- Impersonation
- Phishing and smishing
- Fake websites and online shopping fraud
- Fake mobile apps
- Phone fraud (vishing)
Impersonation Scams
Beware of impersonation scams that target both your personal information and your money. Fraudsters will pretend to be a representative of a legitimate organization to try to solicit your Banking information or your money through various channels such as email, text message or phone calls. Below are a few examples of common impersonation scams.
1. Bank Inspector/Investigator Scamis a type of scam that uses vishing methods (See vishing tab) in which fraudsters pretend to be a bank official or law enforcement officer calling to review a fraudulent claim. They will attempt to trick customers into providing their own money to “aid” in a criminal investigation.
2. Bank Impersonation Scams are when fraudsters pose as legitimate organizations like your bank, claiming your account is in jeopardy or has been impacted by fraud and ask for the One-time password (OTP) that was sent to you just moments ago, to gain access your accounts or approve unauthorized transactions.
A One-time password (OTP) is a 6-digit verification code, that can be sent to you via text message or email or through Push notifications through a mobile app as a second so that you can input and verify your account. Banking with Scotiabank online or mobile app or signing into personal accounts may require you to provide a OTP to access your accounts.
3. Revenue agency Impersonation Scams -Fraudsters will pose as the representative of a government revenue agency to make claim that there are discrepancies from past tax returns demanding immediate payment. They use intimidation to threaten additional fees and/or jail time if payment is not received.
1. Hang up on suspicious calls immediately.
2. Never give out account or personal information over the phone including bank account and credit card details, passwords, PINs and SIN. Legitimate organizations will not need this information to verify you.
3. Revenue agency Impersonation - Fraudsters will pose as the representative of a government revenue agency to make claim that there are discrepancies from past tax returns demanding immediate payment. They use intimidation to threaten additional fees and/or jail time if payment is not received.
4. Never share your One-time password (OTP) over phone, email or SMS- always verify and use a secure site when inputting your OTP.
Remember, Scotiabank will not call you, send you emails or text messages, or present you with unexpected web pages asking you to validate or restore your confidential information such as your password, PIN, access code, credit card, account numbers, or account access.
If you aren’t sure whether it’s really Scotiabank calling, hang up and call1-866-625-0561and report it to us.
For a list of ways to connect with Scotiabank,please visitContact Us.
If you’ve shared financial information, your One-time password, or suspect fraudulent behaviour, please call us immediately at1-866-625-0561.
Recognize it
Fraudsters will pose Bank officials, law enforcement or government representatives requesting information about and/or access to your personal and financial information.
Reject it
Never give out personal or financial information and hang up on suspicious calls immediately.
Report it
Hang up and call 1-866-625-0561 to report it to us.
Phishing and smishing
Phishing is a form of fraud where cyber criminals use emails to trick you into providing personal or sensitive information that can be used for fraudulent purposes. You may be asked to disclose confidential financial and personal information, like passwords, credit card numbers, access codes, or tax identification numbers.
Emails tend to look authentic, featuring corporate logos and layouts similar to those used by institutions for legitimate communications. Some fraudsters also use fake (spoofed) email addresses that appear to be sent from authentic organizations.
Scam artists have also found a way to send fraudulent messages to mobile phones. Smishing is similar to phishing, except that fraudsters will send scam messages through text (SMS), often in the form of suspicious links.
When it comes to SMS, look out for the wrong number scam. Fraudsters will text you pretending to have messaged the wrong person, this is done to open the lines of communication. Once you respond and establish a connection they will transition to talking about investments or crypto scams, often trying to gather your sensitive information.
Be aware that some phishing and smishing scams try to trick you into downloading malicious software (malware) onto your computer or phone. Fraudsters do this by disguising malware as normal file attachments or as links within emails and text messages.
Once downloaded, malware can delete, corrupt, or encrypt (lock) your files, steal sensitive personal or financial data, or, in rare cases, damage hardware.
When you receive what looks to be an official email or text message, don’t act on it immediately. Take it slowly and carefully review what you received.
You might identify the following:
- Unknown sender
- A threatening tone
- Deals that are too good to be true
- A false sense of urgency
- Requests for sensitive information
- Links or attachments you weren’t expecting
- Irregular company colours, logos, or formatting
- Spelling and grammar mistakes
- Wrong message lures
Remember, phishing emails and smishing text messages use language that creates a sense of urgency in order to get you to react quickly without thinking.
