OTTAWA — If your boss’s name appears on your phone, don’t assume that’s who is calling you.
In a rare joint statement issued Monday, the Canadian Anti-Fraud Centre (CAFC) and the Canadian Centre for Cyber Security (CCCS), part of Canada’s cyberdefence agency, said that scammers are now using artificial intelligence to impersonate senior government officials by phone or text.
Spoofing government officials’ phone numbers or voices, they contact other public sector leaders or C-suite business leaders with fake urgent requests for money transfers or asking them to open a malicious link.
The goal is to steal money, sensitive information or install malware on organizations’ computer networks, says the CCCS.
The scam is yet another way that fraudsters are harnessing AI to impersonate government officials and organizations to make their schemes more believable.
In one case, a Canadian individual received a fraudulent message purporting to come from a U.S. government official requesting a “large transfer of money under the pretence of an urgent government-related matter,” said spokesperson Cyber Centre spokesperson Janny Bender Asselin.
Asselin declined to say who the recipient was, if they were a government or business executive or if the money was ever transferred to the scammer.
Neither CCCS nor CAFC responded to questions about which government officials or C-suite executives are either being impersonated or targeted by this new malicious cyber scam.
But the advisory is clear: if you receive a message or call from someone purporting to be a high-ranking government official or even your employer’s CEO demanding you do something urgent and unusual, it could be a scam. Even if the voice sounds like them.
The warning says the latest scam appears linked to an ongoing campaign in the U.S. that was flagged by the Federal Bureau of Investigations (FBI) last month.
l, scammers have been impersonating “senior US officials” and contacting other current or former top federal and state American government workers. They then purport to send a link to move the conversation to another messaging app, but the URL actually infects their device with malware.
“The malicious actors have sent text messages and AI-generated voice messages — techniques known as smishing and vishing, respectively — that claim to come from a senior US official in an effort to establish rapport before gaining access to personal accounts,” the FBI warned.
“If you receive a message claiming to be from a senior US official, do not assume it is authentic.”
For the head of the Canadian Cyber Threat Exchange, Jennifer Quaid, these types of scams have become so prevalent that she now suggests to private sector workers that they shouldn’t always believe that it’s their boss that’s calling when the number appears on their phones.
“Never assume it’s your boss,” she told National Post.
“I would give a CEO, a CFO and my 21-year-old daughter exactly the same advice: stop and think about it. Take a minute to think about what the request is, and then say, ‘I will call you back’ and reach out to that person using another known channel of communication,” she added.
“If your boss is serious about wanting you to transfer $20 million, I don’t think they’re going to object to your saying, ‘I will call you right back’.”
Just in the first three months of 2025, the Anti-Fraud Centre says it has received nearly 13,000 reports of fraud generating over $165 million in losses for 9,092 victims. But as always, that is only the tip of the iceberg as the vast majority of victims don’t report the crime to authorities.
Both the Cyber Centre and Quaid say AI has tremendously boosted criminals’ ability to make their scams more believable. But Quaid also believes that threat actors not being constrained by legal AI guardrails has allowed them to harness AI faster and more effectively than businesses trying to defend themselves.
“They’re not using it with rules. We have rules, and I want to be very clear, rules are a very good thing,” Quaid said of scammers. “But they are operating in a criminal environment without rules, without regard to due process and without regard to privacy, and that’s why they’re able to do more with some of these tools than we are.”
In recent weeks, government agencies have increasingly warned Canadians that scammers are spoofing their phone numbers to appear legitimate. Spoofing allows fraudsters display a fake number on a phone’s caller ID.
Even organizations like the Communications Security Establishment, the country’s cyberdefence agency, have not been spared.
“If you receive a suspicious call from our media number, please know it is not a legitimate call,”
the agency wrote on social media last week
.
“Spoofing lets scammers display a legitimate number, even though they have no connection to the organization. This isn’t always impersonation, but it’s still misleading and can create confusion.”
National Post
cnardi@postmedia.com
Our website is the place for the latest breaking news, exclusive scoops, longreads and provocative commentary. Please bookmark nationalpost.com and sign up for our daily newsletter, Posted, here.