A Suspicious Message From a Supplier or Customer: What to Check Before You Reply
The owner of a small shop gets an email that looks like it is from her regular supplier. It says the bank details have changed and the next payment should go to a new account, by the end of the day. The logo looks right, and so does the tone. Something feels slightly off, but there is a deadline.
That mix of a familiar sender and a ticking clock is how most phishing works. The Canadian Centre for Cyber Security lists the warning signs.
The warning signs
- A deadline that pushes you to act quickly.
- A request for personal or confidential information.
- A link that asks you to log in.
- An offer that seems too good to be true.
- An unsolicited message with attachments, links, web forms, QR codes or login pages, or one claiming to come from a government or bank official.
- A sender you do not recognize. The Cyber Centre adds that addresses can be spoofed, so a known sender is not automatically a safe one.
What to do instead of replying
- Stay calm. Phishing depends on pressure to act fast.
- Do not click links, scan QR codes or reply to suspicious texts.
- Do not send sensitive information by email or text.
- Check through another channel. Call the supplier on the number you already have, or use their official website or app, not the details in the message.
For a change of bank details, a call to a number you already know takes two minutes and settles it.
Where to report fraud in Canada
The Canadian Anti-Fraud Centre takes reports online at reportcyberandfraud.canada.ca, where you can choose to report anonymously, or by phone at 1-888-495-8501 (Monday to Friday, 10 a.m. to 4:45 p.m. Eastern, closed on holidays). If you were a victim, it recommends contacting your local police as soon as possible.
Where Edwin fits
Edwin, a digital assistant, prepares replies and drafts for you, and nothing is sent without your approval, so a message asking for money or details still reaches you before anything leaves. He always says he is an AI. He is not a fraud filter, so the checks above remain yours.