Canadian Securities Administrators Warn of Phishing Emails

AMF Quebec News

Published January 23rd, 2026

Detected March 12th, 2026

Summary

The Canadian Securities Administrators (CSA) has issued a warning to registrants regarding phishing emails impersonating the CSA. These emails are suspected to be malicious attempts to obtain personal or confidential business information. Registrants are urged to be vigilant, verify sender authenticity, and report suspicious emails.

View original document View source feed page

What changed

The Canadian Securities Administrators (CSA) has issued a warning to financial registrants about a new spear-phishing scam. The fraudulent emails impersonate the CSA and use publicly available information to target recipients, aiming to steal personal or confidential business data. The CSA has identified a suspicious domain (@securities-administrators.ca.cazepost.com) not associated with them and advises recipients to delete such emails and report them to their local securities regulator.

Regulated entities receiving suspicious emails claiming to be from the CSA should exercise extreme caution. They are advised to verify the sender's email address, confirm the sender's identity and their expectation of receiving the email. If a link has been clicked or an attachment opened, immediate steps should be taken to change passwords and inform the organization's security department. The CSA encourages vigilance and reporting of any such attempts to prevent further compromise.

What to do next

Verify the authenticity of all emails claiming to be from the CSA.
Do not click on links or open attachments in suspicious emails.
Report any suspected phishing emails to the local securities regulator.

Source document (simplified)

Published: January 23, 2026 CSA Montréal – The Canadian Securities Administrators (CSA) is warning registrants about an email impersonating the CSA that uses publicly available information to target them. The emails are believed to be malicious “spear phishing” attempts by unknown individuals who are trying to obtain personal information or confidential business information. We urge all Canadians to be vigilant, to check the source, not to click links or provide any information.

The phishing email claims to be sent on behalf of the CSA but is from a domain (@securities-administrators.ca.cazepost.com) that is not associated with the CSA or any of its member organizations. Any information sent from this domain is not from the CSA and should be treated with extreme caution. Recipients should delete the email and report it to their local securities regulator

This link will open in a new window.

The CSA strongly urges anyone receiving an email from the CSA to remain vigilant and consider the following:

Is the message from a real, consistent and verifiable email address?
Is the message from someone you know who works at the CSA or works in one of its member organizations?
Were you expecting this email? If you have clicked on a link, or opened an attachment, it is important that you take immediate steps to change your passwords and inform your security department.

Should you receive a suspicious email claiming to be from the CSA contact us at [email protected].

The CSA, the council of the securities regulators of Canada’s provinces and territories, co-ordinates and harmonizes regulation for the Canadian capital markets.

For media inquiries, please contact:

Ilana Kelemen
Canadian Securities Administrators
[email protected]

For investor inquiries, please contact your local securities regulator

This link will open in a new window .