Scam texts in Canada: how to spot them, report them to 7726, and what to do after a click

What fake parcel, toll, CRA and bank texts look like, why you should not reply even with STOP, how forwarding to 7726 works, and the steps to take if you tapped the link.

Editor: Andrew Pickett · Last reviewed 2026-10-24 · Editorial guidelines. Written for readers in Canada.

A text says a parcel is on hold, a highway toll is unpaid, a tax refund is waiting or your bank account is locked, and there is a link. Canada Post defines this, smishing, as a variation of phishing: a text with a link to a fraudulent website. The Canadian Anti-Fraud Centre (CAFC) open data counts 3,081 fraud reports in 2024 whose first contact was a text message, alongside 9,598 that began with a call. This guide covers how to recognize these texts, what the organizations they imitate say about them, what not to do, how to report them, and the steps if you already tapped.

The five stories, and what the real organization says

Parcel and delivery

Canada Post’s own example is a text saying a delivery is on hold because of unpaid shipping fees, with a link to pay. It says it will never text you for credit card or banking information, account login details or payments for deliveries or tracking. Its genuine texts come only from the short codes 272727 or 55555, and only if you signed up for them. When it misses you, it leaves a notice card at your door or in your mailbox. Tracking on the Canada Post website is, it says, the safest way to see whether any fees are due.

Tolls and fines

The Competition Bureau quotes a typical message: “Unpaid highway toll detected on your vehicle. Pay now to avoid fines.” The CAFC says genuine toll agencies do not demand immediate payment by text. 407 ETR in Ontario said it received nearly 12,000 reports of scam texts in 2024 and took down over 470 malicious website domains, and says it will never ask for passwords, PINs or card details in a text or email. The City of Calgary, citing police, says neither the City nor the Government of Alberta will text to request payment of fines.

The tax agency

The CRA says it uses text messages only for multi-factor authentication if you enrolled with the telephone option, and will not send refunds or payments by text. Its scam list includes texts that ask you to reply “Y” or “HELP.” See CRA and Service Canada scam calls.

Your bank

The Canadian Centre for Cyber Security warns that if criminals spoof your bank’s real short code, their messages land in the same conversation thread as the genuine ones, which makes them hard to tell apart. Its advice is to call the number on the back of your debit or credit card, not the number in the text.

The “wrong number”

A friendly message to the wrong person is a known opening for investment fraud. A CAFC release warns about unsolicited messages from strangers, including “wrong number” texts, that lead to prolonged exchanges and move to private messaging apps.

Red flags

• An unexpected message from an unknown number that asks for personal information or a click, as the Competition Bureau lists.
• Urgency, such as a locked account or a fine that grows if you wait.
• Shortened or slightly altered web addresses, and requests for passwords, PINs or SINs, per the Cyber Centre.
• A sender that claims to be a trusted business or bank. Even a sender name that looks right proves nothing, because sender details can be spoofed.

Do not count on typos to protect you. A CAFC spokesperson told CBC Newsin July 2025 that spelling mistakes used to be a standard warning and “it’s not always the case now.”

Do not reply, not even “STOP”

The Competition Bureau says to ignore texts even if they ask you to reply with “STOP” or “NO.” Get Cyber Safe explains why: if you reply, the scammer knows your number is active and may send more. Canada Post gives the same advice. Do not tap links either, and type the organization’s address into your browser yourself.

This differs from the rule for legitimate marketing. Under Canada’s anti-spam law (CASL), a business that sends commercial texts needs your consent, must identify itself and must provide an unsubscribe mechanism, and the CRTC gives replying “STOP” as an example. Some carrier pages also list “STOP” for unwanted texts. For anything you suspect is a scam, follow the federal advice above and do not reply.

Forward it to 7726

7726 spells SPAM. Forwarding a suspicious text to it alerts your cellular provider, which can investigate, and Get Cyber Safe says it is free and does not count against your data or messaging plan. Rogers says it uses the reports to improve its filters for all users, and that blocking is based on message content rather than the sender’s number, since numbers change often.

• Android: open the conversation without tapping links, press and hold the message, choose Forward, enter 7726 and send.
• iPhone: press and hold the message, choose More, tap the arrow, enter 7726 and send.
• The Cyber Centre also lists your messaging app’s own spam reporting function as an option. TELUS asks for the word SPAM in the body of the forwarded message.

7726 reaches your carrier, not the police. Rogers, Vidéotron, Freedom, TELUS and Bell each publish a page about it. Freedom Mobile says it cannot block individual texts itself.

Where else to report

• The Spam Reporting Centretakes reports of spam texts and emails by online form. It says it receives about 5,000 complaints a week and shares them with the CRTC, the Competition Bureau and the Office of the Privacy Commissioner. Include the number that received the text, the sender’s number or name, and the exact date and time, as the CRTC suggests.
• Report scams to the CAFC at reportcyberandfraud.canada.ca or 1-888-495-8501, even if you lost nothing. Phone calls go elsewhere: the Spam Reporting Centre says complaints about unsolicited calls belong with the CRTC’s National Do Not Call List.

The CAFC’s own open data suggests how common this is. From January to September 2025, 1,851 reports began with a text, against 2,246 in the same months of 2024. A CAFC spokesperson told CBC that only about five to ten per cent of victims report, so the true volume is higher.

If you tapped the link or typed in details

1. Contact your bank straight away if you shared a card number or any financial information, using the number on your card.
2. Change the passwords you entered, make them unique, and turn on multi-factor authentication. The Cyber Centre suggests an authenticator app over SMS codes.
3. Scan your device with up-to-date anti-virus software, as Get Cyber Safe advises.
4. Keep a screenshot and report to the CAFC and your local police.
5. Place a fraud alertwith Equifax and TransUnion if your identity details were exposed. Ontario’s government notes that a security freeze is free of charge.

Be wary of anyone who contacts you afterwards offering to recover your losses. The CAFC warns that fraudsters often target victims a second time.

Spam is not always a scam

A text from a real business you did not agree to hear from can still break CASL. The CRTC says the maximum penalty for a violation of the consent rules is $1 million for an individual and $10 million for a business. Those are for spam. A text built to steal money is fraud, and belongs with the CAFC and the police.

To see which numbers visitors reported recently, see the Canada spam call barometer.

This page summarises published guidance, checked on 24 October 2026. The CAFC figures are from its open data, which runs to 29 September 2025. It is not legal advice.