Scams · October 11, 2026 · 4 min read

How scammers use leaked data to make phishing personal, and how to spot it

A message that knows your name, your address and what you bought feels real. Here’s how breach data turns generic scams into personal ones, and the tells that still give them away.

BBrody · Frame

A grid of faint envelopes on black with one gap; a single steel-outlined envelope sits apart inside bracket corners, linked back by a dotted line.

The old advice for spotting phishing was to look for bad spelling and a generic “Dear customer.” That advice is getting less useful. Breaches put real names, addresses, phone numbers and order histories into circulation, and that is exactly what makes a scam message feel like it’s really for you.

From generic to personal

The Canadian Centre for Cyber Security describes spear phishing as a personalized attack that includes details about the target, such as their interests, recent online activities or purchases. Those details used to take effort to collect. Now a single breach can supply them in bulk.

Take a typical retail breach. The Canadian Tire breach, for example, exposed names, email addresses, phone numbers and home addresses, with partial card details for some accounts. None of that lets anyone sign in or spend money. Together, it lets a scammer write:

a text that uses your first name and mentions a store you really use
an email about a “refund” for a card ending in the right digits
a call from your “bank’s fraud team” that already knows your address

The Cyber Centre also warns that generative AI makes messages more realistic and helps attackers gather and analyze public information about targets. Spelling mistakes and a robotic tone are no longer reliable tells.

It’s working

In the first six months of 2026, Canadians reported about $57.7 million lost to spear phishing, according to the Canadian Anti-Fraud Centre, compared with more than $68 million in all of 2025. Many of those cases target businesses, impersonating executives or suppliers to redirect payments. The CAFC also highlights bank investigator fraud, in which callers pose as your bank or the police and claim your account is compromised: about $28.6 million reported lost in the same six months. The CAFC estimates that only 5% to 10% of fraud is reported at all.

The tells that still work

Personal details prove only that someone has your details. Look at what the message asks you to do instead:

It’s urgent. A deadline, a locked account, a parcel about to be returned, a charge about to go through. Pressure is the point.
It wants a code, a password or remote access. The CAFC is clear that it and the police will never ask for your banking information, passwords or verification codes, or for remote access to your device. Treat any caller who does as a scam, whoever they say they are.
It wants money moved. A “safe account,” a fee to release a refund, payment in gift cards or cryptocurrency.
It gives you the way to reply. A link, a QR code, a phone number in the message. Those are the parts the scammer controls.
It asks you to keep quiet. The CAFC lists being told to keep an “investigation” confidential as one of the signs of bank investigator fraud.

What to do instead

Use a channel you find yourself. Hang up and call the number on the back of your card. Type the store’s address into your browser. Open the app directly. This one habit defeats most versions of the scam.
Slow down. The CAFC’s first piece of advice is to independently verify unexpected requests before acting. Talk to someone you trust if you feel pressured.
Make stolen details less useful. Use passkeys or an authenticator app on important accounts, so a phished password or code isn’t enough on its own. Our guide to locking down your Google and Apple accounts is a good place to start.
Report it. If you’ve lost money or shared banking details, call your bank first. Then report it to your local police and the Canadian Anti-Fraud Centre.

Sources

Canadian Centre for Cyber Security, Don’t take the bait: Recognize and avoid phishing attacks (ITSAP.00.101), November 2025
Canadian Anti-Fraud Centre, Fraud Trends – First 6 Months of 2026, August 2026
Canadian Anti-Fraud Centre, Canadian Anti-Fraud Centre Impersonation, July 2026
Canadian Tire Corporation, Customer Information: October 2025 Cyber Incident

New posts, by email.

About once a month. Plain-language privacy notes, nothing else. I never share your address.

From generic to personal

a text that uses your first name and mentions a store you really use

an email about a “refund” for a card ending in the right digits

a call from your “bank’s fraud team” that already knows your address

It’s working

The tells that still work

Personal details prove only that someone has your details. Look at what the message asks you to do instead:

It’s urgent. A deadline, a locked account, a parcel about to be returned, a charge about to go through. Pressure is the point.

It wants a code, a password or remote access. The CAFC is clear that it and the police will never ask for your banking information, passwords or verification codes, or for remote access to your device. Treat any caller who does as a scam, whoever they say they are.

It wants money moved. A “safe account,” a fee to release a refund, payment in gift cards or cryptocurrency.

It gives you the way to reply. A link, a QR code, a phone number in the message. Those are the parts the scammer controls.

It asks you to keep quiet. The CAFC lists being told to keep an “investigation” confidential as one of the signs of bank investigator fraud.

What to do instead

Use a channel you find yourself. Hang up and call the number on the back of your card. Type the store’s address into your browser. Open the app directly. This one habit defeats most versions of the scam.

Slow down. The CAFC’s first piece of advice is to independently verify unexpected requests before acting. Talk to someone you trust if you feel pressured.

Make stolen details less useful. Use passkeys or an authenticator app on important accounts, so a phished password or code isn’t enough on its own. Our guide to locking down your Google and Apple accounts is a good place to start.

Report it. If you’ve lost money or shared banking details, call your bank first. Then report it to your local police and the Canadian Anti-Fraud Centre.