Vishing Attacks Canada: How Fake IT Calls Steal MFA Codes

The vishing attacks Canada’s law firms and financial companies have been fielding this fall start with a phone call that sounds routine. Someone from “IT” says your account needs a quick security update today. They stay on the line, polite and a little rushed, while you sign in.

By the time you hang up, the caller has your password, your multi-factor code and a working session in your Microsoft 365 account. You did exactly what the caller asked.

This post walks through the vishing attacks Canada has seen in 2026, using what the Canadian Centre for Cyber Security has published. It covers how the call works, why the code on your phone does not stop it, and what a small Toronto office can put in place this month.

What the October Alert Says About Vishing Attacks Canada Is Facing

On October 28, 2026, the Canadian Centre for Cyber Security issued alert AL26-028 about an ongoing voice phishing campaign aimed at Canadian organizations. The alert says multiple Canadian firms were targeted by people impersonating internal IT support, who directed employees to fake sign-in pages.

The same alert gives the timeline. The activity shifted between sectors through 2026 and has leaned toward finance and legal organizations since July. The agency found related infrastructure naming Canadian organizations as far back as January, and in October the activity was concentrated on the legal sector.

Two details from the alert explain why this campaign works:

• It gets past ordinary MFA: the fake page passes your password and your MFA response to the real sign-in service in real time, so the attacker ends up with a signed-in session.
• It moves fast: the lure web addresses change often, which limits what a blocklist can catch.

On November 2, 2026, the ABA Journal reported that four Canadian law firms said they had recent data breaches, had contained the damage and were alerting affected clients. The article quoted the alert’s warning about fake IT callers. It did not say how attackers got into each firm, so this post does not tie those breaches to the vishing attacks Canada’s law firms were warned about.

Step by Step: How the Vishing Attacks Canada Is Seeing Work

The alert describes the call in detail. Read it as a script, because that is what it is.

1. The pretext: the caller says there is an urgent passkey migration, an MFA enrollment or a required password change. They may name real people in your IT team or mention a deadline you supposedly missed.
2. The channel: the call can reach a personal mobile, an office phone or Microsoft Teams. The number shown may be spoofed to look like your own help desk.
3. The page: you are sent to a sign-in page with your company’s name in the web address, such as your name as a subdomain of a generic site, or a newly registered domain built from words like “enroll”, “activate”, “sso” or “mfa”.
4. The relay: you type your password and approve the prompt or read out the code. The page hands both to the real identity provider, and the attacker gets your session.
5. The exit: if you try to verify the caller independently, the alert says the caller may simply hang up.

The Canadian Centre for Cyber Security’s vishing guide (ITSAP.00.102), published in July 2026, adds the setup work.

Callers gather names and phone numbers from social media, professional networking sites, company websites and earlier data breaches. They can spoof caller ID so a call appears to come from an internal extension, and the guide warns that some use AI voice cloning built from short audio samples.

Vishing Attacks Canada: Why a Six Digit Code Is Not Enough

Most offices turned on multi-factor authentication years ago. The weak point is the person. A code typed into a fake page, or read aloud to a caller, works just as well for the attacker as it does for you.

The Canadian Centre for Cyber Security’s guidance on multi-factor authentication (ITSAP.30.030) names the techniques plainly. Attackers bypass MFA through MFA fatigue (sending push prompts until someone accepts one), token theft and machine-in-the-middle attacks through false links. Its fixes are number matching, a limit on MFA requests per user, and phishing-resistant MFA, with FIDO-based options strongly recommended.

Alert AL26-028 goes further for this campaign. It recommends phishing-resistant MFA such as FIDO2 security keys, device-bound passkeys or platform authenticators, starting with privileged and high-risk users.

That is the main lesson from the vishing attacks Canada saw this year. The code on your phone proves you are present. It does not prove the page in front of you is real.

What Happens After the Attacker Is In

In the vishing attacks Canada’s legal and financial sectors faced, the call was only the start. According to the alert, once the attacker holds a signed-in session they have been reported to:

• register their own MFA method or device, so they keep access after you change your password
• delete password reset, MFA change and security notification emails before you see them
• reset passwords for other applications that do not use single sign-on
• use automated scripts and Microsoft Graph to pull data out of Microsoft 365, SharePoint, OneDrive and connected cloud apps
• send an extortion demand once the data is gone

Notice the second item. The warning emails are deleted first, so someone has to watch sign-in records instead of waiting for an email.

A quiet employee account can also be the whole story. In April 2026, Canada Life said it had identified a cyber incident involving unauthorized access to certain applications through an employee account, and that the incident was contained. Its statements do not say how that account was accessed, so it is not a confirmed vishing case.

What Canada Life did say afterwards is useful for any business. In its update on the incident, it said it had posted public notices about the increased risk of malicious communication attempts that followed. The vishing guide lists data breaches as one of the ways callers collect the phone numbers and personal details that make a call sound real.

Five Habits That Stop the Call From Working

The vishing attacks Canada has seen this year rely on one thing: an employee who acts before checking. These habits come straight from the two Canadian Centre for Cyber Security documents above.

