Phishing is still one of the most common ways criminals steal passwords, banking details, and business data. Messages may arrive by email, text, or social media and often impersonate a bank, courier, employer, or government agency. Recognizing the pattern early limits damage; knowing when to call investigators helps after money or data is gone.
What phishing looks like
Phishing is a social-engineering attack: the sender tries to make you act before you think. Urgent language, threats of account closure, or promises of refunds are common. Links may go to fake login pages that capture credentials. Attachments may install malware that logs keystrokes or spreads inside a company network.
Spear-phishing targets one person with details from social media or leaked lists. Smishing uses SMS; vishing uses phone calls. The delivery channel changes; the goal is the same: credentials, payment, or malware installation.
Three ways to recognize phishing
1. Check the sender and domain
Look at the full email address, not just the display name. Minor misspellings (for example, a bank name with an extra letter) are a classic sign. On mobile, expand the header before tapping anything.
2. Question urgency and payment requests
Legitimate firms rarely demand immediate wire transfers or gift-card payments by text. If payroll or vendor banking details change, confirm through a known phone number, not the number in the same email thread.
3. Inspect links before you click
Hover on desktop or long-press on mobile to preview the URL. If you are unsure, open a browser and type the company site yourself, or call the organization on a number from their official website.
How to protect yourself and your business
- Turn on multi-factor authentication for email, banking, and cloud storage.
- Train staff to report suspicious messages instead of forwarding them internally.
- Keep software updated and use business-grade email filtering where possible.
- Back up critical data so ransomware has less leverage.
- Segment financial approvals so one compromised inbox cannot authorize large wires alone.
If you think you were phished
- Disconnect compromised devices from the network if malware is suspected.
- Change passwords from a clean device, starting with email and banking.
- Notify your bank and document timelines and amounts if funds moved.
- Report to the Canadian Anti-Fraud Centre and preserve headers/screenshots for counsel.
- Tell IT or your managed provider so mailboxes and logs can be preserved.
Business email compromise (BEC)
BEC often follows a successful phish: attackers read mail for weeks, then insert fraudulent wire instructions that look routine. Finance teams should verify payment changes by callback to numbers on file, not numbers in the email. Investigators help after the fact by documenting mailbox access patterns and tracing open-source leads on where funds were sent.
When private investigators get involved
After a successful phish, employers and counsel often need to know how far access spread: which accounts were touched, whether an insider helped, or where funds were routed. Licensed investigators can compile lawful OSINT, support forensic data recovery on devices you own, and document findings for insurance or civil claims through our cyber investigations service.
We do not recover funds from scammers by magic, but documented timelines and identity clues help lawyers and police referrals. Read how to choose a private investigator in Ontario before you hire any agency.
Contact Investigations Plus for a confidential discussion if a phishing incident is now a business or legal file.
