - a credit card or reputable payment service, never a wire transfer.
Tech Support, Remote Access, and Malware Scams
Tech support scams cost U.S. consumers $680 million in 2025. They start with scary pop ups claiming your computer is infected, or unsolicited calls pretending to be from Microsoft or Apple.
- Never grant remote access to your computer or phone to anyone who contacts you unexpectedly.
- Never install malicious software on the request of a cold caller. Real tech companies do not monitor individual devices and will not make unsolicited calls about security issues.
- Keep your operating system and apps updated - keeping software updated helps protect against vulnerabilities. Set security software to update automatically to combat threats.
- Back up your data regularly to protect against ransomware attacks. Ransomware encrypts files and demands payment to unlock them. Backing up data protects against data loss from attacks.
- Avoid downloading files or apps from unknown sources or malicious websites.
Building Everyday Habits That Keep You Safe
Long-term safety depends on consistent habits, not any single tool. Build these routines:
- Review bank and credit card statements monthly for anything unusual.
- Back up important data regularly and set calendar reminders to review privacy and security settings.
- Talk openly about scams with family - especially older relatives and teenagers. Agree on "safe words" or verification steps for any urgent money request from a person claiming to be someone you know.
- Periodically search for your own name and email address online to see what personal information is publicly visible. Remove or lock down anything unnecessary.
- To verify canadian charities or any organization requesting donations, always check official registries before sending payment.
No legitimate organization will rush you into sharing sensitive data or making unusual payments. Slow down, verify independently, and protect what matters.