1. Hang up and call back: if a caller says they are from IT, a bank or a vendor, end the call and dial a number you already know. ITSAP.00.102 says not to use the number the caller gives or your phone’s callback option.
2. Keep codes off the phone: the vishing guide says not to share usernames, passwords or one-time codes over the phone unless you are certain who is calling. An unexpected IT call does not meet that bar.
3. Use a call-back code: the vishing guide suggests a shared word or call-back procedure for workplaces, so a caller who cannot pass it is treated as fake.
4. Treat urgency as a warning sign: a deadline, a threat to lock your account or pressure from a “senior” person is the pattern, not the exception.
5. Report it fast: tell your IT contact about the call and any web address you were sent to. The alert asks organizations to give staff a clear channel for this.

If someone already typed a code into a fake page, speed matters more than blame. The alert says to revoke active sessions and tokens, reset credentials, remove any MFA methods the attacker added, and review mailbox and file activity. Keep the identity provider and Microsoft 365 audit logs for the investigation.

What Canadian Law Expects After a Compromised Account

If one of the vishing attacks Canada is seeing reaches your Microsoft 365 account and exposes client or employee records, it can become a privacy breach. Under PIPEDA, the Office of the Privacy Commissioner of Canada says organizations must report breaches that pose a real risk of significant harm to the commissioner, notify the affected individuals, and keep records of all breaches, including those below that threshold.

Those records are much easier to produce when sign-in logs were kept and someone was watching them. Without those logs, a business cannot tell whether a call it heard about last week ended in a breach it must report.

For individual losses, the ITSAP.00.102 guide says to report the scam to the Canadian Anti-Fraud Centre with the caller’s number and any websites you were asked to visit.

Where Secur-IT Data Fits

Our team helps small and mid-sized offices prepare for the vishing attacks Canada’s federal cyber security agency described in October, with two managed services that work together.

• Human risk: our security awareness training and phishing simulations include social engineering attack simulations, incident reporting procedures, monthly phishing simulation campaigns and awareness of manipulation beyond email, so staff practice before a real caller tests them.
• Cloud security: our cloud security service sets up multi-factor authentication, conditional access policies and continuous monitoring of user activity, with cloud monitoring to detect suspicious activity across Microsoft 365. The alert names suspicious MFA registrations and scripted Microsoft 365 file access as the signs to watch for.

For small offices, a questionnaire-based assessment is free. An on-site assessment is quoted after a short scoping call.

Frequently Asked Questions

Q: What are the vishing attacks Canada’s organizations are seeing in 2026?

Callers impersonate internal IT support and send employees to fake sign-in pages that relay passwords and MFA responses to the real service. The Canadian Centre for Cyber Security described this in alert AL26-028 on October 28, 2026, with recent activity focused on legal and financial organizations.

Q: Can vishing get around multi-factor authentication?

Yes, when the MFA uses codes or push approvals. The fake page passes your response to the real sign-in service in real time. Against this campaign, the Canadian Centre for Cyber Security recommends phishing-resistant MFA, such as FIDO2 security keys or device-bound passkeys.

Q: How can staff tell a real IT call from a fake one?

Not by voice or caller ID, because both can be faked. Hang up, call IT back on a known internal number, and never read out or type a code because a caller asked.

Q: What should we do if an employee gave a code to a caller?

Revoke that user’s sessions and tokens, reset the password, remove any MFA methods the attacker added, and review mailbox and file activity. Keep the audit logs, then decide whether the breach must be reported under PIPEDA.

Q: Where do I report a vishing call in Canada?

Report it inside your organization first, to your IT contact. The Canadian Centre for Cyber Security asks organizations that find activity matching its alert to report through My Cyber Portal or contact@cyber.gc.ca, and individuals can report scams to the Canadian Anti-Fraud Centre.

If you want to know how your team would handle one of the vishing attacks Canada is seeing today, and what to change first, our team at Secur-IT Data can walk you through it.

References

1. Canadian Centre for Cyber Security: AL26-028, Ongoing Help Desk Voice Phishing Campaign Targeting Canadian Organizations
2. Canadian Centre for Cyber Security: What is voice phishing (vishing)? (ITSAP.00.102)
3. Canadian Centre for Cyber Security: Secure your accounts and devices with multi-factor authentication (ITSAP.30.030)
4. Canada Life: Update on recent cyber incident
5. Office of the Privacy Commissioner of Canada: What you need to know about mandatory reporting of breaches of security safeguards

Krikor Tengerian

Krikor Tengerian is the CEO and founder of Secur-IT Data Solutions, a Toronto-based cybersecurity firm focused on helping Canadian organizations secure their infrastructure and critical systems. With over 25 years of experience across cybersecurity and IT infrastructure, he has supported organizations in hardening networks, protecting critical workloads, and aligning security controls with business and regulatory requirements.​
Krikor actively shapes the direction and themes of Secur-IT’s educational content, collaborating with AI tools to structure, refine, and expand articles while providing the real-world context, use cases, and review to keep them accurate and practical for readers. He regularly shares insights on OT security, threat detection, incident response, and Canadian cybersecurity compliance to help industrial and commercial organizations better understand and reduce their cyber risk.