Scam Safety: Complete Sources and Notes

These complete chapter-by-chapter sources and notes accompany Smart Tech for Real People: Scam Safety by Greg Weir. They identify the evidence behind explanations and recommendations where a rule, product behaviour, safety limit, financial boundary or recovery route matters.

Sources reviewed through 30 September 2026. Guidance, service routes, product behaviour and laws can change. Use the named organisation’s current official guidance when you need to act. The printed book includes a shorter list of principal authorities so its essential guidance does not depend on this page.

Chapter 1: The Moment They Want You to Rush

Canadian Anti-Fraud Centre, “Fraud Trends — First 6 Months of 2026”. Modified 25 August 2026. URL: https://antifraudcentre-centreantifraude.ca/features-vedette/2026/08/fraud-trends-tendances-matiere-fraude-eng.htm. Supports the discussion of urgency, secrecy, impersonation and borrowed trust. Its loss figures and rankings are time-sensitive and are not used as universal risk measures.
Competition Bureau Canada, “Fake urgency cues”. Modified 25 November 2024. URL: https://competition-bureau.canada.ca/en/deceptive-marketing-practices/types-deceptive-marketing-practices/fake-urgency-cues. Supports the distinction between a real deadline and a false or misleading pressure cue. It concerns Canadian deceptive-marketing law, not every scam.
Get Cyber Safe, “The three most common social engineering tactics”, modified 17 March 2025, and Financial Consumer Agency of Canada, “Module 7: How to protect yourself from financial fraud”, dated 23 September 2025. URLs: https://www.getcybersafe.gc.ca/en/blogs/three-most-common-social-engineering-tactics and https://www.canada.ca/en/financial-consumer-agency/services/financial-basics/financial-basics-videos/financial-basics-video-fraud.html. These Canadian sources support age-neutral, non-blaming treatment and the recurring use of fear, urgency, secrecy and familiar details. Their older or interface-specific advice is not adopted wholesale.
U.S. Federal Trade Commission, “How To Avoid a Scam”. July 2023. URL: https://consumer.ftc.gov/articles/how-avoid-scam. Supports the recurring structure of an asserted identity, a problem or prize, immediate pressure and a specified payment method. Organisation-specific statements remain U.S.-specific.
Jaime Claire Auton and Daniel Sturman, “Persuasion under pressure: the influence of persuasion principles and time constraints on phishing email susceptibility”. Information & Computer Security 33(5), 2025, 845–859. URL: https://digital.library.adelaide.edu.au/items/3c118ff1-97c0-4d77-b316-a20dd26c8ca2. This controlled email experiment supports deliberately creating time; it does not establish a universal waiting period.
Katharina Kircanski and colleagues, “Emotional arousal may increase susceptibility to fraud in older and younger adults”. Psychology and Aging 33(2), 2018, 325–337. URL: https://pubmed.ncbi.nlm.nih.gov/29658750/. This laboratory study supports pausing for excitement as well as fear. It does not create an individual or age-based risk rule.

Chapter 2: When Trust Signals Can Be Faked

Unicode Consortium, “Unicode Security Mechanisms”, version 17.0.0, Revision 32, and “Security Issues FAQ”. URLs: https://www.unicode.org/reports/tr39/ and https://www.unicode.org/faq/security.html. These sources define confusable characters and identifier risks. They support the homoglyph explanation, not an expectation that readers detect every deceptive name by sight.
Get Cyber Safe, “Spoofing: What it is and how to protect yourself”, modified 25 November 2025, and Canadian Centre for Cyber Security, “Social engineering — ITSAP.00.166”, modified 20 July 2026. URLs: https://www.getcybersafe.gc.ca/en/blogs/spoofing-introduction and https://www.cyber.gc.ca/en/guidance/social-engineering-itsap00166. Support the treatment of copied identities, polished messages, synthetic media and deceptive permission requests as signals rather than proof.
Canadian Centre for Cyber Security, “What is voice phishing (vishing)? — ITSAP.00.102”, modified 21 July 2026, and U.S. Federal Trade Commission, “Scammers use AI to enhance their family emergency schemes”, published 20 March 2023. URLs: https://www.cyber.gc.ca/en/what-voice-phishing-vishing-itsap00102 and https://consumer.ftc.gov/consumer-alerts/2023/03/scammers-use-ai-enhance-their-family-emergency-schemes. Support the warning that a familiar voice may be cloned or otherwise misleading. They do not establish how a particular recording was made.
Microsoft, “File hosting services misused for identity phishing”, published 8 October 2024, and “How Microsoft Defender for Office 365 innovated to address QR code phishing attacks”, published 4 November 2024. URLs: https://www.microsoft.com/en-us/security/blog/2024/10/08/file-hosting-services-misused-for-identity-phishing/ and https://www.microsoft.com/en-us/security/blog/2024/11/04/how-microsoft-defender-for-office-365-innovated-to-address-qr-code-phishing-attacks/. These campaign analyses support the treatment of trusted cloud platforms and QR codes as delivery routes, not endorsements. They concern observed campaigns and Microsoft environments, not all services.

