Phishing

Phishing is a type of fraud in which attackers send messages pretending to be a trusted person or organization to trick people into clicking links, opening attachments or revealing information.

Phishing emails often imitate banks, Canada Post, the Canada Revenue Agency, Microsoft or a supplier you work with. They create urgency with messages about unpaid invoices, locked accounts or missed deliveries. Links usually lead to fake sign-in pages that capture passwords, while attachments may install malware.

Phishing is one of the most common starting points for attacks on small and mid-sized organizations. A single stolen Microsoft 365 password can lead to fraudulent payment requests sent to your clients, access to confidential files or a ransomware infection. It works because it targets people rather than technology.

Practical tip: combine good email filtering, multi-factor authentication and regular staff training with simulated phishing tests. Most importantly, make it easy and blame-free for employees to report suspicious messages quickly. A fast report lets IT block the message for everyone else and respond before damage spreads.