Don’t take the bait: Recognise and avoid phishing attacks – ITSAP.00.101 – Canadian Centre for Cyber Security

Summary

This Canadian Centre for Cyber Security guidance explains what phishing is, the many forms it can take (email, SMS, voice, QR codes, social media and more), and how artificial intelligence is changing the threat and the defence landscape. It outlines the typical phishing sequence — bait, hook, attack — and lists practical organisational and individual protections, from DMARC and multi-factor authentication to staff training, backups and incident response updates.

The guidance stresses that AI both improves phishing realism and helps defenders through advanced detection systems, so organisations must invest in technology and awareness together.

Key Points

Phishing is social engineering that tricks people into revealing credentials, clicking malicious links, downloading malware or transferring money.
Common types include deceptive phishing, spear phishing, whaling, quishing (QR codes), smishing (SMS), vishing (voice), angler phishing (social media), catfishing and pharming.
Attack flow: threat actors set the bait, use a hook to prompt urgent action, then exploit stolen credentials or deliver malware in the attack phase.
AI increases phishing effectiveness by generating convincing content and by enabling highly targeted spear-phishing and whaling campaigns.
Defensive AI helps too: intrusion detection and behavioural analysis can spot anomalies and speed up mitigation.
Organisational protections: use trusted DNS resolvers, DMARC-aligned anti-phishing tools, MFA, regular patching, backups, blocking known-malicious IPs/domains and updated incident response plans.
Employee actions: stay calm, avoid sending sensitive info by message, reduce personal data shared online, enable spam filters, verify senders via separate channels and avoid scanning unknown QR codes or clicking suspicious links.
Training and phishing simulations significantly reduce successful attacks; discuss smishing/vishing protections with telco providers.

Why should I read this?

Short version: if you use email, phones or social media at work (and who doesn’t?), this is a must-skim. It’s a crisp, practical checklist of what to watch for and what to do — from tech controls to the simple day-to-day habits that stop attackers getting in. We’ve saved you the deep read and pulled out the actions you can use right away.