Chapter 3: Stop, Check, Verify

Canadian Anti-Fraud Centre, “Protect yourself from fraud”, modified 14 January 2026, and Get Cyber Safe, “Spoofing: What it is and how to protect yourself”, modified 25 November 2025. URLs: https://antifraudcentre-centreantifraude.ca/protect-protegez-eng.htm and https://www.getcybersafe.gc.ca/en/blogs/spoofing-introduction. Support ending pressured contact and independently verifying the claimed person or organisation. The book’s four-step wording is its own editorial model.
U.S. Federal Trade Commission, “How to handle unexpected calls that claim your money is at risk”, January 2026, and “What are the signs of a scam?”, March 2025. URLs: https://consumer.ftc.gov/consumer-alerts/2026/01/how-handle-unexpected-calls-claim-your-money-risk and https://consumer.ftc.gov/consumer-alerts/2025/03/what-are-signs-scam. Support the channel break, independent contact and the distinction between a warning sign and proof.

Chapter 4: Suspicious Emails, Texts, and Messages

Canadian Centre for Cyber Security, “Don’t take the bait: Recognize and avoid phishing attacks”, modified 24 November 2025, and “Spotting malicious email messages — ITSAP.00.100”, modified 28 January 2026. URLs: https://www.cyber.gc.ca/en/guidance/dont-take-bait-recognize-and-avoid-phishing-attacks and https://www.cyber.gc.ca/en/guidance/spotting-malicious-email-messages-itsap00100. Support the phishing and malicious-email discussion. Their individual clues are not promoted into universal authenticity tests.
Canadian Centre for Cyber Security and Royal Canadian Mounted Police, “Smishing: Protect yourself from SMS attacks — ITSAP.00.103”. Modified 24 April 2026. URL: https://www.cyber.gc.ca/en/guidance/smishing-protect-yourself-sms-attacks-itsap00103. Supports the Canadian treatment of text-message phishing and the decision to leave the supplied route.
U.S. Federal Trade Commission, “Protect yourself from phishing scams”, published 4 June 2025, and “Is that unexpected text a scam?”, published 16 April 2025. URLs: https://consumer.ftc.gov/consumer-alerts/2025/04/protect-yourself-phishing-scams and https://consumer.ftc.gov/consumer-alerts/2025/04/unexpected-text-scam. Support checking email and text requests through a route obtained elsewhere.
Google, “‘This message could be a scam’ warning”, and Microsoft, “File hosting services misused for identity phishing”, published 8 October 2024. URLs: https://support.google.com/mail/answer/1074268?hl=en and https://www.microsoft.com/en-us/security/blog/2024/10/08/file-hosting-services-misused-for-identity-phishing/. Support the points that a known account can be compromised and a familiar service can carry a deceptive journey. Provider warnings are useful but not guarantees.

Chapter 5: Calls, Voices, and Unexpected Support

Canadian Centre for Cyber Security, “What is voice phishing (vishing)? — ITSAP.00.102” and “Social engineering — ITSAP.00.166”. Modified 21 and 20 July 2026. URLs: https://www.cyber.gc.ca/en/what-voice-phishing-vishing-itsap00102 and https://www.cyber.gc.ca/en/guidance/social-engineering-itsap00166. Support the vishing, voice-cloning, deepfake and pressure discussion without making the technology itself the first response problem.
U.S. Federal Trade Commission, “How to handle unexpected calls that claim your money is at risk” and “Phone Scams”. January 2026 and August 2023. URLs: https://consumer.ftc.gov/consumer-alerts/2026/01/how-handle-unexpected-calls-claim-your-money-risk and https://consumer.ftc.gov/articles/phone-scams. Support ending an incoming call and independently contacting the claimed organisation.
U.S. Federal Trade Commission, “How To Spot, Avoid, and Report Tech Support Scams”. September 2025. URL: https://consumer.ftc.gov/articles/how-spot-avoid-and-report-tech-support-scams. Supports the unsolicited-support and remote-access boundary. Exact recovery steps depend on what changed.
Federal Bureau of Investigation, “Senior U.S. Officials Impersonated in Malicious Messaging Campaign”, and U.S. Federal Trade Commission, “Scammers use AI to enhance their family emergency schemes”. URLs: https://www.fbi.gov/investigate/cyber/alerts/2025/senior-us-officials-impersonated-in-malicious-messaging-campaign and https://consumer.ftc.gov/consumer-alerts/2023/03/scammers-use-ai-enhance-their-family-emergency-schemes. Document real cloned-voice or AI-assisted impersonation concerns. They do not establish the origin of a particular voice.

Chapter 6: Websites, Search Results, and QR Codes

Unicode Consortium, “Unicode Security Mechanisms”, version 17.0.0, Revision 32, and ICANN, “Internationalized Domain Names”. URLs: https://www.unicode.org/reports/tr39/ and https://www.icann.org/resources/pages/idn-2012-02-25-en. Support the explanation of confusable characters and internationalized names. Neither turns address inspection into a dependable eyesight test.
Get Cyber Safe, “How to use QR codes safely”, modified 23 December 2022, and U.S. Federal Trade Commission, “Scammers hide harmful links in QR codes to steal your information”, published 6 December 2023. URLs: https://www.getcybersafe.gc.ca/en/blogs/how-use-qr-codes-safely and https://consumer.ftc.gov/consumer-alerts/2023/12/scammers-hide-harmful-links-qr-codes-steal-your-information. Support treating a QR code as a route rather than proof of the party behind it.
U.S. Federal Trade Commission, “Online search results: The good, the bad, and the scammy”, published 3 April 2025, and “Buying From an Online Marketplace”, November 2024. URLs: https://consumer.ftc.gov/consumer-alerts/2025/04/online-search-results-good-bad-scammy and https://consumer.ftc.gov/articles/buying-online-marketplace. Support the distinction between a search result or polished website and independent verification.
Microsoft, “File hosting services misused for identity phishing”, published 8 October 2024, and Google Threat Analysis Group, “Iranian backed group steps up phishing campaigns against Israel, U.S.”, published 14 August 2024. URLs: https://www.microsoft.com/en-us/security/blog/2024/10/08/file-hosting-services-misused-for-identity-phishing/ and https://blog.google/threat-analysis-group/iranian-backed-group-steps-up-phishing-campaigns-against-israel-us/. Support the legitimate-cloud-platform and Browser-in-the-Browser examples. These are campaign reports, not universal browser-behaviour tests.
Apple, “Block pop-up ads and windows in Safari”. Published 26 January 2026. URL: https://support.apple.com/en-us/102524. Supports leaving an alarming pop-up instead of using its buttons or telephone number. It is Apple-specific and does not describe every browser.

