Scam emails are messages designed to trick you into sending money, sharing personal information or opening a harmful attachment. They may pretend to come from a bank, government department, delivery company, employer or someone you know. Don’t rely on the sender’s name or the message’s appearance to decide whether it is genuine. Check requests through a separate, trusted route before you act.
How scam emails work
Email is a convenient way for a fraudster to reach many people, but a message may also be written for a particular recipient. The sender may use a familiar organization’s name, copy its style or make the message look like part of an existing conversation. The name displayed in your inbox can be misleading, and email addresses can be made to look similar to legitimate ones.
Most scam emails try to prompt a quick response. A message might claim there is a problem with an account, a payment waiting for you, an urgent invoice or a delivery that needs attention. It may ask you to follow a link, reply with details, open an attachment or pay a fee. The aim may be to collect passwords, banking details or identity information, or to get you to send money.
Some emails lead to a fake sign-in page that imitates a real service. If you enter your password there, the sender may be able to use it to try to access your account. An attachment may also be unsafe. Don’t open unexpected files or enable features they request unless you have independently checked that the message and file are legitimate.
A scam email can arrive even if you have never contacted the organization it claims to represent. It can also reach you as part of a genuine-looking conversation after an email account has been compromised. A familiar name, logo or earlier message is not proof that the request is safe.
Common email scam variations
Email scams can take different forms, and the same basic warning signs apply across them:
- Account or payment notices: A message claims that a bank, payment service or other account has a problem and asks you to sign in or confirm details. A request involving an e-transfer or another payment may also be used to draw you into a fake process.
- Delivery messages: An email says a parcel is delayed, cannot be delivered or needs a fee. It may direct you to a page asking for personal or payment information. Check any delivery directly with the company using contact details you find independently.
- Government impersonation: An email may claim that you owe money, qualify for a payment or need to provide information to a government department. The use of a government name does not establish that the department sent it. Contact the department through its official website or another trusted source.
- Invoices and workplace requests: A message may appear to come from a supplier, manager or co-worker and ask for an urgent payment, gift cards or a change to payment details. Verify unusual financial requests directly with the person or business, using contact information you already trust.
- Jobs, prizes and refunds: An email may offer an unexpected opportunity or benefit but ask for a fee, personal details or banking information first. Be cautious when money or sensitive information is requested before you can verify the offer.
- Threats or emotional pressure: Some messages try to frighten you, claim that a loved one needs help or demand money to avoid a supposed consequence. Pause and confirm the situation independently rather than replying under pressure.
These examples describe common approaches, not proof that a named organization is involved. Fraudsters may impersonate real businesses and public agencies without their knowledge or permission.
Warning signs in scam emails
One sign alone may not prove a message is fraudulent, and a polished email can still be deceptive. Treat a message cautiously if it has one or more of these features:
- It pressures you to act immediately or threatens a serious consequence if you do not.
- It asks for a password, banking information, a verification code or other sensitive information by email or through a link.
- It asks you to pay unexpectedly, especially by an unusual method, or to keep the request secret.
- It includes a link or attachment you were not expecting, or urges you to open it to resolve a problem.
- The sender’s address, reply address or link destination does not match what you would expect from the organization.
- The message contains an unexpected change to payment instructions or account details.
- It claims you are owed money, selected for a prize or eligible for a benefit you did not apply for.
- It uses an unusual greeting or details that do not fit the conversation. However, correct spelling, personal details and a familiar tone do not prove a message is genuine.
How to protect yourself
Take a moment before responding to any unexpected message involving money, sign-in details, personal information or an attachment. A little verification can prevent a costly mistake.
- Check through a separate route. Don’t use the message’s link or phone number to investigate its claim. Open the organization’s official app or type its known website address yourself, or use contact details from a statement or trusted record.
- Inspect links without opening them. On a computer, you may be able to point to a link to see where it leads. On a phone, press-and-hold may show a preview, but do not open it. If the destination looks unfamiliar or different from the organization’s usual address, leave it alone.
