A phone with a blank message and pause symbol sits beside an amber dotted path ending in a cross; a teal arrow passes a handset and generic browser window toward five empty circles.

A message can be well written, a website can look professional, and a caller can sound familiar. None of that settles who is on the other end.

AI makes messages, images, videos and voices easier to imitate. The Canadian Anti-Fraud Centre says old warning signs may not show up at all. A polished approach can still be a fraudulent one.

The answer is not to become a part-time deepfake examiner. It is to change the job. Instead of asking, “Can I prove this looks synthetic?” ask, “Can I confirm this exact request through a route I found myself?”

That distinction matters when a message, call, video or voice note asks for money, account details, a password, a one-time code, a link click, a download or a change to payment instructions. In the first six months of 2026, Canadians reported about $351 million in fraud losses to the Canadian Anti-Fraud Centre. The centre estimates that only 5% to 10% of fraud is reported. These are reported losses across fraud types, not AI-only scams—a reason to make verification routine.

Stop treating polish as proof

The familiar “watch for typos” advice has not become useless; it has become incomplete. A strange address, a blurry logo or a rushed demand can still be a warning. But their absence is not a clearance badge.

Fraudsters lean on urgency, authority, fear and familiarity because those things hurry a decision. They may impersonate a bank, government office, service provider, colleague, friend or family member. Caller ID can be manipulated. A voice can sound right. A message can include details that feel specific. The Canadian Anti-Fraud Centre’s practical point is more durable than any list of visual tells: something that appears real is not proof that it is real.

There is another trap here: asking a chatbot or detector to tell you whether suspicious content is authentic. Its verdict alone is not independent confirmation of the sender or the requested action. B.C.’s public guidance on generative-AI outputs makes the broader point: plausible output still needs checking against primary, authoritative sources. A tool can help you understand a message. Its assessment of that message does not replace confirming the request through a route you found yourself.

So keep the decision small and concrete. Do not try to diagnose the technology. Verify the action.

The Two-Channel Check Card

Use this when a message, call, video or voice note asks you to act. This five-step card is this article’s synthesis of the official guidance in the Sources section, not an official named protocol or a guarantee.

1. Pause the in-band action

Do not click the supplied link, open the attachment, reply in the existing thread, call the number provided, or send a code to “verify” the request. Never provide a password, PIN or one-time verification code to an unsolicited caller, message sender or other contact. The original contact is the channel that needs checking.

2. Name the exact request

Write down what it wants: money, credentials, a one-time code, a download, personal information, or changed payment instructions. Specificity helps. “Is this real?” is harder to verify than “Did you ask me to send this amount to this destination today?”

3. Find a second route yourself

Use the organization’s official website or app, a phone number on a statement or card already in your possession, a saved contact you trust, or an established directory. Do not use contact details supplied in the message.

4. Verify the specific action

Ask whether the exact request is real: the amount, destination, account-security issue, payment change or proposed download. “Yes, we sometimes contact customers” is not confirmation of this request. Confirming that an organization is real does not authorize sending a password, PIN or one-time code back through the original contact.

5. Choose the next step only after confirmation

If the request is not confirmed, stop engaging through the original contact. If a service you opened yourself asks for a code as part of its own sign-in or authentication flow, follow that official flow; do not share the code with a caller or message sender. If money, account access or credentials may be involved, follow current instructions from the institution or organization you reached independently and use the official Canadian reporting destination where appropriate.

The card works across email, text, phone calls, websites, voice notes and video. It does not promise that every second channel is infallible, and it is not a fraud investigation method. It is a way to put a little space between an unexpected demand and a consequential action. Glamorous? Not especially. Useful when someone says you have 10 minutes to “secure” an account? Very much so.

What counts as a second channel?

A second channel is not a different button inside the same suspicious message. It is a route you control or locate independently.

For a bank, that might mean opening the official app yourself or calling the number on the back of a card. For a delivery notice, it might mean typing the known official site into a browser rather than following the text link. For a person who suddenly needs money from a new number, it could mean calling the number you already have for them. For a business payment change, it means checking with a known contact through an established method before sending anything.

This approach also avoids an awkward false choice: either trust the polished message or prove that it is AI-made. You do not need to win that argument. You need to confirm the request before it changes your money, account or information.

Keep the rule proportionate

Not every unexpected message needs a full incident response. A generic marketing email can be deleted or ignored. The check card is for requests that could cause harm if acted on: a payment, a credential, a code, a download, a sensitive detail or a change in instructions.

If you think an account or payment may already be involved, act through the organization’s official route, not the sender’s directions. The Anti-Fraud Centre advises people targeted by cybercrime or fraud to report it to local police and to the Canadian reporting service. For an exact incident, follow the current guidance of the affected institution and the official fraud and cybercrime reporting service; this is a practical verification habit, not financial, legal or incident-response advice.

AI may make a fraud attempt more fluent, more personalized or more visually convincing. It does not make independent confirmation less useful. When a message asks you to act, the question is not whether it passes a vibe check. The question is whether the request survives a second channel.

Sources