Chapter 7: Before Money Leaves Your Hands

Financial Consumer Agency of Canada, “Unauthorized credit and debit transactions: know your rights and responsibilities”, dated 15 October 2025, and “Cashing a cheque”, dated 17 October 2025. URLs: https://www.canada.ca/en/financial-consumer-agency/services/rights-responsibilities/protection-unauthorized-transactions.html and https://www.canada.ca/en/financial-consumer-agency/services/banking/cashing-cheques.html. Support separating an unauthorized transaction from a payment a person was deceived into making, and a cheque deposit from final settlement. Rights and deadlines depend on the institution, agreement and facts.
Financial Consumer Agency of Canada, “Crypto assets”. Dated 27 November 2025. URL: https://www.canada.ca/en/financial-consumer-agency/services/payment/digital-currency.html. Supports the high-volatility, limited-protection and transaction-reversal cautions. It is general Canadian guidance, not a recovery promise.
Interac, “Interac Consumer FAQs” and “The Ombudsman’s Office”. URLs: https://www.interac.ca/en/resources/personal-resources/personal-faq/ and https://www.interac.ca/en/company/about/the-ombudsmans-office/. Support the payment-state and provider-boundary discussion. The reader’s financial institution controls its own interface, limits and first response.
U.S. Federal Trade Commission, “A way to spot scams: how someone asks you to pay”, July 2026, “Avoiding and Reporting Gift Card Scams”, July 2023, and “What To Do if You Were Scammed”, June 2026. URLs: https://consumer.ftc.gov/consumer-alerts/2026/07/way-spot-scams-how-someone-asks-you-pay, https://consumer.ftc.gov/articles/avoiding-and-reporting-gift-card-scams and https://consumer.ftc.gov/articles/what-do-if-you-were-scammed. Support payment-method warning signs and method-specific first responses. They do not guarantee reversal.
U.S. Consumer Financial Protection Bureau, “How can I get a refund on a product or service I purchased with my credit card?”. URL: https://www.consumerfinance.gov/ask-cfpb/how-can-i-get-a-refund-on-a-product-or-service-i-purchased-with-my-credit-card-en-1969/. Supports the U.S. credit-card dispute distinction. Eligibility, evidence and timing are fact-specific.
Zelle, “What if the person I am sending money to hasn’t enrolled with Zelle?” and “Report a Scam or Fraud”. URLs: https://www.zelle.com/faq/what-if-person-i-am-sending-money-hasnt-enrolled-zelle and https://www.zelle.com/support/report-scam. Support the U.S. payment- state and scam/fraud reporting distinctions. They must not be treated as Interac instructions or a promise of reimbursement.

Chapter 8: Account Takeover and Recovery Traps

Canadian Centre for Cyber Security, “Rethink your password habits to protect your accounts from hackers — ITSAP.30.036” and “Secure your accounts and devices with multi-factor authentication — ITSAP.30.030”. Modified 15 May and 16 February 2024. URLs: https://www.cyber.gc.ca/en/guidance/rethink-your-password-habits-protect-your-accounts-hackers-itsap30036 and https://www.cyber.gc.ca/en/guidance/secure-your-accounts-and-devices-multi-factor-authentication-itsap30030. Support credential-reuse, MFA-fatigue and method-strength distinctions.
Canadian Centre for Cyber Security, “Defending against adversary-in-the- middle threats with phishing-resistant multi-factor authentication — ITSM.30.031”, modified 30 October 2025, and “Social engineering — ITSAP.00.166”, modified 20 July 2026. URLs: https://www.cyber.gc.ca/en/guidance/defending-against-adversary-middle-threats-phishing-resistant-multi-factor-authentication-itsm30031 and https://www.cyber.gc.ca/en/guidance/social-engineering-itsap00166. Support the AiTM and OAuth-consent-phishing explanations. These organisational sources do not prove that every consumer service offers the same controls.
Canadian Centre for Cyber Security, “Security considerations for SIMs — ITSAP.10.021”. Modified 16 February 2026. URL: https://www.cyber.gc.ca/en/guidance/security-considerations-sims. Supports the SIM-swap explanation. Loss of telephone service is a clue, not proof of a swap.
U.S. Federal Trade Commission, “How To Recover Your Hacked Email or Social Media Account”, August 2023, and “Refund and Recovery Scams”, December 2023. URLs: https://consumer.ftc.gov/articles/how-recover-your-hacked-email-or-social-media-account and https://consumer.ftc.gov/articles/refund-and-recovery-scams. Supports provider-led account recovery and the warning that recovery help can itself be fraudulent.