You should never respond to or action any email or text that:
- Requires you to provide personal or financial information (login credentials, account numbers, tax identification numbers, etc.)
- Threatens to close or suspend your accounts if you don’t provide or verify personal information
- Claims your account has been compromised or that there has been fraudulent activity on your account and asks you to enter or verify your account information
- Claims the bank has lost important security information and needs you to update your information online
- Claims they messaged the wrong person and begins asking about your investments and other sensitive information
- States that there are unauthorized charges on your account and requests your account information
- Asks you to enter your card number, password, access code, or account numbers into an email, pop-up window, form, or non-secure web page
- Asks you to confirm, validate, verify, or refresh your account, credit card, or financial information
Always remember that Scotiabank will not call you, send you emails or text messages, or present you with unexpected web pages asking you to validate or restore your confidential information such as your password, PIN, access code, credit card, account numbers, or account access.
If you’re suspicious of the message you received, never respond to emails, open attachments, or select links from institutions (even if reputable) or unknown senders asking for personal or financial information.
Trust your instincts:
- If an email looks suspicious, don’t select links or download attachments within that message
Double-check:
- If you have an existing relationship with the company or individual mentioned in the email, verify the validity of the contact and request by reaching out to them directly using a known contact number
- Make sure to use a phone number from a reputable source to contact the company, for example, the phone number on the back of your bank card
Hover over links:
- Attackers rely on shortened links, redirects, and fake email addresses that mimic those of a legitimate organization
- Before clicking a link, check its destination by hovering over it with your cursor (the visible part of the link is called the anchor and the destination is where the link leads)
- If you don’t recognize where the link is taking you or the destination does not match that of the organization, don’t click!
- Make sure the link is taking you to a secure website; if it begins with “https” instead of “http,” it means the site is secured using an SSL Certificate (the “s” stands for secure)
Don’t forward
- Never forward suspicious emails or text messages to family, friends, or colleagues as you could put them at risk
Never call a phone number that appears in a suspected phishing or smishing message and never respond to the message itself. Often, phishing emails and text messages will include fake contact information that will redirect you back to the fraudsters.
If you’ve received a fraudulent email, please forward it to phishing@scotiabank.com. Don’t remove or change the original subject line or the email in any way when you forward it.
If you’ve entered personal information after selecting a link or suspect fraudulent behaviour, please call us immediately at 1-866-625-0561.
Recognize it
Phishing and smishing messages use language that creates a sense of urgency in order to get you to react without thinking.
Reject it
Slow down. You don’t have to respond immediately, so take some time to thoroughly review what you’ve received.
Report it
If you’ve received a fraudulent email, please forward it tophishing@scotiabank.com.
Fake websites and online shopping fraud
Scammers and fraudsters are taking advantage of the growth of the digital marketing industry, specifically the increase in e-commerce, by creating fake websites that capture sensitive information or spread malware (malicious software).
These types of scams involve directing victims to fake websites, often online shopping websites, through the use of fake emails and online ads that offer deals that are too good to be true.
Just like legitimate websites, fake websites will prompt you to enter your personal and credit card information to complete a transaction or enter a contest. However, unlike legitimate sites, once you make a purchase or enter your information, you won’t receive your item or win a contest, and fraudsters will now have access to your personal and financial information.
At an initial glance, these types of scams are difficult to recognize because scammers use a technique called pagejacking to create convincing fraudulent websites.
Pagejacking is when scammers illegally copy legitimate website content to then use on their fake website, making a convincing duplicate of the real website.
It’s important to take things slowly and to carefully review websites you access through email/SMS links or online ads.
It’s only by slowing down that you start noticing suspicious elements within the website:
- The website URL starts with “http” instead of “https” (the “s” stands for secure) and does not display a tiny padlock icon in the address bar
- The site looks poorly designed, unprofessional, and has broken links
- You can't find an address or phone number for the business; follow up with a Google search of the business name to see if there are other sites that show a different address
- Sales, return, and privacy policies are hard to find or unclear
- The back button is disabled, and you get stuck on a page and can't go back
- You're asked for credit card information anytime other than when you’re making a purchase
You can develop good habits to protect yourself from online shopping fraud.
