You Just Scanned a QR Code. Should You Have?

Think before you scan.

Congratulations - you just scanned a QR code to learn why you should be cautious about scanning QR codes. A QR code can hide the destination until after you scan it, which makes it useful for both legitimate businesses and scammers.

What to watch for

• Check the source. Be cautious with QR codes on unexpected emails, texts, flyers, parking meters, posters or packages.
• Look for tampering. A sticker placed over an original QR code can redirect you somewhere completely different.
• Preview the link before opening it. Make sure the domain looks familiar and is spelled correctly.
• Do not enter passwords, payment details or personal information unless you have verified the website.
• If a QR code asks you to download an app or file, stop and verify it another way first.

You've Got Mail... or a Scam!

Can you spot a phishing email?

Phishing can lead to more than a hacked email account. In a recent Ontario case, a Brampton man discovered a $35,000 line of credit had been opened and maxed out in his name, and a physical card had been picked up at a Milton bank branch he said he had never visited. Identity thieves can piece together personal information gathered through fraudulent links, QR codes, texts and other scams. Read the CTV News example.

What to watch for

• Check the real sender address - not just the display name. An email may say "Billing" or use a familiar name while the actual address is unrelated.
• Hover over links on a computer, or carefully preview them on a mobile device where supported, before opening them.
• Watch for urgency: "Act now", "Your account will be closed" or "Payment required immediately" are meant to rush you.
• Be suspicious of unexpected attachments, invoices, password reset requests or requests for confidential information. Regularly review bank and credit-card activity, and investigate unfamiliar credit inquiries or accounts promptly.
• Look for unusual wording, spelling mistakes, formatting changes or requests that do not match how the sender normally communicates.

A quick phishing test

• The email says it is from bill@gmail.com - but when you inspect the sender, the real address is 34xx7@fake-example.com. Which address matters? The real one.
• The button says "View Invoice" - but the link preview points to a completely different website. Do not click.

Is Your Password a Welcome Mat for Hackers?

Long. Unique. Protected.

Passwords are still one of the easiest ways into an account when they are short, predictable or reused. Use long, unique passwords and add multi-factor authentication (MFA) so a stolen password alone is not enough.

What to watch for

• Use a long passphrase or a password generated by a reputable password manager.
• Use a different password for each important account. Reusing one password means one breach can expose several accounts.
• Turn on multi-factor authentication (MFA) wherever possible. An authenticator app or passkey offers stronger protection than a password alone.
• Do not use obvious personal details such as names, birthdays, pets, company names or simple patterns.
• Changing phones or tablets? Before wiping or giving up the old device, move your authenticator app, passkeys and other MFA methods to the new device and test that you can still sign in. Keep recovery codes or a backup method somewhere secure.

Would You Trust This Website?

One wrong letter could cost you.

Fake websites can look nearly identical to the real thing. Small spelling changes, extra words or misleading subdomains can make a fraudulent address look legitimate at a glance.

What to watch for

• Read the actual domain carefully. example.com and examp1e.com are not the same website.
• Pay attention to what appears before the first slash. A long address can contain a familiar brand name while the real domain belongs to someone else.
• Be cautious with unexpected pop-ups that ask you to install software, sign in again or provide payment information.
• Do not assume a padlock or HTTPS means a site is trustworthy. It only means the connection is encrypted.
• When signing in to an important account, use a saved bookmark or type the known website address yourself instead of following an unexpected link.

When Did You Last Give Your Tech a Checkup?

Five minutes today can save hours later.

Keeping technology secure is not one big task - it is a handful of small habits done consistently. Keep systems updated, protect your accounts, maintain reliable backups and regularly review who and what still has access.

What to watch for

• Update: Turn on automatic updates for your operating system, browser, phone and frequently used applications.
• Protect: Make sure your device security features and malware protection are enabled and current.
• Back up: Keep important files backed up and occasionally test that you can actually restore them.
• Lock: Protect computers, phones and tablets with a PIN, password, biometric lock and automatic screen timeout.
• Review: Remove software you no longer use, check which devices are signed in, and confirm your MFA and recovery methods still point to devices and accounts you control.

Bonus business check

• Confirm staff know how to report a suspicious email or security issue.
• Build MFA into offboarding. Remove former employees and contractors promptly, including their devices, authenticator registrations, recovery emails, phone numbers, app passwords and active sessions.
• Avoid a single-person MFA bottleneck. For critical business services, maintain at least two organization-controlled administrator or recovery paths so access does not depend on one employee or contractor and one personal device.