AI scams in Canada: a verification checklist for Cyber Month

Canada’s Cyber Security Awareness Month began October 1, 2026 under the theme “Your best defence is you.” The Communications Security Establishment’s campaign highlights more convincing AI-assisted scams and encourages verification, unique passwords and multi-factor authentication. The campaign is an awareness initiative, not a new measurement of fraud losses.

AI impersonation is a documented Canadian concern

A June 23, 2025 joint advisory from the Canadian Cyber Centre and Canadian Anti-Fraud Centre described text and AI-generated voice messages impersonating senior officials and prominent public figures. It warned about urgent financial requests and malicious links. That advisory supplies a concrete example behind the current campaign, but its date matters: it is not evidence of a newly discovered October 2026 incident.

The advisory recommends contacting people or organizations through previously confirmed channels. Display names and caller numbers can be forged. This makes the process used to verify a request more dependable than whether the message sounds professional.

Build a pause into requests involving money or access

If a message asks you to transfer money, disclose a code or install software, stop the interaction long enough to verify it. Use a number you already have, a bookmarked official website or a contact route you locate independently. A reply inside the same suspicious conversation does not provide an independent check.

For a supposed family emergency, call the family member through an existing contact and ask another trusted person to help confirm the situation. For an invoice change at work, use the established supplier verification process. Our practical rule is to verify both identity and the requested action: a real contact can still have a compromised account.

Protect accounts before a convincing message arrives

The Cyber Month campaign encourages strong, unique passwords and MFA. A password manager can help avoid reuse across services. Check which recovery channels your accounts depend on, and keep those protected too. MFA strengthens account access, but it does not make an instruction to send money legitimate.

Organizations should define who can approve a payment or a change to bank details, and give staff an easy way to pause without being penalized. A short rehearsal using an invented request can reveal whether the verification process is usable under pressure. It should test the process, rather than blame someone for missing a subtle visual clue.

Related sources: CSE: start of Cyber Month 2026 ↗

If you already interacted with a suspicious request

The joint advisory directs suspected targets to local law enforcement, the Canadian Anti-Fraud Centre and the Canadian Cyber Centre. Preserve the message and the relevant transaction details for a report. If an account or payment is involved, contact the provider through its official support route promptly.

No visual or audio clue reliably settles every case. The useful habit is to keep a trusted path outside the suspicious interaction and use it before sharing information or authorizing an action.

Sources and editorial method

We use the linked original statements and reports to distinguish documented facts from our analysis. Company announcements describe their authors’ plans and claims; they are not independent verification of future outcomes. This article is dated and will be revised if material evidence changes. Read our editorial standards and corrections process.

CSE: start of Cyber Month 2026 ↗ — October 1 campaign statement; guidance and campaign purpose.
Cyber Centre and CAFC: impersonation advisory ↗ — June 23, 2025 documented campaign, verification advice and reporting routes.