Phishing is social engineering that tricks people into revealing passwords, approving fake payments, or installing malware — usually through urgent email, SMS, or voice calls pretending to be banks, CRA, Microsoft, or executives. Business email compromise costs Canadian organizations millions annually. Defenses combine user training, simulated phishing tests, email authentication (SPF, DKIM, DMARC), attachment sandboxing, and MFA so stolen passwords alone are useless. Report suspicious messages to your MSP or IT team; never click "verify account" links from unsolicited mail. Verify wire transfers and gift-card requests through a second channel.
