October 24, 2024 – Statistics Canada’s updated methods of reaching citizens through random unscheduled door-to-door visits, emails, and phone calls pose a real security risk in this heightened environment of AI driven personal data theft and hacking. With the power of AI, malicious actors can spoof or socially engineer these outreach methods, making it nearly impossible for a non-technical person to differentiate between legitimate StatsCan representatives and sophisticated criminal scammers if they are not informed, aware, and careful.

Here's how it works:  Scammers could impersonate StatsCan officials either by showing up at your door, sending you an official-looking email with a fraudulent link, or phoning you from a caller ID spoofed real-looking official government number.  Once you engage with these fake representatives or websites, you unknowingly hand over a treasure trove of extremely sensitive personal and family information data that could be used for criminal exploits such as:

• Identity Theft
• Personal Profiling / Sale of Personal Information Data
• Break and Enter Theft
• Home Invasion / Kidnapping
• Cyber Attack / Data Loss
• Banking Fraud, Employer Fraud
• Extortion
• Credit Card Fraud
• Mortgage /Insurance Fraud

These attackers can now easily create realistic personas, phishing sites, phone numbers, or emails that look and behave exactly like the legitimate StatsCan officers and portals, making it easy to trick unsuspecting Canadians into handing over vital financial, personal, and family information.

Why the Threat Is Even More Concerning

StatsCan use passive aggressive pressure-based time and legal tactics to increase survey compliance. By law, Canadians are required to participate in these surveys, with the threat of a $500 fine, three months in jail, and a criminal record for non-compliance. Unfortunately, this pressure to comply also mimics the same urgency and intimidation tactics employed by criminals, making it easier for scammers to quickly exploit people’s fear of legal repercussions.

When faced with official-looking correspondence and the threat of legal action, many people may bypass the important step of verifying the legitimacy of the person or website contacting them, playing directly into the hands of cybercriminals.

We are familiar with an actual recent event in which a spontaneous StatsCan household visit was missed by a homeowner who was not home, and the visiting StatsCan official left a small adhesive note on the homeowner’s door informing of their visit, instructing the homeowner to contact them back by phone or through the website listed using the contact information and Surveyor ID# on the note.

These printed instructions provided by StatsCan are not entirely safe nor correct to ensure accurate verification of the caller leaving the note, which could have easily been faked, spoofed, and incorrect. 

To make matters worse, the homeowner who happened to be away on vacation for an extended period and not yet able to verify or reply to the visit, was aggressively contacted several weeks later by a StatsCan representative by phone, and was pressured into completing the required survey, threatening there were potential penalties for not co-operating, without offering a reasonable opportunity for the homeowner to independently verify authenticity of the caller.

In this case, the homeowner was lucky it was in fact a legitimate visit and call from overzealous StatsCan agents, because unknowing, unaware, and feeling pressured, the full survey was completed, unverified, over the phone, providing a tremendous amount of highly sensitive personal and family data.

What You Can Do to Protect Yourself

We strongly advise Canadians to take proactive steps to ensure they are engaging with legitimate StatsCan officials. Here’s how you can protect yourself and your personal information:

1. Request Verification: Always ask for and note down the official phone number, website, Interviewer ID#, and Personal Survey Number that must be provided by any legitimate StatsCan caller.
2. Double-Check Authenticity: Before answering ANY survey questions or clicking on any links, call the official StatsCan phone number you find listed on their verified Canadian government website yourself to confirm that you’ve been randomly selected for a survey.  Do NOT call any number provided by the caller directly, nor use any link they have provided.  You must independently look it up yourself to verify actual real government contact information authenticity with their official statistics Canada agency.  Criminals will spoof/fake the official number to show up on your caller ID and a legitimate looking website, regardless of the number or website they are calling you from or referring you to.
3. Watch for Red Flags: Be cautious of any unsolicited communication pressuring you to participate without allowing you time to verify their real authenticity. Legitimate government agencies should always give you time to ensure the process is safe and secure, and likely give you a time to schedule or re-schedule an interview.
4. Avoid Unverified Links: If you receive an email or text with a survey link, do not click on it. Instead, manually navigate to StatsCan’s official website and find the survey section on your own to ensure you’re not redirected to a phishing site.
5. Report Suspicious Activity: If you suspect someone is fraudulently posing as a StatsCan representative, report the incident to your local authorities or through the official government channels immediately.

Closing Thoughts: Stay Informed, Stay Safe

At  Superion Inc., we are committed to helping Canadians navigate the complex and often risky digital world. The recent potential exploitation of StatsCan's survey methods is a reminder that criminals are always looking for new ways to steal personal information. By staying vigilant, taking the time to verify authenticity, and refusing to give in to pressure tactics, you can protect yourself and your family from falling victim to these increasingly sophisticated scams.

In an age of AI-driven fraud, your best defense is knowledge. Stay safe, and always double-check who’s on the other end of the before giving out any personal information.

About Superion.  Superion Inc., based in Surrey BC, is a Canadian owned and operated IT service provider focused on helping businesses across the country support, manage, and secure their IT infrastructure and ensure continuity through tailored IT and cybersecurity strategies. Their team of experts offers a full range of end-to-end managed IT and cyber security solutions, from proactive planning and monitoring to rapid incident response, all backed by a dedication to customer relationships and success. To learn more about their IT security, support services, and how they can help SMEs thrive in the digital age, visit www.superion.ca.