By John O’Brien, National Security Officer, Microsoft Canada
For this blog post, Get Cyber Safe has partnered with Microsoft Canada, who, like us, understands how important cyber security is to businesses as well as individuals. This blog represents their perspective and we thank them for being a dedicated partner in the cyber security of Canadians.
Scams have always relied on catching us off guard. An urgent email from your bank. A text about a package you don’t remember ordering. A frantic call from someone you know asking for money or information.
What’s changing now is how convincing those messages can be.
Artificial intelligence (AI) can help cybercriminals create more convincing content and make traditional attacks faster and more effective. The tactics look familiar; the speed and sophistication do not.
The good news is that staying safer online doesn’t mean you have to become a cyber security expert. A few simple actions, repeated often, can become habits that help protect you.
Here are four habits you can start using today.
1. Pause and assess
Scams often come with a ticking clock. Act now. Your account is at risk. Send the money immediately. Click this link before it is too late.
That sense of urgency has a purpose. It’s designed to get you to react before you have time to think.
AI can make the message itself more convincing, but you can still control what happens next. If a request is unexpected, especially if it involves money, passwords, verification codes or personal information, pause.
Ask yourself a few simple questions. Was I expecting this? Does this request make sense? Why am I being asked to act right now?
Taking a moment is like putting a speed bump between the message and your response. It gives you time to spot something that doesn’t add up.
And remember: falling for a convincing message is not simply a matter of being careless. Even the most security-conscious users can be tricked by convincing phishing or social engineering attempts; usually when they’re tired or distracted.
That is why the next habit matters so much.
2. Verify before you act
Imagine you get a text from your bank saying there is suspicious activity on your account. There is a phone number to call and a link to click.
Instead of using either one, go directly to the source.
Call the number on the back of your bank card or type the bank’s website into your browser yourself.
If a family member or colleague sends an unusual request, contact them another way, like a phone call to the number you have in your contacts, to make sure it is really them.
When in doubt, check through a channel you already know and trust.
3. Think before you click or share
Links are part of everyday life online. We use them to pay bills, track packages, sign into accounts and share information.
That familiarity is exactly what can make a malicious link easy to miss. We have been trained to click them, don’t feel bad about it.
Before opening an unexpected link or attachment, take a closer look at the message around it. Be especially careful when someone is asking you to sign in, download something or provide sensitive information.
The same goes for information you share. Passwords and verification codes are like keys to your digital home. You wouldn’t give a stranger the keys to your house, treat your digital home that same way.
But staying safe should not depend on spotting every suspicious message perfectly. The goal should be to “cut down the places where one slip leads to a breach.”
In other words, good cyber security should give you a safety net. Ensure that your devices are always up to date and that you have an active anti-malware solution such as Microsoft Defender installed. The goal isn’t only to change our human behaviour; it’s to build systems that remove opportunities for error and make the secure choice the easy choice.
4. Make security routine
Good judgment can help you avoid a scam. Strong cyber security habits can help protect you if one slips through.
There will always be another scam to learn about, another suspicious message to watch for or another security setting you could change. Trying to tackle everything at once can feel overwhelming.
So don’t start with everything.
Start with multi-factor authentication (MFA) on important accounts. MFA asks for another form of verification in addition to your password. That means a stolen password alone may not be enough for someone to access your account.
Phishing-resistant forms of MFA, such as passkeys, are designed to protect you even if someone tries to trick you into sharing your sign-in information. Unlike methods that rely on passwords or verification codes that can be stolen, they provide a stronger layer of protection against phishing and other attempts to take over your account.
You can also keep your devices and apps up to date. Those update notifications may be easy to put off, but updates often contain security fixes that help protect against known weaknesses.
Think of these protections like layers of clothing on a cold Canadian morning. One layer helps. Several working together can do a much better job.
The more often you pause, verify and protect your accounts, the more routine those actions become. Just like locking the door when you leave home, eventually you may barely have to think about doing them.
Make the safer choice the easier choice
There is a lot Canadians can do to protect themselves, but cyber security should not rest entirely on individuals.
People get distracted. We get busy. We click things too quickly. And sometimes a fake is simply very convincing.
Technology needs to account for that too.
Systems should be designed to protect people from themselves. That can mean stronger default settings, safer ways to sign in and fewer opportunities for a single wrong click to cause serious harm.
The goal isn’t to make people perfect, the goal is to build systems that are harder to misuse.
For Canadians, that means good cyber security is a combination of the tools protecting you and the habits you practice every day.
You don’t need to spot every scam, and you don’t need to understand every new cyber threat.
Start with the basics: pause, verify, think before you click, strengthen your defences and make those actions a habit.
When in doubt, ask someone else. You’ve got time.