“Cybercriminals do not always break down our digital doors. Sometimes, they borrow the face of a friend, knock politely, and wait for us to open them. In a world where trust itself can be stolen, our greatest defence is not technology alone, but the wisdom to question what appears familiar.” – MJ Martin
An Invitation That Raised My Suspicions
This week, I received an email inviting me to a party. The message contained very little information, other than a link to the invitation. I examined the sender’s email address and recognized it immediately. It belonged to a friend.
Nevertheless, something troubled me. Rather than opening the invitation, I replied and asked my friend to provide the details directly.
Later, she informed me that her email account had been hacked. Her son had visited to help her change her password.
My suspicions had apparently spared me from a potentially dangerous encounter. But the experience raised an important question. How can an innocent invitation from someone we trust become a weapon against us?
Understanding the Cyberattack
This was consistent with a phishing attack, potentially involving account takeover. Cybercriminals sometimes obtain access to legitimate email accounts and exploit the owner’s existing relationships.
However, a legitimate-looking sender address does not prove an account was hacked. Criminals can also forge sender information through email spoofing.
The strategy is called social engineering. Rather than attacking sophisticated computer defences directly, criminals manipulate human behaviour.
Consider a burglar who steals your neighbour’s house keys, then uses them to gain your confidence. The keys are genuine, but the person holding them is not trustworthy.
According to the Canadian Centre for Cyber Security, phishing frequently exploits trusted identities to encourage recipients to open malicious attachments or visit fraudulent websites.
What Are These Criminals After?
Most attacks are financially motivated. Criminals seek passwords, banking credentials, personal information, and access to additional accounts.
Some distribute malicious software capable of stealing information, monitoring activities, or encrypting files for ransom.
Others harvest contact lists, turning one compromised account into hundreds of potential victims.
The perpetrators range from individual opportunists to organized international criminal networks. Their operations can be remarkably sophisticated, automated, and difficult to trace.
The Canadian Anti-Fraud Centre reported approximately $351 million in fraud losses during the first six months of 2026, across multiple categories of fraud. https://antifraudcentre-centreantifraude.ca/features-vedette/2026/08/fraud-trends-tendances-matiere-fraude-eng.htm
What If I Had Opened the Invitation?
Clicking the link might have connected my browser to a criminal-controlled server.
That server could have recorded technical information about my visit, displayed a counterfeit login page, or attempted to deliver malicious software.
Importantly, simply visiting a website does not automatically mean your computer has been compromised. The greatest danger often arises when someone enters credentials, downloads a file, authorizes an unfamiliar application, or encounters an exploitable software vulnerability.
The distinction matters. A suspicious click warrants investigation, but it does not necessarily constitute a successful attack.
Protecting Ourselves
Our first defence is healthy scepticism.
We should verify unexpected invitations through an independent communication channel, preferably a telephone call. Replying to a compromised email account may simply reach the criminal.
Strong, unique passwords, password managers, multifactor authentication, updated software, and reputable security tools provide additional protection.
Anyone whose email account has been compromised should change their password, revoke unfamiliar sessions, examine forwarding rules, remove unauthorized applications, and notify contacts. Changing a password alone may not eliminate every unauthorized access mechanism.
Anyone who clicked a suspicious link should avoid further interaction, scan their device, and change exposed credentials using a trusted device. Suspected fraud can be reported to the Canadian Anti-Fraud Centre.
The Price of Digital Trust
The greatest vulnerability in cybersecurity is often not technology, but trust.
We have constructed an extraordinary digital society in which communication travels around the world in milliseconds. Yet its security still depends upon individuals making thoughtful decisions.
My experience illustrates a simple principle. Trust the person, but independently verify the message.
Perhaps we should ask ourselves whether convenience has made us careless. Are we teaching our children and older Canadians sufficient digital literacy? And should our technology providers shoulder greater responsibility for protecting the people who depend upon their systems?
Cybersecurity is no longer exclusively a technical discipline. It has become an essential life skill.
The invitation that deserves the greatest scrutiny may be the one that arrives from someone we know.
The Canadian Centre for Cyber Security’s guidance on phishing attacks and multifactor authentication supports the central security recommendations. Its guidance also confirms that stolen login sessions can sometimes bypass conventional authentication protections. Canadian Centre for Cyber Security +3
One question worth exploring further:
Should email providers be required to introduce stronger default protections for older Canadians and other vulnerable users, or would doing so unnecessarily complicate everyday communication?
About the Author:
Michael Martin is the Vice President of Technology with Metercor Inc., a Smart Meter, IoT, and Smart City systems integrator based in Canada. He has more than 40 years of experience in systems design for applications that use broadband networks, optical fibre, wireless, and digital communications technologies. He is a business and technology consultant. He was a senior executive consultant for 15 years with IBM, where he worked in the GBS Global Center of Competency for Energy and Utilities and the GTS Global Center of Excellence for Energy and Utilities. He is a founding partner and President of MICAN Communications and before that was President of Comlink Systems Limited and Ensat Broadcast Services, Inc., both divisions of Cygnal Technologies Corporation (CYN: TSX).
Martin served on the Board of Directors for TeraGo Inc (TGO: TSX) and on the Board of Directors for Avante Logixx Inc. (XX: TSX.V). He has served as a Member, SCC ISO-IEC JTC 1/SC-41 – Internet of Things and related technologies, ISO – International Organization for Standardization, and as a member of the NIST SP 500-325 Fog Computing Conceptual Model, National Institute of Standards and Technology. He served on the Board of Governors of the University of Ontario Institute of Technology (UOIT) [now Ontario Tech University] and on the Board of Advisers of five different Colleges in Ontario – Centennial College, Humber College, George Brown College, Durham College, Ryerson Polytechnic University [now Toronto Metropolitan University]. For 16 years he served on the Board of the Society of Motion Picture and Television Engineers (SMPTE), Toronto Section.
He holds three master’s degrees – in business (MBA), communication (MA), and education (MEd). As well, he has three undergraduate diplomas and seven major certifications in business, computer programming, internetworking, project management, media, photography, and communication technology. He has completed over 80 next generation MOOC (Massive Open Online Courses) [aka Micro Learning] continuous education programs in a wide variety of topics, including: Economics, Python Programming, Internet of Things, Cloud, Artificial Intelligence and Cognitive systems, Blockchain, Agile, Power BI, Big Data, Design Thinking, Security, Indigenous Canada awareness, and more.
Martin is a volunteer, a photographer, a learner, a technologist, a pilot, a philosophizer, and always, a romantic optimist.