Chapter 9: Buying and Selling Between Strangers

Canadian Anti-Fraud Centre, “Merchandise”. Modified 16 January 2026. URL: https://antifraudcentre-centreantifraude.ca/scams-fraudes/merchandise-marchandises-eng.htm. Supports the buyer/seller treatment of nonexistent goods, fake payment notices, overpayments and fee requests.
Health Canada, “Keep safety in mind when shopping online”. Dated 11 October 2024. URL: https://www.canada.ca/en/health-canada/services/buying-consumer-products-online.html. Supports the point that counterfeit or non-compliant products can create safety consequences beyond losing the purchase price.
Competition Bureau Canada, “Purchase of merchandise scams” and “Sale of merchandise scams”. Modified 19 January 2022. URLs: https://competition-bureau.canada.ca/en/fraud-and-scams/tips-and-advice/purchase-merchandise-scams and https://competition-bureau.canada.ca/en/fraud-and-scams/tips-and-advice/sale-merchandise-scams. Support keeping buyer and seller risks separate.
eBay Canada, “eBay Money Back Guarantee policy”, and U.S. Federal Trade Commission, “Buying From an Online Marketplace”. URLs: https://www.ebay.ca/help/policies/ebay-money-back-guarantee-policy/ebay-money-back-guarantee-policy?id=4210 and https://consumer.ftc.gov/articles/buying-online-marketplace. Support the principle that marketplace protection is conditional on the platform, listing, payment route, timing and evidence. They do not establish coverage for a particular transaction.
U.S. Federal Trade Commission, “Selling stuff online? Here’s how to avoid a scam” and “How To Spot, Avoid, and Report Fake Check Scams”. URLs: https://consumer.ftc.gov/consumer-alerts/2022/07/selling-stuff-online-heres-how-avoid-scam and https://consumer.ftc.gov/articles/how-spot-avoid-and-report-fake-check-scams. Support the fake-payment, overpayment and cheque-settlement distinctions.

Chapter 10: Banks, Fraud Investigators, Government, Police, and Technical Support

Canadian Anti-Fraud Centre, “Bank investigator”, modified 15 January 2026, and Chilliwack RCMP, “Mounties issue warning of bank investigator scam”, published 29 August 2024. URLs: https://antifraudcentre-centreantifraude.ca/scams-fraudes/b-investigator-enqueteur-eng.htm and bc-archives.rcmp.ca archive page. Support the Canadian bank-investigator pattern and the chapter’s sourced opening. The RCMP page is an official archived record; it is not maintained as current guidance. A reported case is not a prevalence estimate.
Canada Revenue Agency, “Verify it’s the CRA calling”. Modified 15 April 2026. URL: https://www.canada.ca/en/revenue-agency/corporate/scams-fraud/verify-cra-contact.html. Supports verifying a claimed CRA contact through the agency’s official process without assuming that every government call is false.
TD, “How to protect yourself from the bank investigator scam”, published 7 July 2025; RBC, “Current Scam Alerts”; and Scotiabank, “Types of bank scams and urgent messages to avoid”, published 26 February 2025. URLs: https://stories.td.com/ca/en/article/how-to-protect-yourself-from-the-bank-investigator-scam, https://www.rbc.com/cyber-security/alerts/ and https://www.scotiabank.com/ca/en/personal/advice-plus/features/posts.types-of-bank-scams-and-urgent-messages-to-avoid.html. Provide representative Canadian bank guidance. The reader’s own institution and agreement control the actual response.
Microsoft, “Protect yourself from tech support scams”, and U.S. Federal Trade Commission, “How To Spot, Avoid, and Report Tech Support Scams”. URLs: https://support.microsoft.com/en-us/office/protect-yourself-from-tech-support-scams and https://consumer.ftc.gov/articles/how-spot-avoid-and-report-tech-support-scams. Support the unsolicited-support, pop-up and remote-access boundaries.
U.S. Consumer Financial Protection Bureau, “Who do I contact for help with a scam or fraud?”, modified 31 August 2026, and U.S. Federal Trade Commission, “How to handle unexpected calls that claim your money is at risk”. URLs: https://www.consumerfinance.gov/ask-cfpb/who-do-i-contact-for-help-with-a-scam-or-fraud-en-1777/ and https://consumer.ftc.gov/consumer-alerts/2026/01/how-handle-unexpected-calls-claim-your-money-risk. Support independent contact and U.S. reporting boundaries.
Internal Revenue Service, “How to know it’s the IRS”, updated 9 July 2026, and Federal Bureau of Investigation, “FBI Warns Public to Beware of Scammers Impersonating FBI Agents and Other Government Officials”, published 5 June 2024. URLs: https://www.irs.gov/help/how-to-know-its-the-irs and https://www.fbi.gov/contact-us/field-offices/portland/news/fbi-warns-public-to-beware-of-scammers-impersonating-fbi-agents-and-other-government-officials. Support U.S. tax and government-agent impersonation boundaries. They do not mean that every legitimate agency uses the same contact rules.

