Section 3
Spot Red Flags
One of your strongest defences against fraud is learning to recognise the warning signs — the patterns and pressure tactics that almost every scam relies on. Spotting a red flag doesn't mean panic. It means pause.
This section gives you a clear list of warning signs to watch for, explains an important nuance about real vs. fake urgency, and then gives you a chance to test what you've learned through real-world scenarios.
The Pause List
If any of the following happen in a communication — no matter what channel it arrives through — stop and take a breath before doing anything.
- 1
Urgency
"Act now or face consequences." Real organizations give you time to think and verify. Urgency is the scammer's most powerful tool — it's designed to override your judgment.
- 2
Secrecy
"Don't tell your family." Legitimate businesses and government agencies do not need secrecy to conduct normal business. If someone asks you to keep something from your loved ones, that is a serious warning sign.
- 3
Unusual Payment Methods
Gift cards, cryptocurrency, wire transfers, or cash. These are nearly impossible to trace or reverse. No legitimate organization will ever ask for payment this way.
- 4
Requests for Personal Information
Your SIN, date of birth, passwords, PINs, or account numbers should never be given to someone who contacts you. Share this only when you initiate contact with a trusted institution.
- 5
Threats
Threats of arrest, deportation, fines, or loss of benefits are used to create panic. Real government agencies resolve issues through formal processes — not a single, unexpected phone call.
- 6
Emotional Pressure
If a communication leaves you feeling frightened, excited, guilty, or panicked — slow down. Those emotions are often deliberately triggered. Your best decisions come from a calm mind.
- 7
Requests for Remote Access to Your Computer
If anyone asks to connect to your computer remotely to "check a problem" — say no. This gives them full access to your files, saved passwords, and financial accounts.
- 8
One-Time Passcode Requests
If you receive an automatic text with a verification code and someone on the phone asks you to read it back — stop immediately. This is how scammers bypass your account security. Legitimate organizations never ask you to share a code sent to you.
If something seems urgent, look up the contact information yourself from a source you already trust — the back of your card, the official government website, the phone book. Call or log in directly. Do not use the number, link, or name provided in the message itself.
Not every scary message is a scam
Here is an important balance to strike: not every urgent message is fraudulent. Real banks do send fraud alerts. Real government agencies send important notices. Real packages get delayed. Real emergencies do happen. The goal isn't to be suspicious of everything — it's to give yourself permission to slow down and verify before acting.
The key difference between a legitimate message and a scam is usually this:
- A legitimate message will direct you to channels you can independently verify — a website you know, a number on the back of your card, a portal you already have access to.
- A scam will pressure you to act through the channels the sender provides — a phone number they give you, a link they include, a person they connect you to.
The most useful question to ask is not "Does this feel uncomfortable?" — some real situations do. The better question is: "Can I independently confirm this is real?"
Scam or Legit? Test your skills
Each scenario below is based on a real type of fraud that targets Canadian seniors. Read it, decide Scam or Legit, then see the answer and the key signs to watch for.
The CRA Phone Call
You're home on a Tuesday afternoon when the phone rings. Caller ID shows "Canada Revenue Agency — Ottawa."
Scam or Legit?
- The CRA never threatens arrest in a single phone call, and certainly not without prior written notices.
- Gift cards are never an acceptable payment method for any government agency — one of the clearest scam signals there is.
- The instruction not to discuss this with anyone is deliberate isolation — a hallmark of the scam formula.
- The CRA will never demand immediate same-day payment over the phone.
- Even if caller ID shows "CRA," that number can be faked through spoofing.
The real CRA sends written notices before any enforcement action and will never ask for gift cards. If you receive a call like this, hang up. If unsure, call the CRA directly at 1-800-959-8281 — using the number you look up yourself.
The Bank Fraud Alert
You're out running errands when this text arrives.
Scam or Legit?
- There is no link in the message — a positive sign, as scams almost always include a link to click.
- It includes specific, verifiable details: bank name, card type, last four digits, and the exact transaction.
- The requested action is a simple YES or NO — no personal information, no password, no call-back number.
- "Do not click any links" is consistent with what legitimate fraud teams advise.
It is always reasonable to be cautious. If you're uncertain, don't reply — instead, call the number on the back of your card and ask directly whether there's a flag on your account. That way you verify through a channel you control.
The Grandchild in Trouble
It's 9:00 in the evening when your phone rings. A young man's voice, shaky and upset, says:
Scam or Legit?
- The instruction not to tell the parents is the biggest red flag — real emergencies don't require secrecy from family.
- The request for cash, picked up at your home, is not how legitimate bail processes work.
