Stage 01 · They find you
Where they got your information, and how to stop the calls
Start here Turn on the call filtering that is already in the phone
Reaching you is somebody’s job. The settings below mean fewer scammers reach you.
What the scammers are doing
Working at scale.
Scam operations are organizations with offices, shifts, scripts, targets and training. The approach that reaches you has been refined on thousands of people first.
Why a scam works here
A first approach shows no sign of being a scam.
Scammers drop any approach that looks wrong, so none of the steps under “what to do” asks you to spot a scam.
Where a scam can be stopped
Here, first.
Settings on your phone and email stop many of these before they reach you, though not all.
Phone, door, mail, email, or someone you already trust
Scammers move to whichever way of reaching you gets answered. Any of these can be the first contact:
- The phone. Landline and cell, calls and texts.
- The door. Roofing and driveway work after a storm, utility inspections, charity collection, a lost delivery. In person, in daylight, with a clipboard.
- The mail. Prize notices, invoices for things never ordered, renewal demands, charity appeals. Physical mail carries authority that email lost years ago.
- Email. Cheapest of all, so it runs constantly in the background.
- Someone you already trust. A friend’s real account, no longer operated by the friend. This is the hardest one to guard against.
More ways they reach you
- Social media and messaging. Advertising, group chats, and comment threads, including on pages that are entirely legitimate.
- Places that are not online at all. A church group, a card game, a fair, a community hall. Somebody turns up, and is pleasant, and comes back.
Being contacted does not mean you did anything wrong. Scammers contact huge numbers of people.
Where your name and number already are
In the cases we have seen, the scammer got your name and number from one of these:
- Breach data. Names, numbers, emails and addresses taken from companies that were themselves attacked, then combined and resold.
- Public records. Land titles, voter lists, professional registries, court filings. All lawful to hold, all searchable.
- Obituaries. A death notice gives who has died, who survives them, and their city. Scammers read them, because a death often means money is about to move.
- Purchased marketing lists. Bought and sold legally, every day.
More places your number comes from
- Ten random digits. A phone number is not a secret. Dialling every possible one is cheap enough to do continuously.
- Earlier lists. Anyone who has responded to a previous approach is worth more, and gets sold on.
What to do, in the order we would start
Start here
Most effect for the least effort, and each can be done in an afternoon.
Turn on the call filtering that is already in the phone
- iPhone · Settings → Apps → Phone → Screen Unknown Callers → Silence
- Google Pixel · Phone → More → Settings → Spam and Call Screen
- Samsung Galaxy · Phone → More options → Settings → Block numbers → Block calls from unknown numbers
What it does. On an iPhone, numbers not in your contacts go straight to voicemail. On a Pixel, Call Screen answers first and asks who is calling. Apple describes one iPhone path; on older software the setting may sit elsewhere in Settings.
On a Samsung
On a Samsung. Samsung says it blocks calls from “unknown or unspecified numbers”. To see what that covers, have someone not in your contacts call you.
Who still rings through. Anyone saved in your contacts, so save the numbers you rely on before you turn it on.
Its limits, and when it turns itself off
What it does not do. It does nothing about a call that shows a number you recognize. Bank and police impersonators work that way.
Who else goes to voicemail. Real callers you have not saved, like a pharmacy or a clinic, so check your messages more often.
When it switches itself off. On an iPhone, for 24 hours after you dial 911, so that anyone calling back can reach you. It also does not apply while you are roaming.
On a landline, get a phone with a block button
What it does. Several handset makers sell phones with a single button that blocks the caller you just heard. Small boxes that sit between the wall jack and the phone do the same, though the cheapest box costs more than the cheapest phone.
What it can and cannot stop
What it helps with. Sales callers who ring again from the same number. Scam calls often come from a new number each time.
What it does not do. Stop a first call from a new number.
Why a landline needs it. Phone companies now check that caller ID is not forged, but the check does not reach calls on the old copper landline network.
Ask the phone company what screening they include
What it does. Some screening is already running on your line whether you asked for it or not.
What your phone company already does
What the regulator already requires. The Canadian Radio-television and Telecommunications Commission (CRTC) requires Canadian providers to block certain obviously illegitimate calls at the network. Since 2021 providers have also had to verify caller ID on internet-based calls.
What is already on. On a mobile phone, Bell and Rogers label or block suspected spam calls automatically, at no charge. On a home phone it is different: the useful screening is usually an add-on you have to ask for, and some of it costs money.
The verified mark. On a newer phone you may see an indicator that a caller’s number has been verified. It means the number was not forged. It does not mean the caller is honest.
What the mark does not prove. A scammer calling from their own real number gets the mark too. A missing mark proves nothing either, since the check does not reach every landline call.
Keep two email addresses
What it does. One address for banking, government and family. A second for shopping, newsletters, contests, and anything that wants an address before it will give you something. The second address is the one most likely to end up in breach data and on sold lists.
What it does not do. Take an address back off the lists it is already on.
Worth doing
Real effect, but narrower, slower, or a habit rather than a setting.
Do not click unsubscribe on mail from someone you have never heard of
What it does. Unsubscribing can confirm that a real person reads that address, which makes it worth more to whoever sends the next one. The link itself is also a common way to reach a page asking for a password.
What to do instead. Delete the message, or mark it as junk.
Unsubscribing from a business you actually signed up with is fine.
Register on the National Do Not Call List
What it does. Most telemarketers have to stop calling. Charities, political parties, survey firms and businesses you bought from in the last 18 months still can. It does not stop scammers.
Why do it anyway. With fewer sales calls, an unexpected call is easier to notice.