Chapter 11: Family Emergencies, Friendship, and Romance

Canadian Anti-Fraud Centre, “Emergency”, modified 14 January 2026; “Relationship and romance”, modified 16 January 2026; and “Money mule awareness”, modified 7 July 2022. URLs: https://antifraudcentre-centreantifraude.ca/scams-fraudes/emergency-urgence-eng.htm, https://antifraudcentre-centreantifraude.ca/scams-fraudes/romance-rencontre-eng.htm and https://antifraudcentre-centreantifraude.ca/features-vedette/2020/awareness-sensibilisation-eng.htm. Support the Canadian emergency, romance and money-mule patterns.
Canadian Centre for Cyber Security, “What is voice phishing (vishing)? — ITSAP.00.102”, modified 21 July 2026. URL: https://www.cyber.gc.ca/en/what-voice-phishing-vishing-itsap00102. Supports the voice-contact risks, including the need to verify a caller through another channel.
U.S. Federal Trade Commission, “Scammers use AI to enhance their family emergency schemes” and “What To Know About Romance Scams”, August 2022. URLs: https://consumer.ftc.gov/consumer-alerts/2023/03/scammers-use-ai-enhance-their-family-emergency-schemes and https://consumer.ftc.gov/articles/what-know-about-romance-scams. Support the U.S. family-emergency, voice-cloning and romance-scam examples.
U.S. Office for Victims of Crime, “Model Standards — Ethical Standard 3”. URL: https://ovc.ojp.gov/sites/ovc/files/model-standards/6/ethical_standards_3.html. Supports the chapter’s trauma-informed, non-blaming approach to helping a person who may be experiencing fraud.

Chapter 12: Investments, Cryptocurrency, and the Promise of Easy Returns

Canadian Anti-Fraud Centre, “Investment”, modified 16 January 2026. URL: https://antifraudcentre-centreantifraude.ca/scams-fraudes/investment-investissement-eng.htm. Supports the Canadian investment-fraud patterns, including social contact and fraudulent trading platforms.
Canadian Securities Administrators, “Are They Registered?” and “Crypto Platforms Authorized to Do Business with Canadians”. Updated 13 January and 31 July 2026, respectively. URLs: https://www.securities-administrators.ca/investor-tools/are-they-registered/ and https://www.securities-administrators.ca/crypto-platforms-regulation-and-enforcement-actions/crypto-platforms-authorized-to-do-business-with-canadians/. Support independent registration checks. Registration or authorization is not a promise that an investment is suitable, profitable or risk-free.
Canadian Investment Regulatory Organization, “Learn about the Risk of Crypto Assets”. URL: https://www.ciro.ca/office-investor/understanding-risk/learn-about-risk-crypto-assets. Supports the risks and limits of crypto assets in the Canadian context.
U.S. Federal Trade Commission, “Investment Scams”, “What To Know About Cryptocurrency and Scams”, May 2022, and “With people losing big to investment scams, learn how to spot and avoid them”, April 2026. URLs: https://consumer.ftc.gov/articles/investment-scams, https://consumer.ftc.gov/articles/what-know-about-cryptocurrency-scams and https://consumer.ftc.gov/consumer-alerts/2026/04/people-losing-big-investment-scams-learn-how-spot-and-avoid-them. Support the U.S. warning signs and the need to verify before sending money.
U.S. Securities and Exchange Commission, “Artificial Intelligence (AI) and Investment Fraud: Investor Alert”. URL: https://www.investor.gov/introduction-investing/general-resources/news-alerts/alerts-bulletins/investor-alerts/artificial-intelligence-fraud. Supports the discussion of AI-themed investment claims and fabricated endorsements.

Chapter 13: Jobs, Tasks, and Opportunities That Ask You to Pay

Canadian Anti-Fraud Centre, “Job”, modified 16 January 2026, and “Money mule awareness”, modified 7 July 2022. URLs: https://antifraudcentre-centreantifraude.ca/scams-fraudes/job-emploi-eng.htm and https://antifraudcentre-centreantifraude.ca/features-vedette/2020/awareness-sensibilisation-eng.htm. Support Canadian job-scam and money-mule patterns.
U.S. Federal Trade Commission, “Job Scams”, March 2023; “Task scams create the illusion of making money”; “How To Spot, Avoid, and Report Fake Check Scams”, 5 June 2025; and “Scammers are hijacking job ads. Here’s how to spot the fakes”. URLs: https://consumer.ftc.gov/articles/job-scams, https://consumer.ftc.gov/consumer-alerts/2024/11/task-scams-create-illusion-making-money, https://consumer.ftc.gov/articles/how-spot-avoid-and-report-fake-check-scams and https://consumer.ftc.gov/consumer-alerts/2023/05/scammers-are-hijacking-job-ads-heres-how-spot-fakes. Support fake recruiters, task platforms, fake cheques and copied job ads.
U.S. Postal Inspection Service, “Work-From-Home Scams and Reshipping Schemes”. URL: https://www.uspis.gov/news/scam-article/work-from-home-scams-and-reshipping-schemes-2. Supports the reshipping-scheme warning and the risk of becoming an unwitting participant.

