Canadians Say They Can Spot Scams. Their Habits Say Otherwise.
As Cyber Security Awareness Month wraps up, two national surveys show a wide gap between how safe Canadians feel online and how they actually behave.
Confidence versus practice
An Equifax Canada survey conducted by Leger found that 83 per cent of Canadians are confident they can tell real messages from scams. Yet only 58 per cent use multi-factor authentication on many of their financial and social media accounts, and just half use unique passwords for important accounts. More than one in five (22 per cent) reuse the same two or three passwords across several accounts.
Exposure is widespread. Nearly two-thirds of respondents saw at least one type of fraudulent message in the past year. The most common were messages impersonating Canadian banks or government agencies (37 per cent) and fake alerts about someone accessing their accounts (36 per cent). Younger Canadians were the most relaxed: 20 per cent of those aged 18 to 34 said they would ignore a notice that their data had been compromised unless they saw suspicious activity, compared with 11 per cent of those 55 and older.
Breaches cost customers
A separate report from Bell Cyber found that 77 per cent of Canadians say they were personally targeted by a cyberattack in the past year. Nearly four in 10 (38 per cent) have avoided a company because of cybersecurity concerns, and 57 per cent say they would likely leave a company after a breach involving their personal information.
AI is adding to the pressure. Three-quarters of respondents believe AI is helping criminals produce convincing scams faster than organizations can stop them, and nearly half say they received a message they suspected was made or altered with AI.
The training gap
Only 35 per cent of Canadian employees told Bell Cyber they have received adequate cybersecurity training, and that falls to 22 per cent at small businesses. That gap matters this month in particular. The help desk vishing campaign behind recent law firm breaches works by fooling people, not by breaking software.
