AI-Personalised Service Canada Phishing Scam
Criminals craft Service Canada phishing emails using AI to include the recipient's correct SIN fragment, employment details, and current benefit amounts, making the message appear to come from a genuine government source rather than a mass-phishing campaign.
Part of: AI Hyper-Personalised Phishing Scams
Last reviewed: 8 June 2026
Service Canada delivers federal employment insurance, Old Age Security, Canada Pension Plan, and Social Insurance Number services to millions of Canadians. Because the agency manages financial benefits and identity documents, its brand is highly valuable to phishing attackers.
AI tools now allow criminals to merge data harvested from employment websites, breach databases, and social media into personalised messages that reference the recipient's name, employer, province, and approximate benefit entitlement. The result looks nothing like a generic phishing email and convinces a careful reader that it comes from a real Service Canada case officer.
Service Canada communicates through My Service Canada Account at canada.ca. It does not send personalised links by email or SMS asking you to re-enter banking details, and it will not threaten benefit suspension via an unsolicited message.
How this scam works on the Service Canada brand
An email arrives from a spoofed address such as [email protected][random].com. It opens with the recipient's full name, references their most recent Employment Insurance benefit period, and states that a direct-deposit banking update is required to continue receiving payments.
A link labelled Update Banking Information leads to a lookalike My Service Canada Account login page. After credentials are entered, a form asks for bank transit number, institution number, and account number — all that is needed to redirect benefit deposits.
Some campaigns include a secondary pressure layer: a deepfake-voice follow-up call from an automated agent confirming the email was sent and urging the recipient to complete the update urgently or risk a payment hold.
Common red flags
- Email references your correct name, employer, or benefit amount — this data comes from breaches, not from genuine Service Canada records
- Message asks you to update banking details via a link rather than through My Service Canada Account at canada.ca
- Sender domain is not exactly servicecanada.gc.ca or canada.ca
- Urgency framing such as update required within 48 hours to avoid payment suspension
- Link leads to a URL that contains servicecanada but is not under canada.ca
- Email asks for SIN, full bank account details, or date of birth via the link
- Follow-up call from an automated voice citing the email as official government correspondence
How to protect yourself
- Access My Service Canada Account only by typing canada.ca/en/employment-social-development/services/my-account.html directly in your browser
- Service Canada sends banking-update reminders through your secure My Account inbox, not by external email link
- Enable the MSCA notification feature so you receive alerts when your account is accessed
- If you received a suspicious email, change your My Service Canada Account password and review your banking information
- Call Service Canada at 1-800-206-7218 to verify any claimed account action before responding
- Enable multi-factor authentication on your MSCA if available
- Report the phishing message before deleting it
How to report it
- Forward suspicious emails to [email protected]
- Report to the Canadian Anti-Fraud Centre at antifraudcentre.ca or 1-888-495-8501
- Report to the RCMP if SIN fraud is suspected
- Forward smishing texts to 7726
- File a report with the Competition Bureau at competitionbureau.gc.ca if financial loss occurred
Frequently asked questions
How does Service Canada communicate banking-update requests?
Banking update requests appear as notifications within your secure My Service Canada Account inbox at canada.ca. Service Canada does not send external emails or SMS messages with direct links to update your bank details.
The email knew my Employment Insurance benefit period. Is that suspicious?
Yes. Approximate benefit periods can be inferred from employment data available on LinkedIn or company websites, and may also come from data breaches. Knowing this detail does not make a message legitimate. Always verify through My Service Canada Account directly.
What is My Service Canada Account and how do I access it safely?
MSCA is the secure portal at canada.ca where you manage EI, CPP, OAS, and other federal benefits. Access it by typing canada.ca in your browser and navigating to the MSCA link on the official site. Never use a link from an email or SMS.