Chapter 14: Protect the Accounts and Devices That Matter Most

Get Cyber Safe, “How to ensure your accounts are secure”, modified 20 June 2025; “Password Managers”, modified 20 January 2026; and “How backups keep your data safe”, modified 26 September 2024. URLs: https://www.getcybersafe.gc.ca/en/blogs/ensure-your-accounts-are-secure, https://www.getcybersafe.gc.ca/en/resources/password-managers and https://www.getcybersafe.gc.ca/en/resources/backups-keep-data-safe. Support the Canadian account, password-manager and backup guidance.
Canadian Centre for Cyber Security, “Secure your accounts and devices with multi-factor authentication”, modified 16 February 2024, and “Security considerations for SIMs”, modified 16 February 2026. URLs: https://www.cyber.gc.ca/en/guidance/secure-your-accounts-and-devices-multi-factor-authentication-itsap30030 and https://www.cyber.gc.ca/en/guidance/security-considerations-sims. Support multi-factor authentication and SIM-related account risks.
Financial Consumer Agency of Canada, “Online banking: know your rights and responsibilities”, modified 15 October 2025. URL: https://www.canada.ca/en/financial-consumer-agency/services/rights-responsibilities/rights-banking/online-banking.html. Supports the Canadian online-banking responsibilities and reporting boundary; the reader’s agreement and circumstances still matter.
U.S. Federal Trade Commission, “How To Recover Your Hacked Email or Social Media Account”, August 2023. URL: https://consumer.ftc.gov/articles/how-recover-your-hacked-email-or-social-media-account. Supports the account-recovery sequence.
National Institute of Standards and Technology, NIST SP 800-63B-4: Digital Identity Guidelines — Authentication and Authenticator Management, 2025, and Protecting Data from Ransomware and Other Data Loss Events: A Guide for Managed Service Providers to Conduct, Maintain, and Test Backup Files, April 2020. URLs: https://www.nist.gov/publications/nist-sp-800-63b-4digital-identity-guidelines-authentication-and-authenticator and https://csrc.nist.gov/pubs/other/2020/04/24/protecting-data-from-ransomware-and-other-data-los/final. Provide technical grounding for authentication and tested backups. They are standards guidance, not proof that any particular service conforms.

Chapter 15: Build Your Verification Network

Get Cyber Safe, “How to ensure your accounts are secure”, modified 20 June 2025, and Financial Consumer Agency of Canada, “Online banking: know your rights and responsibilities”, modified 15 October 2025. URLs: https://www.getcybersafe.gc.ca/en/blogs/ensure-your-accounts-are-secure and https://www.canada.ca/en/financial-consumer-agency/services/rights-responsibilities/rights-banking/online-banking.html. Support shared preparation without implying that another person should know or hold someone’s passwords.
Canadian Investment Regulatory Organization, “Why You Should Consider Appointing a Trusted Contact Person”, and U.S. Securities and Exchange Commission, “Why You Should Consider Adding a Trusted Contact to Your Account — Updated Investor Bulletin”, updated 25 August 2025. URLs: https://www.ciro.ca/office-investor/avoiding-fraud-and-protecting-your-investments/why-you-should-consider-appointing-trusted-contact-person and https://www.investor.gov/introduction-investing/general-resources/news-alerts/alerts-bulletins/investor-bulletins-trusted-contact. Explain Canadian and U.S. trusted-contact arrangements. A trusted contact is not automatically an attorney, account owner or trading authority.
U.S. Federal Trade Commission, “How To Avoid a Scam”, July 2023. URL: https://consumer.ftc.gov/articles/how-avoid-scam. Supports a simple family pause-and-verify routine.
National Institute of Standards and Technology, NIST SP 800-63B-4: Digital Identity Guidelines — Authentication and Authenticator Management, 2025. URL: https://pages.nist.gov/800-63-4/sp800-63b.html. Provides technical grounding for authentication and recovery planning; it does not establish that a particular consumer service follows the guidance.
Greg Weir, Tech Passport public source-code repository, main repository identity observed as `aaad6773315f0099e749b81ab9fc72272732b217` on 10 September 2026, and deployed Tech Passport site, observed returning an HTTP 200 response on the same date. URLs: https://github.com/gregweir/tech-passport and https://techpassport.tartanleaf.com/. Support the limited statement that a public repository and responding site were observed. They do not establish deployment-to-repository identity, internal data handling, offline behaviour, browser coverage, security, privacy, accessibility conformance or suitability for a particular reader.

Chapter 16: Make Riskier Tasks Safer

Financial Consumer Agency of Canada, “Online banking: know your rights and responsibilities”, modified 15 October 2025, and “Credit card fraud”, modified 1 December 2025. URLs: https://www.canada.ca/en/financial-consumer-agency/services/rights-responsibilities/rights-banking/online-banking.html and https://www.canada.ca/en/financial-consumer-agency/services/credit-fraud.html. Support Canadian payment, statement-review and reporting guidance.
Office of Consumer Affairs, “Online shopping”, modified 31 March 2022, and Competition Bureau Canada, “Service-related scams”, modified 19 January 2022. URLs: https://ised-isde.canada.ca/site/office-consumer-affairs/en/connected-consumer/online-shopping and https://competition-bureau.canada.ca/en/fraud-and-scams/tips-and-advice/service-related-scams. Support Canadian online-shopping and service-scam warning signs.
Get Cyber Safe, “Public Wi-Fi”, modified 27 October 2021, and Government of Canada, “Cyber security while travelling”, modified 2 October 2025. URLs: https://www.getcybersafe.gc.ca/en/secure-your-connections/public-wi-fi and https://travel.gc.ca/travelling/health-safety/cyber-safe. Support Canadian public-network and travel preparation.
U.S. Federal Trade Commission, “Buying From an Online Marketplace”, November 2024, and “Avoid Scams When You Travel”, September 2025. URLs: https://consumer.ftc.gov/articles/buying-online-marketplace and https://consumer.ftc.gov/articles/avoid-scams-when-you-travel. Support U.S. marketplace and travel-scam guidance.
Microsoft, “How to install programs from online sources on Windows”, and Apple, “Open apps safely on your Mac”, published 1 June 2026. URLs: https://support.microsoft.com/en-us/windows/apps/how-to-install-programs-from-online-sources-on-windows and https://support.apple.com/en-ie/102445. Support the platform-specific installation cautions. Interface details can change, and the linked regional Apple page may redirect by location.

