What is phishing?

What is phishing?

Phishing is a common tactic used to obtain personal and financial information from victims through texts, emails or phone messages. They usually take the form of someone pretending to be a representative of a trusted institution such as your bank, a law enforcement agency or the government.

Ottawa Police Services has information about 20 different cyber crimes including the bank investigator scam. It commonly involves the victim being told that their credit card or online account has been compromised or flagged for suspicious or unauthorized purchases. They are asked to provide their credit card information to remedy the issue.

In another common scam, victims are told they are being contacted by Canada Revenue Agency (CRA) concerning unpaid taxes. They are threatened with severe consequences – such as a police visit to their home – unless they forward money immediately to make amends.

We all get these messages and most of us ignore them. But occasionally, they find their way to a person who believes the claims are true and forwards money as requested.

That is not how police or government agencies work. In Ottawa, if police want to talk to you about a criminal investigation they will usually call and say they would like to schedule an appointment. (They come unannounced with a warrant if they feel someone else may be in danger or the wanted person is considered a flight risk.) They will never demand money to resolve any issue.

The same is true with the CRA. In some cases, the agency may send out an email to inform the recipient that they have been sent a message about money owing. That message will only be viewable if the person uses their credentials to log in through a special portal on the CRA website.

A variation is an email or text with minimal wording that encourages you to click on links or attachments. It may seem like a receipt from a recent purchase, a delivery notification or something more urgent. If you click on the link or attachment, your computer may be infected with a virus or malware.

Who responds to phishing emails?

I had a call from an Ottawa resident who said that Canada Border Services had just called him to say they were coming to arrest him unless he immediately sent a payment related to the marijuana he had ordered online. I told him to relax, as Canada Border Services does not operate like that.

Phishing emails are getting more sophisticated and convincing. They can seem like the real thing so it is not surprising that some people respond to them. Older Canadians who are not internet-savvy are often vulnerable.

Even senior bureaucrats have fallen for these scams. Here in Ottawa, a former city treasurer was convinced to send $128,000 to a fictitious U.S. firm in July 2018, according to a media report.

The story notes the treasurer wired the money within hours of receiving a request from what she thought was the city manager, asking her to send the cash as part of a soon-to-be-announced deal that had been negotiated with a new city vendor.

“The message came from an email address that appeared legitimate, but was from outside the city’s internal email system,” the news report explains.

How do you handle phishing emails?

Ottawa police give these tips if you receive phishing emails.

• Never provide remote access to your computer.
• Don’t provide personal information over the phone.
• Ask the caller for their name, where they work and a reference number. Advise them you will independently verify their information. Don’t use a number provided by the caller, look up the phone number via the Internet or documentation you have.
• Don’t be pressured. Take time to talk to a trusted friend or family member to get their opinion about what you are being asked to do.
• If in doubt, contact your local police service.

What are some examples of phishing emails?

After Ontario Premier Doug Ford announced that he was dropping the fee for licence plate renewal and reimbursing residents who had already paid, many people received a phishing email that read: “Service Ontario: As you know, we have removed licence plate stickers on all vehicles, so we are giving you back $120.00 CAD. Get hold of it here: [malicious link] *Data rates may apply.”

Another common one read: “Canadian-benefit.gov@outlook.com Subj: 100001 Government of Canada sent you $540.00 (CAD) and the money is waiting to be deposited into your bank account. Message: Government of Canada has started to sending out federal payment by e-Transfer. Click here to deposit your funds: [malicious link] Reference number: CA2vSg6e Data rates may apply.”

What is COVID fraud?

The short supply of testing kits and remedies during the COVID pandemic led to what has been dubbed COVID fraud, with some people falsely claiming they could provide the kits and treatment people were anxiously seeking. According to information from the Canadian Fraud Centre, there were 32,442 reports of COVID-19 fraud reported between March 6, 2020 and March 31, 2022, with almost 30,000 people losing $8.17 million.

My experience with ‘Dave from the CRA’

I once had a voice message from someone who identified himself as “Dave from the CRA,” telling me I owed money. I called him back and asked for his full name. He said he was “Dave from CRA” and that is all the information he would provide. I asked what department he was in, such as auditing and recovery, but he was unable to elaborate further. I asked why he was calling from a number outside the 613 area code and why he was calling from a cellphone, instead of a landline. Again, no response. I hung up on “Dave.”

I recommend that people do not return phone calls to messages from unknown callers claiming to represent the CRA, police or other institutions when these institutions claim you owe them money or you will be arrested.

Call me if you have been charged

Since most phishing operations are located beyond our borders there are few cases that have made it to Canadian courts. But phishing is a form of fraud and if you have been charged, the Crown must demonstrate beyond a reasonable doubt that you “by deceit, falsehood or other fraudulent means” defrauded someone else or an institution. If you are facing any criminal charge in the Ottawa-area, contact me for a free consultation.