The threat landscape is changing quickly, and AI is making malicious emails, texts, phone calls, and videos easier to create and more convincing. One common theme? These attacks exploit urgency, fear, curiosity, trust, and the everyday distractions that can cause any of us to act before we verify.

Don’t Trust UNTIL You Verify

Just because something is convenient, doesn’t mean it’s secure. If there is one key takeaway from this post, it’s this: ANY time you receive an unexpected message or if you are asked for unprompted account information such as account number, password, or passcode, you should NOT provide it. Instead, you should reach out directly to the institution/bank/company that is requesting it by going directly to the company’s website (and NOT using the phone number or URL/link that was provided in the what-could-be-fraudulent message).

Many of those phone calls and emails may even come close to looking legitimate – for example maybe it will say Bancofamerica where just one letter is transposed (e.g. Banc vs Bank). On top of that, be skeptical of AI voice cloning and deepfake scams. The FTC has been warning about scammers cloning a family member's voice (often from a few seconds of social media audio) to fake an emergency call asking for money. If you get a panicked call or even what appears to be a video from a "relative," hang up and call them back on a known number before doing anything.

Also be cautious when an unexpected caller tries to get you to repeat a specific phrase, answer a series of unusual questions, or say words such as “yes.” The caller may be attempting to capture clean samples of your voice for impersonation or to replay a recorded response against a voice-based verification system. Do not follow the caller’s script. Hang up, contact the organization through a trusted number, and ask whether it offers a stronger authentication option that does not rely on voice alone.

Is it Really That Important?

Any message that claims to be urgent probably isn’t – instead the attacker is just trying to get you to react before you have time to think about it. Some examples:

Legitimate organizations may send important alerts by email or text, but they generally will not ask you to disclose a password, provide a one-time code, or make an unusual payment through an unsolicited message. If a message concerns your bank, a government agency, or another important account, do not rely on the contact information in the message. Open the organization’s official app, type its known website address yourself, or call a trusted number from a statement or the back of your card.

What Are Your Important Accounts and How to Better Protect Them?

The best way to determine which of your accounts may warrant good passwords (i.e. banking/finance, investment, healthcare) is to consider “what could go wrong” if a hacker was able to take over my account? Think of authentication and passwords being your keys to the kingdom for those accounts. The best way to protect these accounts is through multi-factor authentication (MFA) wherever possible, and favor stronger options such as an authenticator app, security key, or passkey when they are available. A one-time password (OTP) may be one part of MFA, but it should never be shared with someone who contacts you. The nice thing here is that many of the institutions that you may consider critical can make these options available to you, and you don’t have to be a tech geek to figure them out.

MFA requires two or more different types of proof: something you know, such as a password; something you have, such as a phone, authenticator app, or security key; or something you are, such as a fingerprint or facial scan. MFA is not foolproof. Attackers may trick people into sharing a one-time code, approving an unexpected sign-in prompt, or moving a conversation to a fake support channel. Never share an OTP or approve a login request you did not initiate. If someone claiming to represent a financial institution asks you to do either, end the conversation and contact the institution directly through a trusted number or website.

What if one of your important accounts/institutions doesn’t provide the option for MFA or OTP? Then it is vital that you adhere to strong password hygiene. What does that mean? Don’t reuse the same password across different accounts. Don’t put your passwords on a sticky note under your keyboard. Ideally use a password manager so that it can take on the task of making each password unique and just as importantly, complex.

The IP Guy in Me

Having been in the IT arena for over 300 years (IT years are like dog years), here are a couple of straightforward ounce-of-prevention recommendations:

Improve Your Vigilance

Many financial institutions (banks, credit cards, investments) allow for you to set up alerts (text or email) whenever there is activity in your account (and oftentimes, you can select thresholds) – we do this with all of our transactions. On top of that, there are many free or inexpensive credit monitoring/locking services that allow you to lock down any activities associated with your identity/accounts or that provide monitoring of any suspicious activities.

To check your credit report for free you can visit www.annualcreditreport.com or TransUnion Canada. While this won’t prevent fraud, it can help you react promptly to nefarious activity.

The common thread: These attacks exploit urgency, fear, curiosity, trust, and the everyday distractions that can cause any of us to act before we verify, which is why it’s important to slow down before you act on anything urgent, verify through a second channel, and let technology (password managers, MFA, auto-updates) do the remembering for you. As the airport announcement reminds us, “security is everyone’s responsibility.” A few deliberate habits can make scams easier to recognize and limit the damage when something does go wrong.