Chapter 17: The First Hour

Canadian Anti-Fraud Centre, “What to do if you’re a victim of fraud”, modified 16 January 2026 and reverified 11 September 2026, and Financial Consumer Agency of Canada, “Resolving an unauthorized transaction”, modified 2 September 2025 and reverified 11 September 2026. URLs: https://antifraudcentre-centreantifraude.ca/scams-fraudes/victim-victime-eng.htm?wbdisable=true and https://www.canada.ca/en/financial-consumer-agency/services/resolving-unauthorized-transaction.html. Support the Canadian stop-contact, financial-institution and reporting sequence. Recovery rights depend on facts, agreements and law.
U.S. Federal Trade Commission, “What To Do if You Were Scammed”, updated June 2026 and reverified 11 September 2026. URL: https://consumer.ftc.gov/articles/what-do-if-you-were-scammed. Supports the U.S. response sequence and payment-method-specific next steps.
Interac, “Consumer Frequently Asked Questions”. URL: https://www.interac.ca/en/resources/personal-resources/personal-faq/. Provides Canadian Interac e-Transfer context. The reader should use the instructions of their own participating financial institution.
Zelle, “What if the person I am sending money to hasn’t enrolled with Zelle?” and “Report a Fraud or Scam”. URLs: https://www.zelle.com/faq/what-if-person-i-am-sending-money-hasnt-enrolled-zelle and https://www.zelle.com/support/report-scam. Provide U.S. Zelle-specific context. The user’s bank or credit union remains the appropriate source for an actual transaction.
Google, “Secure a hacked or compromised Google Account”; Apple, “If you think your Apple Account has been compromised”, published 5 December 2025; and Microsoft, “What happens if there’s an unusual sign-in to your account”. URLs: https://support.google.com/accounts/answer/6294825?hl=en, https://support.apple.com/en-ca/102560 and https://support.microsoft.com/en-us/accounts-billing/security/what-happens-if-there-s-an-unusual-sign-in-to-your-account. Support provider-specific account recovery. Interfaces and recovery options vary by account and can change.
Microsoft, “Protect yourself from tech support scams”. URL: https://support.microsoft.com/en-us/office/protect-yourself-from-tech-support-scams. Supports the immediate response to unwanted remote access or false support.
Service Canada, “The Social Insurance Number (SIN) Code of Practice”, modified 24 March 2026, and IdentityTheft.gov, “Recovery Steps”. URLs: https://www.canada.ca/en/employment-social-development/services/sin/reports/code-of-practice.html and https://www.identitytheft.gov/Steps. Support Canadian SIN and U.S. identity-theft response boundaries.
U.S. National 911 Program, “Calling 911”. Updated 24 January 2023. URL: https://www.911.gov/calling-911/. Supports the U.S. emergency-services boundary. Readers in Canada should call 911 for an immediate emergency; other locations use their local emergency number.
U.S. Federal Trade Commission, “Have you lost money to a scam? Watch for scammers who say they can help”, published 3 August 2026. URL: https://consumer.ftc.gov/consumer-alerts/2026/08/have-you-lost-money-scam-watch-scammers-who-say-they-can-help. Supports the warning about recovery scams that follow an initial loss.

Chapter 18: Recovering Money, Accounts, and Identity

Canadian Anti-Fraud Centre, “What to do if you’re a victim of fraud”, modified 16 January 2026. URL: https://antifraudcentre-centreantifraude.ca/scams-fraudes/victim-victime-eng.htm. Supports the Canadian reporting and evidence-preservation sequence.
Financial Consumer Agency of Canada, “Resolving an unauthorized transaction”, modified 2 September 2025, and “How to file a complaint with your bank”, modified 15 July 2026. URLs: https://www.canada.ca/en/financial-consumer-agency/services/resolving-unauthorized-transaction.html and https://www.canada.ca/en/financial-consumer-agency/services/complaints/file-complaint-financial-institution.html. Support Canadian transaction disputes and bank complaints. They do not promise reimbursement.
U.S. Federal Trade Commission, “What To Do if You Were Scammed”, updated June 2026, and U.S. Consumer Financial Protection Bureau, “How do I get my money back after I discover an unauthorized transaction or money missing from my bank account?”, modified 31 August 2026. URLs: https://consumer.ftc.gov/articles/what-do-if-you-were-scammed and https://www.consumerfinance.gov/ask-cfpb/how-do-i-get-my-money-back-after-i-discover-an-unauthorized-transaction-or-money-missing-from-my-bank-account-en-1017/. Support U.S. payment recovery and unauthorized-transaction boundaries.
U.S. Consumer Financial Protection Bureau, “Submit a complaint about a financial product or service”. Modified 15 July 2026. URL: https://www.consumerfinance.gov/complaint/. Supports the U.S. financial complaint route; it is not a general police-reporting portal.
Coinbase, “Lock or unlock your compromised account”. URL: https://help.coinbase.com/en/coinbase/privacy-and-security/account-compromised/my-account-was-compromised. Provides one provider-specific example of a compromised crypto account. Readers must follow their own provider’s current instructions.
U.S. Federal Trade Commission, “How To Recover Your Hacked Email or Social Media Account”, and Microsoft, “Protect yourself from tech support scams”. URLs: https://consumer.ftc.gov/articles/how-recover-your-hacked-email-or-social-media-account and https://support.microsoft.com/en-us/office/protect-yourself-from-tech-support-scams. Support account recovery and remote-access response.
Service Canada, “Social Insurance Number fraud and data breach”, modified 13 May 2026. URL: https://www.canada.ca/en/employment-social-development/services/sin/fraud-data-breaches.html. Supports Canadian SIN-related response.
IdentityTheft.gov, “Recovery Steps”, and U.S. Federal Trade Commission, “Credit Freezes and Fraud Alerts”, modified 25 August 2025, and “How To Protect Your Child From Identity Theft”, published 23 October 2024. URLs: https://www.identitytheft.gov/Steps, https://consumer.ftc.gov/articles/credit-freezes-and-fraud-alerts and https://consumer.ftc.gov/articles/how-protect-your-child-identity-theft. Support U.S. adult and child identity-recovery steps.
U.S. Department of Health and Human Services, “Your Medical Records”. Content reviewed 30 May 2025. URL: https://www.hhs.gov/hipaa/for-individuals/medical-records/index.html. Supports the U.S. medical-records boundary; Canadian health-record processes are provincial or territorial and require local verification.
U.S. Consumer Financial Protection Bureau, “Contact us”. Modified 8 September 2026. URL: https://www.consumerfinance.gov/about-us/contact-us/. Provides telephone and TTY/TDD contact information for readers who cannot use the web form.

