Email Security: Protect Your Account from Scams and Fraud

This is the first in a series on protecting the critical information, people and and possessions in your life from fraud and scams. More practical guidance will follow.

How secure is your email account against hackers? Many Canadians overestimate the safety of their email. You might not notice anything unusual for months, yet your address could already be exposed from a corporate data breach or circulating on the dark web alongside other personal details. Cyber-criminals often collect that information quietly and attempt access long before you become aware.

Why do scammers hack email accounts?

Email accounts contain a wealth of personal and financial data. Once a criminal gains access, they can quickly identify where you bank, which credit cards you use, where you live, and the kinds of messages you receive. Compromised email can also be used to intercept multi-factor authentication (MFA) codes and reset passwords for other services.

Everyone is potentially a target — you don’t need a large bank balance to attract scammers. Attackers cast a wide net, looking for any accounts they can exploit. “The jackpot is when they get someone with substantial assets, but anyone can be a target for scammers,” says Octavia Howell, vice-president and chief information security officer for Equifax Canada.

Criminals also exploit connections: if they access one inbox, they can study your contacts and message patterns to impersonate colleagues, friends or service providers. A common scam in Canada involves cloned co-worker email addresses requesting banking details for expense reimbursements or payroll. What looks like a routine email can become an effective fraud vector when it’s engineered from genuine context and conversations.

Modern computing allows attackers to target millions of accounts simultaneously, cross-reference data and test many password combinations. As Howell notes, “They only have to be correct once.”

How to spot phishing and reduce risk — tips from Octavia Howell

Good email hygiene significantly lowers your fraud risk. Howell recommends practical steps you can adopt right away:

• Change passwords regularly, at least every few months. If you learn that an organization you use has been breached, update your email password immediately.
• Avoid clicking suspicious emails. Use your email provider’s report and delete tools. Verify the sender’s address carefully — attackers can create addresses that look almost identical to legitimate ones, so watch for small differences like extra letters, dots or hyphens.
• Install a website blocker on phones and computers so malicious links you might accidentally click are prevented from loading.
• Check your digital footprint periodically. Search for your name and email online to see what information is publicly available, and remove or change exposed details where possible.
• Consider a trusted fraud protection service to monitor your accounts and alert you to unusual behaviour early.
• Don’t publish your email or personal details on social media. Publicly visible information — even the name of a pet or a hometown — can be used to craft tailored phishing messages or to guess passwords.
• Where possible, avoid using your email address as a username on other sites; choose a unique username instead.

Scammers are using AI

Artificial intelligence is a powerful tool for productivity, and fraudsters are adopting it too. AI makes it easier for attackers to gather publicly available details and synthesize convincing, targeted scams. Whereas older attacks focused on cracking numeric codes, modern scams increasingly use real personal information to create believable social engineering attempts. That makes vigilance and strong account controls even more important.

How to report identity theft in Canada

If you suspect identity theft, report it to local police and to the Canadian Anti-Fraud Centre. You should also notify the major credit bureaus to file a fraud alert on your credit file, which can flag unusual credit or loan applications. Regularly review your credit reports and scores for unexpected changes and act quickly if you spot anything unusual.

Identify fraud early with Equifax Complete Protection

One option for boosting email and identity security is a monitoring and protection service such as Equifax Complete Protection. This subscription offers tools to monitor your credit and personal data, scan for exposed information, and provide identity restoration help if a theft occurs. Policies may vary by province.

Features include:

• Daily credit monitoring and alerts for changes to your Equifax credit report
• Dark web monitoring to detect if your personal information appears where criminals trade data
• Social media monitoring to highlight suspicious activity on your accounts
• Online data encryption, password generation and secure storage
• Parental controls to manage children’s access to apps and websites
• Device protection to help block phishing attempts, viruses and malware

Equifax Complete Protection is listed at $34.95 per month. For many people, that cost is modest compared with the potential financial and personal disruption caused by identity theft.

Read more about fraud prevention:

• Your ID was stolen — what to expect
• Watch: five key questions on identity theft
• How to help protect seniors and loved ones from scams
• How to protect your devices from identity theft
• Common crypto scams and how to avoid them