In 2023, Canadians reported losing hundreds of millions of dollars to fraud — and online scams accounted for a significant portion of that total. Older adults are disproportionately targeted, not because they are naive or easily fooled, but because they are often perceived as having more savings, more trust in institutions, and less familiarity with the tactics being used.
Understanding this clearly is the first step. You are not being targeted because of any personal failing. You are being targeted because you are statistically seen as a valuable mark by people whose entire business is deception. That fact, once understood, shifts the emotional weight of the conversation: from shame and embarrassment to awareness and preparation.
This article is about that preparation. We'll walk through the most common online scam types, explain why they work, and give you practical tools for recognizing and avoiding them. Our goal is not to frighten you away from the internet — the vast majority of digital interactions are entirely safe — but to help you approach it with appropriate, grounded caution.
Why Scams Work: The Psychology Behind Them
Online scams are effective not because they are technically sophisticated, but because they are psychologically sophisticated. Scammers study human behaviour and design their approaches to trigger responses that override careful thinking.
The most commonly exploited emotions are:
Fear. A message that tells you your bank account has been compromised, your computer has been infected, or your tax return has triggered a legal issue creates immediate alarm. Fear narrows our thinking and makes us more likely to act quickly and less likely to stop and question.
Urgency. Nearly every scam includes a time pressure: "You must act within 24 hours," "Limited to the first 10 respondents," "This offer expires today." Urgency is designed to prevent you from taking the time to verify. When something online makes you feel you must act right now, that pressure itself is a warning sign.
Authority. Scammers frequently impersonate legitimate institutions — Canada Revenue Agency, Service Canada, major banks, well-known technology companies, courier services, or even a relative or friend. We're conditioned to comply with authority, and scammers exploit that conditioning deliberately.
Opportunity. Scams that promise prizes, unexpected windfalls, or unusually good deals exploit our natural interest in positive outcomes. The classic "you've won something" or "exclusive opportunity" scam has persisted for decades because it still works.
Common Online Scam Types
Phishing Emails and Messages
Phishing is the practice of sending messages that appear to come from a trusted source — your bank, a government agency, or a company you do business with — and asking you to click a link or provide personal information.
A typical phishing email might say something like: "We've noticed unusual activity on your account. Please click here to verify your information immediately." The link takes you to a website that looks exactly like your bank's site, but is actually a fake designed to capture whatever you enter.
Key warning signs of phishing messages:
- Urgency or threat language ("your account will be suspended")
- Generic greetings ("Dear Customer") rather than your name
- A link that, when you hover over it, shows a different address than expected
- Requests for passwords, full credit card numbers, or your Social Insurance Number
- Spelling errors or slightly off-brand visual design
- An email address that looks almost right but isn't quite — "[email protected]" instead of "@rbc.com"
Legitimate institutions — including the Canada Revenue Agency, your bank, and government services — will never ask for your passwords, full SIN, or full credit card numbers by email. If you're unsure whether a message is legitimate, go directly to the institution's official website by typing its address in your browser, and call them on their published phone number.
Grandparent Scams
This scam involves a phone call or message from someone pretending to be a grandchild — or a police officer, lawyer, or doctor representing a grandchild — in a distressing situation. "Grandma, I've been in an accident / arrested / robbed. I need money urgently. Please don't tell Mum and Dad."
The emotional power of this scam is significant. The sense of urgency, the distress of the supposed grandchild, and the explicit instruction not to involve other family members — all of these are designed to bypass careful thinking and trigger an immediate response.
The best defence is a simple one: before acting, call the grandchild directly using a number you already have stored in your phone. Do not use any number provided by the person who contacted you. If it was a genuine emergency, you'll reach them. If it was a scam, you'll have avoided it.
Tech Support Scams
These scams begin in several ways: a pop-up message claiming your computer has a virus, a phone call from someone claiming to be from Microsoft or Apple, or an email warning about a "detected threat." The goal is to convince you to give the scammer remote access to your computer, or to pay for unnecessary "support services."
Microsoft and Apple will never call you unsolicited to tell you your computer has a problem. Legitimate security warnings from your own software do not include a phone number to call. If you receive one of these calls or messages, ending the interaction is the right response.
If you're ever uncertain whether your computer genuinely has an issue, take it to a local, reputable repair shop or ask a trusted family member rather than responding to any unsolicited contact.
Romance Scams
Romance scams involve a person creating a fake profile on a dating site or social media platform and building a relationship with the target over weeks or months. The scammer builds trust, sometimes declaring strong affection, before eventually asking for money — often for a fabricated emergency, business opportunity, or to cover travel costs to come and visit.
These scams are particularly difficult emotionally because a genuine-feeling connection has been built. The Canadian Anti-Fraud Centre reports that older adults are among those most frequently affected. Losses can be substantial.
Be cautious about any online relationship in which the other person has never agreed to a live video call, always has a reason they can't meet, and eventually asks for money or financial assistance of any kind.
CRA (Canada Revenue Agency) Impersonation Scams
Scammers frequently impersonate the Canada Revenue Agency, threatening arrest, deportation, or legal action for unpaid taxes unless immediate payment is made — usually by gift card, cryptocurrency, or wire transfer. These calls can sound official and can be frightening.
The real CRA will never demand immediate payment by gift card or cryptocurrency. They will never threaten arrest on the phone. If you receive a call like this, hang up. If you're concerned about your tax situation, contact the CRA directly at their published number or speak with an accountant.
Practical Protective Habits
Beyond knowing the specific scam types, there are several habits that will significantly reduce your vulnerability online.
Pause before you click. Any link in an email, text message, or social media post should be approached with a moment of consideration before clicking. Ask yourself: was I expecting this message? Does the sender look right? Does the urgency feel normal?
Use strong, unique passwords. A strong password is at least 12 characters long and includes a mix of letters, numbers, and symbols. Using the same password across multiple accounts means that if one account is compromised, others are too. A password manager — a secure app designed to store passwords — can help you manage this without having to remember everything.
Enable two-factor authentication. Many services now offer two-factor authentication — a system where logging in requires both your password and a second verification (usually a code sent to your phone). This significantly increases security even if someone has your password.
Verify before you act. If any call, email, or message asks you to take an action — especially involving money, personal information, or account access — verify through a separate, trusted channel before proceeding. Call the organization back on a number from their official website.
Talk to someone you trust. If you're unsure about something, tell a trusted friend or family member. Scammers often tell victims to keep things secret — and that instruction itself is a warning sign. A genuine institution will never ask you to keep their request confidential.
What to Do If You've Been Scammed
If you believe you have been the victim of an online scam, the first thing to know is this: you are not alone, and you are not foolish. These scams are sophisticated, and they catch people at every level of experience and education. The important thing now is to act promptly.
Contact your bank immediately if any financial information was involved. They have fraud departments equipped to help, and acting quickly can sometimes limit the damage.
Report the scam to the Canadian Anti-Fraud Centre (CAFC) at 1-888-495-8501 or through their website at antifraudcentre.ca. Reporting helps the organization identify patterns and protect others.
Change your passwords for any accounts that may have been compromised. If you have a trusted family member or friend who can help you do this, ask for their support.
Do not engage further with the scammer. Block their number and email, and do not send any additional money, even if they promise to return what was already taken. They will not.
This article is published for general educational purposes by Tivronex. It does not constitute legal or financial advice. If you believe you have been the victim of fraud, please contact your financial institution and the Canadian Anti-Fraud Centre. Tivronex is an independent educational organization based in Vernon, British Columbia, Canada.