Chapter 19: Reporting, Learning, and Helping Someone Else

Canadian Anti-Fraud Centre, “What to do if you’re a victim of fraud”, modified 16 January 2026, and Royal Canadian Mounted Police, “Report cybercrime and fraud”, modified 30 October 2025. URLs: https://antifraudcentre-centreantifraude.ca/scams-fraudes/victim-victime-eng.htm and https://rcmp.ca/en/federal-policing/cybercrime/national-cybercrime-coordination-centre/report-cybercrime-and-fraud. Support Canada’s national fraud-reporting routes. Local police remain the appropriate route for immediate danger or local investigative needs.
U.S. Federal Trade Commission, “Did you spot a scam? Here’s what to do next”; IdentityTheft.gov, home page; Federal Bureau of Investigation, “Internet Crime Complaint Center: Frequently Asked Questions”; and USAGov, “Learn where to report a scam”. URLs: https://consumer.ftc.gov/consumer-alerts/2026/08/did-you-spot-scam-heres-what-do-next, https://www.identitytheft.gov/, https://www.ic3.gov/Home/FAQ and https://www.usa.gov/where-report-scams. Distinguish the principal U.S. consumer, identity-theft, internet-crime and routing resources.
U.S. Consumer Financial Protection Bureau, “Learn how the complaint process works”, modified 28 May 2026, and “Submitting a complaint on behalf of a consumer”, modified 15 July 2026. URLs: https://www.consumerfinance.gov/complaint/process/ and https://www.consumerfinance.gov/complaint/submitting-a-complaint-on-behalf-of-a-consumer/. Explain the U.S. financial-product complaint process and the option to help another consumer. These are not substitutes for emergency or police help.
Canadian Anti-Fraud Centre, “Canadian Anti-Fraud Centre impersonation scams”, modified 2 July 2026. URL: https://antifraudcentre-centreantifraude.ca/features-vedette/2026/07/impersonation-arnaqueurs-eng.htm. Supports the warning that even the name of a reporting agency can be impersonated.
U.S. Federal Trade Commission, “Have you lost money to a scam? Watch for scammers who say they can help”, published August 2026, and “Refund Programs: Frequently Asked Questions”. URLs: https://consumer.ftc.gov/consumer-alerts/2026/08/have-you-lost-money-scam-watch-scammers-who-say-they-can-help and https://www.ftc.gov/enforcement/recent-ftc-cases-resulting-refunds/refund-programs-frequently-asked-questions. Support the recovery-scam warning and the boundary that legitimate FTC refunds do not require an advance fee.
U.S. Federal Trade Commission, “If someone you care about paid a scammer, here’s how to help”, published 10 April 2024, and AARP and FINRA Investor Education Foundation, Blame and Shame in the Context of Financial Fraud, June 2022. URLs: https://consumer.ftc.gov/consumer-alerts/2024/04/if-someone-you-care-about-paid-scammer-heres-how-help and https://www.finrafoundation.org/sites/finrafoundation/files/Blame-and-Shame-in-the-Context-of-Financial-Fraud.pdf. Support practical, non-blaming help and the discussion of shame as a barrier to disclosure and reporting.
Canada’s 9-8-8 Suicide Crisis Helpline, “Get Help”, and U.S. 988 Suicide & Crisis Lifeline, “What to Expect”. URLs: https://988.ca/ and https://988lifeline.org/get-help/what-to-expect/. Provide Canada- and U.S.-specific crisis-support routes. If there is immediate danger, call the applicable emergency number.

Appendix D: Lookalike Characters: A Quick Reference

Unicode Consortium, “Unicode Security Mechanisms”, version 17.0.0, Revision 32, dated 4 September 2025, and “confusables.txt”. Data header dated 22 July 2025. Both sources opened 13 September 2026. URLs: https://www.unicode.org/reports/tr39/tr39-32.html and https://www.unicode.org/Public/17.0.0/security/confusables.txt. These sources support the reference table’s character examples and the explanation that visual resemblance depends on the font and display. They do not establish which lookalikes are most common in scams or whether a particular browser or service accepts a name.

Corrections and updates

If you find a broken link, a source that has moved or a factual point that may need review, please use the Tartanleaf contact page. Do not send passwords, verification codes, full account numbers or other sensitive information.