How to register. On the National Do Not Call List website, or call 1-866-580-3625 with the number you want registered.
Take yourself off people-search sites
What it does. Removes one way people find your address, your age, and the names of relatives.
What it does not do. It does not touch breach data, which is the bigger source of your details by far, and which nobody can recall. Spokeo, one people-search site, says an opt-out leaves the public records a listing was built from where they are.
Commonly suggested, limited effect
Not wrong, but each does much less than it sounds. Do not rely on any of them alone.
Blocking numbers one at a time
Blocking one number at a time does little, because a scammer chooses the number shown when dialling, and changes it constantly.
A “no soliciting” sticker on the door
A sticker only turns away honest callers, who are not the problem.
Call-blocking apps made by other companies
Some work well. Some upload your contact list, so read which permissions an app asks for before you install it.
Writing an obituary
A death notice is a public, permanent document. It names the person who died, the relatives left behind, where the family lives, and what hour they will all be somewhere else.
When writing one, you can leave out any of the details below. Above all, we suggest not printing all three together:
- The surviving relatives’ full names.
- The home address.
- The exact time and place of the service.
At least one funeral provider offers to help a family decide what to include, so ask the one you are using. Deciding what to include is easier before the worst week than during it.
The number on your screen was chosen by the person calling you.
Caller ID displays whatever the caller tells it to display. It can show a real bank’s real published number, or a police detachment’s, or your own. It is not evidence of anything. The system was built before anyone had a reason to lie to it.
“How did they get my number?”
People often ask that first. The question usually has half a dozen answers, most of them lawful, and knowing them rarely changes what to do next.
How long it takes, from first contact to the money
The difference between kinds of scam that matters most is how fast the money can leave after the first approach.
Some scams we have seen take twenty minutes from the first ring to the money leaving, and some take two years. We have grouped them below by that time, not by the story told.
Minutes to an hour
Begins and ends inside a single phone call, or one sitting at the computer.
- A grandchild in trouble. A call, often very early or very late, sometimes a day after a silent call nobody thought about. An accident, an arrest, a lawyer, a payment, and a reason not to tell the rest of the family.
- Your bank’s fraud department. The account has been compromised and the money has to be moved somewhere safe tonight. The display shows the bank’s own published number.
- The police, or an investigator. The same call as the bank one, from someone posing as police or an investigator. Sometimes both calls come, each confirming the other.
More calls like these
- Your computer is infected. A pop-up that will not close, or a call about a computer nobody has looked at. It ends with a stranger operating the screen.
- Taxes owed, or a benefit waiting. A government department, by phone, text or email, carrying either a threat or a payment.
Days
Long enough to sleep on. Short enough that nobody does.
- Work at the door. Roofing, driveway, chimney, a utility inspection, often after a storm. The job starts, the price grows, and payment is wanted in cash or by bank draft before it is finished.
Weeks to months
Long enough to check everything, and everything checks out.
- An investment that keeps doing well. Found through an advertisement, a messaging group, or a friend’s account that is no longer run by the friend. The statements are real documents. Small withdrawals are paid out on request, which is what makes the large deposit feel safe.
Months to years
Nothing is asked for a long time, on purpose.
- Someone who has become important. Met on a dating app, or somewhere nobody thinks of as one: a game, a church group, a comment thread. The first request is small, and it comes with a reason.
Afterwards
This kind only reaches people who have already lost money.
- Help getting the money back. Contact weeks or months later, quoting real details of what happened, because those details were sold on. A recovery fee, a retainer, a government fund that does not exist.
How fast it moves matters more than what it is called
When money can leave inside an hour, there is no time to phone a daughter and talk it over. What helps is a rule settled beforehand, on an ordinary day, such as calling one named person before any money moves.
When a scam takes weeks or months, there is time to talk, but nothing will look wrong, because the scammers spend those weeks making it look right. Checking fails on the slow scams. In our view, talking it over with someone works better.
Organizations you can contact, and what each one does
These four national organizations are free, and each can be reached by phone as well as online. Most keep office hours.
- Canadian Anti-Fraud Centre. Where fraud and attempted fraud get reported. It does not investigate your case and it does not return money.
- National Do Not Call List. Registration is permanent. It stops lawful Canadian telemarketers, not scammers.
- Competition Bureau of Canada. Deceptive marketing: prize notices, false claims, the letter saying money has been won.
- Canada Post, Consumers’ Choice. Stops unaddressed advertising mail. It does not stop mail with a name on it.
the Canadian Anti-Fraud Centre where scams get reported nationally, which is not the same as being investigated
It gathers reports from across the country so that patterns can be seen. Your own case belongs to the local police force, and the Centre does not work it. It cannot move money either.
Numbers for the Do Not Call List and Canada Post are under You want fewer sales calls and less junk mail. The Canadian Anti-Fraud Centre’s number is under Someone tried to scam you, and you didn’t lose anything. Step by step: I want to be harder to scam.
Firms that remove your information for you
What they do. They write on your behalf to the people-search sites, and to the companies that collect and sell personal details, asking for you to be taken off, and keep repeating the requests.
What you pay for, and what to check first
What you are paying for. The same work as doing it by hand, kept up over time, which is the part most people stop doing.
What they do not do. Remove data taken in breaches. Once it is out, nobody can take it back. No firm covers every broker, and the coverage lists differ.
Before you pay. You are handing a company your name, address, date of birth and previous addresses in order to have them removed elsewhere. Three things to check first:
- Ask what they keep, for how long, and how to close the account afterwards.
- Three such firms are DeleteMe, Optery and Incogni. We have not tested any of them, and none of them pays us.
- Compare the firms’ own coverage lists, not ranking articles.