Spear-phishing isn't the "your package couldn't be delivered" text you get by the hundred. It's personalized, researched, and built to pass your gut check — which is exactly why it's draining more money than ordinary phishing.
What's Actually Happening
The Canadian Anti-Fraud Centre has already logged 33,854 online fraud reports so far in 2026. Spear-phishing — fraud that uses real, specific details about you or your employer to seem legitimate — accounts for a disproportionate share of the losses: $31 million CAD in the first quarter alone. For context, total fraud losses in Canada hit $643 million in 2024, nearly 300% higher than in 2020, and the Centre itself estimates only a small fraction of incidents ever get reported.
Recent polling backs up why it's working: 87% of Canadians say it's getting harder to tell whether an online ad is real, and 75% say the same about telling a fake shopping site from a real one.
Spear-Phishing vs. Regular Phishing
Regular phishing is a mass email or text — generic, sent to thousands of people, easy to spot once you know the pattern ("Your account has been suspended, click here").
Spear-phishing is targeted. It might reference your actual employer, a real coworker's name, a project you're genuinely working on, or a supplier you actually use — pulled from LinkedIn, a data breach, or a company website. That specificity is what gets it past the "this looks fake" instinct.
Red Flags — Even When It Looks Legitimate
- ⚠️ A request to change payment details, wire funds, or buy gift cards — especially if it claims urgency ("before end of day")
- ⚠️ An email that matches a real contact's name and writing style but comes from a slightly different domain (e.g. an extra letter, a different TLD)
- ⚠️ A message that references accurate personal or work details but asks you to act outside your normal process
- ⚠️ Pressure to bypass a second person for approval, or to keep the request confidential
If You Think You've Been Targeted
Haven't sent anything yet? Verify the request through a separate channel — call the person or company directly using a number you already had, not one from the message.
Already sent money or shared banking details? Contact your bank or card issuer immediately to flag the transaction, then report it — the earlier both happen, the better the odds of recovery.
Not sure if a specific message is real? Upload it to Asya's document check, or get the exact reporting steps.
Check It With Asya →Sources & Verification
Figures in this article are drawn from the Canadian Anti-Fraud Centre's 2026 reporting data and independent analysis, including:
Learn more about how ComplaintCA verifies information on our About page.