- The late-hour call is designed to create panic and prevent careful thinking.
- Scammers sometimes use AI voice-cloning to make the voice sound like your real grandchild.
- You likely never confirmed who was calling before the emotional story began — always ask for a name and verify it.
Before doing anything, hang up and call your grandchild directly on a number you already have. If they answer, there is no emergency. If you can't reach them, call their parents. Real legal emergencies can always survive the five minutes it takes to make those calls.
The Contractor at the Door
A man in a work vest knocks on your door. He warns that with rain coming, the damage could get worse quickly.
Scam or Legit?
- "Just happened to be in the neighbourhood" and "deal available today only" are classic high-pressure tactics that prevent research.
- Reputable contractors are typically booked — they don't go door-to-door looking for same-day work.
- A cash-only payment request is a significant red flag.
- The weather urgency ("rain is coming") is a deliberate emotional trigger.
- No written estimate, no business card or licence number, no time to compare quotes.
You are never obligated to decide on the spot. Ask for a business card and a written estimate, and say you'll be in touch. A legitimate contractor provides both without hesitation. If they become pushy when you say you need time, that tells you everything you need to know.
The Investment Friend
Three weeks ago, Gerald sent you a friend request on Facebook. You've chatted regularly since. He's warm, thoughtful and easy to talk to. Today he writes:
Scam or Legit?
- A relationship built entirely online that quickly turns to a financial opportunity is the pattern of a romance or friendship scam.
- The direct link to an unfamiliar platform is a significant red flag.
- "Don't mention it to too many people" is a secrecy request — designed to prevent reality-checking.
- Unusually high returns through a lesser-known platform fits the pig-butchering scam pattern.
- The warm relationship built over weeks is intentional grooming — making the financial request feel natural.
Scammers invest weeks or months building genuine-feeling relationships before introducing money. Before sending anything to a platform you discovered through a personal online connection, speak with a trusted person and verify the platform with your provincial securities regulator.
The Appointment Reminder
The morning before your doctor's appointment, this text arrives.
Scam or Legit?
- No links — the message isn't trying to send you anywhere or collect anything.
- No personal information is requested.
- The office number is provided for your use, but there's no pressure to call right now.
- The content is simple and verifiable — you can confirm with your doctor's office directly.
- "No reply needed" means the message expects nothing in return.
Appointment reminders from healthcare providers are common and generally safe. If you're ever uncertain, call the office using a number you already have (from a previous appointment card) to confirm.
The Virus Warning Pop-Up
You're browsing the internet when your screen fills with a red warning, a loud alarm sounds, and the Microsoft logo appears:
Scam or Legit?
- Microsoft (and Apple) never contact users through browser pop-ups or unsolicited calls.
- "Do not close the window or restart" is designed to prevent the simple fix that would end the scam.
- The alarm sound and urgent design are deliberate emotional triggers meant to create panic.
- Calling the number connects you to scammers, who will ask for remote access or payment for a fake "fix."
- No real virus or security threat requires you to call a phone number on a pop-up.
If you see a pop-up like this, close your browser. If it won't close, restart your computer. Do not call the number. Your device is almost certainly fine — the pop-up itself is the scam. If unsure, ask a trusted family member or a reputable local computer shop.
The Prize Letter
A large envelope arrives, printed in bold red letters: "FINAL NOTICE — PRIZE CLAIM REQUIRED." Inside is this letter and a cheque:
Scam or Legit?
- You cannot win a prize from a contest you never entered.
- No legitimate prize requires a fee to be paid in order to receive your winnings — ever.
- The enclosed cheque is almost certainly fake. It may clear initially but will bounce days later — after you've sent the $250.
- The five-day deadline is urgency designed to prevent careful thinking or asking for advice.
- "Final Notice" language creates a false sense of loss if you don't act.
The cheque-and-fee pattern is one of the oldest mail scams in existence. The cheque feels real because your bank may accept it at first — but once it's found fraudulent, the bank reverses the deposit and you're responsible for any money you sent. Never send money to claim a prize.
What did you notice?
Looking back at those eight scenarios, a few patterns probably stood out.
Scam scenarios all had at least one of the following: urgency that prevented careful thinking, a request for an unusual form of payment, instructions to keep something secret, or a direct link or phone number provided within the message itself.
Legitimate scenarios shared something different: they directed you to channels you could verify independently, they did not ask you for anything sensitive, and they gave you time to act without threatening serious consequences for waiting.
When something feels off — even if you can't quite explain why — pause. Say, "I need some time to think about this," or "I'll call you back." A legitimate sender will always be fine with that. A scammer will push back, and that pushback is your answer.