Never respond to pop-up messages on a website that asks for your financial information.
If the price of an item or the opportunity presented seems way too good to be true, don’t select the link provided until you’ve researched the price of other retailers. Instead of selecting a link in a text message or email, use a search engine like Google to search for the company’s legitimate website and find the deal you’re looking for.
You can also use the email or phone number listed on their website to contact the company to validate the offer.
If you’re a Scotiabank customer and believe you’ve been impacted by online fraud, immediately call us at 1-866-625-0561.
Make sure to also report all shopping scams to your local police department.
Recognize it
Be wary of websites that are poorly designed, have broken links, aren’t secure (http), or don’t include proper contact information.
Reject it
If a deal sounds too good to be true, it probably is. It’s safer to just ignore it.
Report it
Call 1-866-625-0561
Fake mobile apps
An increasing number of retailers and service providers require or encourage you to download a mobile application to make a purchase.
However, there are many fraudulent apps that trick you into sharing your private information for malicious purposes. These can also include fake versions of social media or communication apps, such as WhatsApp or Facebook.
Before downloading or using a new app, look for the following:
- Is the name of the app publisher the same name as the retail app? Is the spelling correct?
- Does the app have user feedback and ratings? Has there been any negative feedback?
- How many people have downloaded the app? A high number is typically a good sign that the application is legitimate and not a copy
- Does the company provide contact details, a website address, or email information?
- Does the app install require permissions outside of the app’s scope? For example, a calculator app that’s asking for access to your camera and contacts
- Does the app have multiple pop-up ads and does it keep prompting you for your personal information?
Remember to only downloadapps from trusted sources, like the App Store or Google Play.
If you’re ever in doubt about whether an app is legitimate, use a search engine like Google to search for the company website. You can either send an email or call the company directly using the contact information listed on their website to verify the legitimacy of the app.
Make sure to report suspicious apps on the app store you’re using.
If you ever find an app impersonating an official Scotiabank-related app, send the app name, app store name, and a link to the app to phishing@scotiabank.com.
Recognize it
Negative or generic reviews, a low number of app downloads, pop-ups, and multiple permission requests are all signs of fake apps.
Reject it
Contact the company that made the app or visit their authorized website and ask for its legitimacy.
Report it
If you ever find an app impersonating an official Scotiabank-related app, send the information to phishing@scotiabank.com.
Phone fraud
Whenever you answer the phone and someone you don’t know is on the other end, take extra precaution.
Scam artists are known to pose as representatives from government agencies, local police services, legitimate financial institutions, and other types of companies in an attempt to defraud customers.
Phone fraud is commonly referred to as vishing. The term comes from “voice” and “phishing.” Vishing uses telephone communications in combination with email or the internet to steal information and money from unsuspecting consumers.
The Bank Inspector/Investigator Scam is a type of vishing scam in which fraudsters pretend to be a bank official or law enforcement officer calling to review a fraudulent claim. They will attempt to trick customers into providing their own money to “aid” in a criminal investigation.
The most common phone scams involve:
- Malicious people impersonating government agencies, such as revenue, public health (COVID related), financial institutions, immigration services, justice departments, or local police services; if they sound threatening, it’s safe to assume it’s a scam
- Fake Bank investigators, inspectors or representatives asking money or sensitive information.
- Get-rich-quick schemes that are vague and have no apparent risk
- Fake charity solicitations asking for donations
- Prize winnings that require you to pay for shipping expenses
- A message that prompts you to visit a website and enter personal or financial information
- Hang up on suspicious calls immediately
- Never give out account or personal information over the phone
- Never send money to a suspicious caller from a government agency or financial institution
- If you aren’t sure about the organization or person calling, verify the contact number and call back
- If you believe the fraudster poses a risk to your personal safety, call your local police.
If you aren’t sure whether it’s really Scotiabank calling, hang up and call 1-866-625-0561 and report it to us.
For a list of ways to connect with Scotiabank,please visitContact Us.
Recognize it
If the caller sounds threatening or is urging you to hurry, it’s safe to assume it’s a scam.
Reject it
Never give out personal or financial information over the phone.
Report it
Hang up, call 1-866-625-0561 and report it to us.
