How to Spot a Phishing Email: 5 Canadian Examples Decoded

A text says the CRA owes you $412 and will send it by Interac e-Transfer. An email from "Canada Post" wants $2.99 to release a parcel. Your office manager gets a Hydro-Québec refund notice with a "secure" link.

These messages borrow the names of organizations every Canadian deals with. That's exactly why they work.

Here's the upside: each of these organizations has published what it will never do by email or text. Once you know those rules, most fakes fall apart in ten seconds. Below are the warning signs to check, followed by five examples taken apart line by line.

Seven warning signs to check before you click

The Canadian Centre for Cyber Security sums it up well: a message is suspicious when it rushes you, asks for information or invites you to log in through a link. Run through this list:

• Urgency: a deadline, or a threat of disconnection, suspension or penalties.
• The ask: a password, card number, SIN or a code sent to your phone.
• The link: the real address doesn't match the organization's official website.
• The sender: a familiar name with an odd email address or unknown number.
• Too good to be true: a refund, credit or prize you weren't expecting.
• The channel: an organization that says it doesn't text… is texting you.
• The context: you aren't expecting a parcel, a refund or a shared document.

One caveat: stop relying on typos. The Cyber Centre notes that AI makes those clues less reliable. Polished English proves nothing.

Five examples, taken apart

The messages below are fictional reconstructions based on schemes the organizations themselves have warned about. The addresses use the reserved .example domain and lead nowhere.

1. The CRA e-Transfer refund

Text: "CRA: You are eligible for a tax refund of $412.15. Accept your Interac e-Transfer within 24 hours: cra-refund-deposit.example/accept"

What's wrong: the CRA says it will not send refunds or payments by e-Transfer or text message, and that it doesn't use texts or instant messaging at all, apart from MFA codes you signed up for. The 24-hour deadline is pure pressure.

2. The Canada Post parcel fee

Text: "Canada Post: your package is on hold at our sorting facility. A $2.99 fee is required or it will be returned to sender: cp-delivery.example/track"

What's wrong: Canada Post never asks, by email or text, for payment to release a delivery, or for your credit card details. The tiny amount is bait. What they want is your card number.

3. The Hydro-Québec "overpayment"

Email: "Hydro-Québec: an overpayment of $86.40 was detected on your account. Claim your refund before 11:59 p.m.: hq-refund.example/customer"

What's wrong: Hydro-Québec states that it never issues refunds or compensation by text or email. Add the midnight deadline and an address that isn't Hydro-Québec's, and you have three red flags out of seven. Revenu Québec follows the same logic: its alerts contain no hyperlinks or attachments.

4. The SAAQ licence "credit"

Text: "SAAQ: you were overcharged when renewing your driver's licence. Get your credit here: saaq-credit.example"

What's wrong: in December 2024, the SAAQ called out this exact scheme and reminded Quebecers that it doesn't contact clients by text about this kind of issue. To check your file, go to SAAQclic by typing the address yourself.

5. The fake Microsoft 365 login (the one aimed at your business)

Email: "A document has been shared with you: Invoice_Q3.pdf. Sign in to view it." The button leads to m365-login.example.

What's wrong: this one isn't after your credit card. It wants your work password, and sometimes your MFA code. A genuine shared file is also visible when you sign in to OneDrive or SharePoint the usual way. Mailboxes stolen like this are a favourite launch pad for business email compromise and CEO fraud.

What these organizations say they never do

Keep this table handy, or post it near reception.

How to check without taking a risk

Not sure? Here's how to settle it safely.

1. Never use the link you received. Type the official address into your browser or open the organization's app. If the problem is real, it will show up in your account.
2. Look at the address without opening it. Hover with your mouse, or long-press on a phone. A domain that "looks like" the real one isn't good enough.
3. Call a number you already have, from a bill or the official website, never the one in the message.
4. Confirm through another channel when the message comes from a colleague or supplier. A quick phone call settles it.
5. Be wary of QR codes too. The Cyber Centre lists them among phishing vectors. Same rule: don't scan a code that shows up without context.

Report it, then delete it

Reporting takes a minute and protects your coworkers.

• At work: forward the message to your IT contact, or use your mail app's "Report" button. Don't forward it to colleagues "to see what they think."
• Texts: forward them to 7726. Your carrier may block the sender.
• Hydro-Québec: the utility asks for a copy of suspicious messages at [email protected].
• Canadian Anti-Fraud Centre: online through the federal Report Cybercrime and Fraud platform, or at 1-888-495-8501.

Then delete the message. Already clicked? Don't panic: follow our guide on what to do after clicking a phishing link.

What your business can do on its side

Training people's eyes is essential. But a small business can also cut down on how many fakes reach inboxes in the first place.

• Protect your own domain. Without DMARC, a fraudster can send email from your exact address to your clients. Our DMARC, SPF and DKIM checker tells you where you stand in seconds.
• Train the team. A phishing simulation built on examples like these shows who clicks and, more importantly, who reports.
• Tune your email platform. External-sender banners, attachment filtering and MFA everywhere are all part of our Microsoft 365 and Google Workspace audit.
• Celebrate reports. When the owner of a property management firm in Pointe-Claire publicly thanks the employee who spotted a fake, the whole team gets the message: reporting is welcome, even when it's a false alarm.

The best reflex fits in one sentence: never answer an urgent request through the channel it arrived on.