Meet the Phish Family
Phishing isn’t just a lone scammer hiding behind a fake email anymore — it’s an entire crime family of schemes, each with its own specialty.
Family members include the smooth talker who calls pretending to be your boss, the texter who claims your package is waiting, and the high-roller who targets executives with million-dollar deals that aren’t real. Together, they make up the modern Phish Family and business is booming. This post will help you stay ahead of evolving threats like phishing, smishing, vishing, and quishing.
We'll also look at a new tool in the hands of our digital crime family: artificial intelligence. AI now helps them write perfect emails, imitate voices, and even build realistic websites or QR codes that look completely legitimate. What used to be obvious scams are now polished operations that fool even cautious professionals.
These attacks don’t just steal passwords; they can steal money, reputations, and hard-earned trust. Let's break down the most common types of phishing, show how AI is making each one harder to spot, and share practical ways to protect your business from the Phish Family’s latest tricks.
Why Phishing Works (and why the Phish Family keeps growing)
At heart, phishing is social engineering — it doesn’t try to brute-force your network; it convinces a human to open the door. Attackers rely on predictable human reactions to common emotional levers like:
- Urgency (“pay this now”)
- Authority (“this is from your CEO”)
- Curiosity (“see your invoice”)
- Helpfulness (“I need a favour”)
- Greed (“you’ve won”)
These tactics have been used by con artists for centuries because they work. The online world has opened the largest menu of opportunities in history — and AI has made the scams more convincing than ever.
Where old phishing emails were easy to spot (bad grammar, wonky logos), today’s messages often look and read exactly like something your business would trust. AI enables criminals to:
- Draft convincing, on-brand copy that mimics corporate tone and style.
- Personalize messages at scale by scraping public profiles so the attacker appears to “know” you.
- Clone voices from a few seconds of audio for realistic vishing calls — or generate deepfake video/audio to pressure teams into acting fast.
- Auto-generate fake landing pages and QR-linked sites that visually match the real thing (quishing).
Put simply: the tools have given the Phish Family an edge. And because people still make split-second decisions under pressure, these upgraded scams work. In Canada this matters — 1 in 6 Canadian businesses reported a cybersecurity incident in 2023, and many of those incidents begin with a successful phishing attempt.
Next: we’ll walk through each major phishing type in the “Phish Family” lineup, explain the specific ways AI is making each method harder to spot, and share practical steps your team can use to fight back.
Phishing — The Godfather
If there’s a “Don” in the Phish Family, it’s phishing — the long-running scam that impersonates trusted senders and convinces people to open the door themselves.
Today’s phishing emails look more polished than ever, often mirroring real company correspondence down to the signature line, tone, and web design. With AI-generated writing, grammar errors are gone and context feels authentic — making these scams dangerously persuasive.
Real-World Example: CPATA IP Scam (2025)
In January 2025, the College of Patent Agents and Trademark Agents (CPATA) issued a warning about a widespread phishing campaign targeting Canadian business owners and intellectual property holders.
Victims received official-looking emails from people claiming to be “intellectual property attorneys” or representatives of the Canadian Intellectual Property Office (CIPO). The messages cited real patent or trademark details pulled from public records and urged immediate payment to “protect your brand” from fake infringement threats.
Some messages even used the names of registered agents and professionally designed logos to appear legitimate. The scam relied on urgency, authority, and fear — three of the most common levers in successful phishing attacks.
How AI Is Impacting Phishing Emails
Artificial intelligence has made it easier for scammers to:
- Mimic corporate writing styles by analyzing thousands of legitimate emails from a company to replicate tone, formatting, and even common phrases used by specific departments
- Eliminate the "red flags" like grammar errors, awkward phrasing, and translation mistakes that used to make phishing emails obvious
Defence Tip: Always verify urgent or payment-related requests by contacting the organization directly through official channels. Never rely on contact details or links provided in the suspicious message.
