December 5, 2025 Threats 5 min read

How to Recognize Phishing Emails: A Guide for Canadian Businesses

By Omer Segoly, CISM | Published December 5, 2025 · Updated October 9, 2026

To recognize a phishing email, check what it asks you to do and who really sent it. The Canadian Centre for Cyber Security (CCCS) lists the main warning signs as an urgent request with a deadline, a request for personal or confidential information, a link asking you to log in, an unsolicited attachment or QR code, and an offer that sounds too good to be true. Verify anything unusual through a separate channel before you act.

Phishing matters for Canadian businesses because scams are the most common way they get hit. Statistics Canada's 2023 Canadian Survey of Cyber Security and Cybercrime found that scams and fraud remained the most commonly used method behind cyber security incidents affecting Canadian businesses. The Canadian Anti-Fraud Centre's Top 10 frauds in 2025 lists 2,869 phishing reports in 2025, and spear phishing was the second-largest fraud category by reported dollar loss, at CA$67.9 million.

What is phishing?

Phishing is a form of social engineering in which criminals send messages that look legitimate to get people to act. The CCCS guide Don't take the bait (ITSAP.00.101) says phishing tries to trick people into:

• Clicking a malicious link that installs malware or leads to a fake login page
• Opening a dangerous attachment that compromises their device
• Revealing sensitive information like passwords, banking details, or personal data
• Transferring money based on a fraudulent request

Variants include spear phishing (personalized to one person or company), whaling (aimed at executives), quishing (QR codes), smishing (text messages) and vishing (phone calls).

What are the warning signs of a phishing email?

The clearest warning signs are pressure and unusual requests, not typos. The CCCS guide Spotting malicious email messages (ITSAP.00.100) lists clues such as an unfamiliar or misspelled sender address, generic greetings, an urgent tone, and unusual requests like paying an overdue invoice. It also warns that AI-written phishing may have no spelling or grammar mistakes.

Urgency and pressure

"Your account will be suspended in 24 hours." "Immediate action required." Phishing emails create artificial urgency to prevent you from thinking critically.

Unexpected requests

A vendor suddenly changing their payment details. Your CEO emailing from a new address asking for a wire transfer. An IT department asking you to verify your password via email. Legitimate organizations rarely make urgent, unexpected requests via email.

Suspicious sender details

The display name says "Canada Revenue Agency" but the actual email address is something like cra-notice@gmail.com. Always check the full sender address, not just the display name. Remember that addresses can be spoofed and a known sender is not necessarily a trusted one.

Generic greetings

"Dear Customer" or "Dear User" instead of your actual name. Legitimate organizations that have a relationship with you typically address you by name.

Look-alike links

Hover over any link before clicking. If the URL doesn't match the organization it claims to be from, or uses a misspelled domain like canada-gov.net instead of gc.ca, don't click. The CCCS also warns about look-alike tricks such as characters from other alphabets and fake subdomains like "login.google.com.example.com."

Unsolicited attachments and QR codes

An attachment or QR code you weren't expecting deserves the same caution as a link. Quishing can bypass email security tools that scan for malicious links and attachments.

What should you do if you receive a suspicious email?

Don't act on it until you have verified it another way. The CCCS advises contacting the sender by another means, such as a phone number you already have, and typing the organization's website address yourself instead of clicking:

1. Don't click any links, open any attachments, or scan any QR codes
2. Don't reply to the message
3. Report it to your IT team or manager, and don't forward it to coworkers
4. Verify the request through a separate channel: call the sender using a known phone number, not one provided in the email
5. Delete the message after reporting it

If someone already clicked, they should report it immediately, disconnect the device from the network and change their password from a different device, as ITSAP.00.100 recommends.

How can a business protect itself from phishing?

Combine training with technical controls, because no single layer catches everything. The CCCS recommends anti-phishing technology, email authentication aligned with DMARC, multi-factor authentication on all systems, clear internal procedures for verifying and reporting suspicious messages, and internal phishing simulations:

• Regular training: security awareness training should be ongoing, not a one-time event
• Phishing simulations: test employees with realistic (but safe) phishing emails to measure and improve awareness
• Email filtering: deploy email security tools that flag or block known phishing patterns
• DMARC, SPF, and DKIM: these email authentication protocols help prevent attackers from spoofing your domain
• Multi-factor authentication: even if a password is stolen through phishing, MFA makes it much harder to use; phishing-resistant methods such as passkeys go further

Phishing is also a common delivery mechanism for ransomware and a frequent starting point for business email compromise.

The CCCS Baseline Controls address phishing readiness across several areas, including Security Awareness (BC.6), Network Security (BC.9), and Authentication (BC.5). One question to ask your IT lead or provider: if an employee clicks a phishing link today, how would we find out, and how fast? Our cyber security assessment evaluates your defences across all of these areas.

Where do you report phishing in Canada?

Report it inside your organization first, then to the authorities if needed. ITSAP.00.100 says employees should report suspicious emails to their IT and security teams, and that phishing emails can also be reported to the Cyber Centre or the Canadian Anti-Fraud Centre. If money was sent, contact your bank immediately.

Frequently Asked Questions

Cite This Page

Suggested citation:

Cybersecurity Canada (2025). How to Recognize Phishing Emails: A Guide for Canadian Businesses. Retrieved from https://cybersecuritycanada.ca/news/posts/how-to-recognize-phishing-emails/

Permanent URL: https://cybersecuritycanada.ca/news/posts/how-to-recognize-phishing-emails/ · Last updated October 9, 2026