- Confirm payment requests. If a message asks you to pay, change banking details or send money, verify it directly with the person or organization using a contact method you already know. For workplace requests, follow your employer’s established approval process.
- Keep passwords and codes private. Don’t share passwords or one-time security codes in response to an email. Use unique passwords for important accounts and turn on multi-factor authentication where available.
- Use care with attachments. Don’t open unexpected files or enable macros or other active content just because an email says it is necessary. If you are unsure, confirm with the supposed sender through another channel.
- Keep devices and software updated. Updates can fix security weaknesses. Use reputable security software if available, and be cautious about claims in an email that you must install a tool to fix an urgent problem.
- Report and delete suspicious messages. Use your email provider’s built-in phishing or junk-reporting option when available. Don’t forward a suspicious message to other people as a warning without checking that you will not spread unsafe links or attachments.
What to do if you were targeted
If you clicked a link, opened a file, replied or shared information, act promptly. The right steps depend on what happened, but these actions can help limit further harm:
- Stop interacting with the message. Don’t reply, open more links or send additional money or information. Save the email and any related messages if you may need them for a report.
- If you entered a password, change it. Go to the real service using its official app or website, not the email link. Change the password for that account and any other account where you reused it. Turn on multi-factor authentication if it is offered, and review account activity and recovery details.
- If you shared a security code or banking information, contact the relevant institution. Use the number on your bank card, statement or official website. Explain what you disclosed and follow the bank’s instructions. If money was sent or banking details were exposed, contact your bank as soon as possible.
- If you sent money, ask the payment provider for help right away. Contact your bank or the service used to send the money. Do not pay anyone who promises to recover your money for an advance fee; that may be another scam.
- If you opened an attachment or installed something, take precautions. Disconnect the device from the internet if you suspect it may be compromised, and use trusted security help to check it. If the device belongs to your workplace, tell your employer’s IT or security contact promptly.
- Watch for follow-up attempts. A person who has your contact or personal information may try another approach. Be cautious of messages offering help, refunds or recovery in exchange for money or more information.
- Keep records and report the incident. Note what happened, when it happened and what information or money may have been exposed. Report it to the appropriate organizations and authorities, even if you are unsure whether a loss occurred.
How to report scam emails in Canada
Report suspected fraud to the Canadian Anti-Fraud Centre (CAFC) online at antifraudcentre-centreantifraude.ca or by phone at 1-888-495-8501. Share what happened and provide the details you have, such as the message, sender information and any payment records. Reporting can help authorities identify fraud patterns, but it does not guarantee that money will be recovered.
If you lost money, your identity may have been misused, or you feel threatened, contact your local police. If the email involved money, a payment card or banking details, contact your bank or financial institution promptly using a trusted number or website. You can also report the message to your email provider using its built-in reporting tools.
If the email pretended to come from a particular business or government department, you can notify that organization through contact information you find independently. Do not use details supplied in the suspicious email. The organization may be able to confirm whether the message is legitimate and advise you about protecting your account.
Frequently asked questions
Can an email be a scam even if it uses my name?
Yes. A message may include personal details and still be fraudulent. Don’t treat a correct name, familiar logo or convincing tone as proof. Verify unexpected requests through a separate, trusted route.
Should I reply to ask whether the email is real?
No. A reply can confirm that your address is active or invite more pressure. Contact the supposed sender using details you already trust, not the reply address in the message.
What if I only clicked the link but entered nothing?
Close the page and don’t enter information or download anything. If you downloaded a file, installed software or noticed unusual activity, seek trusted technical help. If you entered a password or other details, change the password and contact the affected institution.
Can I get my money back after an email scam?
There is no guarantee, but contact your bank or payment provider immediately if you sent money. Be wary of anyone who asks for an upfront fee to recover funds, and report the incident to the CAFC and local police.