Smishing: The Street Hustler
If phishing is the boss of the family, smishing is the fast-talking sidekick — short, direct, and designed to make you click before you think.
Smishing (short for SMS phishing) uses text messages to trick people into sharing personal information, downloading malware, or visiting malicious websites. These scams thrive on urgency: “Your package couldn’t be delivered,” “Your account is frozen,” or “You’re owed a refund.”
Because text messages feel personal and immediate, smishing attacks are incredibly effective — especially when combined with AI-written content that removes the spelling errors and odd phrasing that once gave scams away.
Real-World Example: RCMP “Delivery Notice” Scam (2025)
In January 2025, the Royal Canadian Mounted Police (RCMP) and the Canadian Anti-Fraud Centre issued a warning about a smishing scam impersonating the RCMP.
Victims received text messages claiming the RCMP was unable to deliver court documents, asking them to click a link to reschedule. The link led to a fraudulent RCMP website designed to harvest personal information.
The scam used official language and branding to appear legitimate and created a sense of panic by threatening recipients with missed legal deadlines — a perfect example of how authority and urgency are exploited together.
The RCMP reminded Canadians that it does not issue notices or requests for information by text message and that its official website is rcmp-grc.gc.ca.
How AI Is Making the Messages More Convincing
According to the Canadian Anti-Fraud Centre, smishing attempts are growing more sophisticated as fraudsters leverage AI and automation to scale their operations. CAFC spokesperson Jeff Horncastle told The Canadian Press that AI now helps criminals to:
- generate convincing, grammatically perfect text messages — even in languages that aren’t their own;
- scrape leaked data from past breaches to personalize messages with accurate names, numbers, or account details; and automate bulk campaigns that send thousands of messages in seconds.
Defence Tip: Never click links or reply to texts from unknown senders. Report suspicious messages by forwarding them to 7726 (SPAM) and delete them immediately.
Vishing: The Impersonator
If smishing is the Phish Family’s fast texter, vishing is its silver-tongued caller — the scammer who sounds trustworthy, urgent, and just official enough to make you stay on the line.
Vishing (short for voice phishing) involves phone calls or voicemail messages designed to trick people into revealing information, transferring funds, or granting remote access. The caller might claim to be from your bank, a government agency, or even your company’s IT department.
With just a few seconds of recorded audio, fraudsters can now clone voices that sound almost identical to a CEO, manager, or relative. This technology, once reserved for Hollywood, is now cheap and widely available online.
Real-World Example: Deepfake CEO Scam Targets Global Businesses
In 2024, the international advertising firm WPP revealed that cybercriminals used AI-generated voice and video deepfakes to impersonate senior executives during virtual meetings.
The scammers joined what appeared to be a legitimate conference call — complete with realistic facial movements and authentic-sounding voices — and instructed employees to authorize a large financial transfer.
The attempt was detected before any money changed hands, but the incident underscored a chilling truth: deepfake vishing attacks are no longer theoretical. The Canadian Centre for Cyber Security warns that voice cloning and caller ID spoofing are now common features of modern vishing campaigns, making it nearly impossible to rely on voice alone for verification.
How AI Is Making the Calls More Convincing
AI has fundamentally changed how vishing works. Scammers can now:
- Clone voices from a short online video, voicemail, or podcast recording.
- Script realistic conversations that adapt to your responses in real time.
- Combine voice cloning with spoofed caller IDs to appear as trusted contacts — even from within your own organization.
Defence Tip: Hang up and call back using a verified number. Never act on financial or credential requests made over an unexpected call — even if the voice sounds familiar.
Spear Phishing & Whaling: The Infiltrators
Spear phishing and whaling are two sides of the same blade. Both rely on careful reconnaissance and personalized messaging rather than mass blasts. The difference is target and consequence: spear phishing aims at employees who can open doors (HR, payroll, procurement), while whaling goes after executives and board members whose approval can move large sums or change strategic direction. In practice, both use tailored content designed to look legitimate and urgent.
Real-World Example: Salvation Army / City of Ottawa
In April 2022 the City of Ottawa disclosed it had been defrauded of about $558,000 after criminals compromised the Salvation Army’s email system. Attackers used the charity’s legitimate domain to send realistic requests to the city asking for changes to vendor banking details. Because the messages came from a trusted partner’s account, they were processed as routine. The city later recovered the funds, but the incident is a textbook example of business email compromise (BEC) driven by targeted impersonation.
How AI Is Sharpening Targeted Attacks
AI has accelerated and industrialized targeted fraud:
- It scrapes LinkedIn, public filings, and leaked data to map organizational roles and relationships.
- It generates on-brand, in-tone messages and realistic subject lines that mimic internal correspondences.
- It assembles convincing fake invoices, contracts, or login pages, and can even produce voice or video deepfakes for high-value whaling attacks.
Defence Tip: Always verify requests to change payment details or release funds using a separate, trusted channel (call a published number, confirm in person, or require written confirmation from two authorized contacts).
Quishing: The Tech-Savvy Con Artist
Once a harmless shortcut for menus and payments, QR codes have become a new favourite weapon in the phishing arsenal. Quishing — or QR phishing — replaces traditional links with codes that send victims to fake login pages or malicious websites.
Because the destination is hidden until scanned, these scams easily bypass email filters and appear legitimate on paper, signage, or digital screens.
Real-World Example: Fake Parking QR Codes Across Canada
According to a CBC News report (October 2024), fraudulent parking QR codes have appeared in Toronto, Vancouver, Calgary, and Ottawa, directing users to spoofed payment websites that harvest credit card data.
Similar attacks have been found in emails and invoices sent to businesses, where embedded QR codes link to imitation Microsoft 365 or banking portals.
The Canadian Anti-Fraud Centre warns that these scams are rising as people continue to trust QR codes from years of contactless use during the pandemic.
How AI Is Making QR Scams More Convincing
AI tools allow attackers to:
- Instantly clone the branding and design of legitimate payment or login pages.
- Create custom QR graphics complete with real logos and business names.
- Automate phishing kits that track scans and submissions to refine future attacks.
Defence Tip: Be cautious with QR codes from unknown or public sources. If a code appears in an email, invoice, or on a sign, manually type the web address or use a saved bookmark instead of scanning.
Angler Phishing: The Sociable Scammer
Angler phishing preys on the fact that many customers turn to social media for quick help. Attackers create fake branded “support” accounts attempting to steal credentials, payment details, or install malware. Just as a fisherman uses lures designed for specific species, the “angler” uses targeted social media messages to hook victims seeking support or other customer service-related help.
Real-World Pattern: Fake Support Accounts and Social DMs
Across platforms, security teams and fraud-watch groups have seen a steady rise in fake support accounts mimicking company names, logos, and reply-style.
A typical angler phishing attempt might go like this:
- A customer tweets that their delivery never arrived.
- Within minutes, a look-alike “support” account — same logo, slightly different handle — replies offering a quick fix and asks the customer to DM or click a link to verify their order.
- The private message leads to a convincing fake support page that asks for login details or payment information, and before the real company has time to respond the attacker has already harvested credentials or charged the card.
This method isn’t limited to big brands — small businesses and local service providers are targeted as well because their customers publicly post issues and attackers can opportunistically reply.
How AI Is Powering Angler Phishing
AI makes angler phishing easier and more scalable by enabling attackers to:
- Auto-generate dozens of convincing reply messages tailored to the tone of the complaint.
- Clone logos and craft profile bios that closely mimic legitimate support accounts.
- Automate monitoring of brand mentions so fake accounts can reply faster than real teams.
Defence Tip: Never provide credentials, payment information, or personal details in DMs. If someone on social media claims to be support, switch to verifiable channels such as the company’s official website or customer service phone line.
How to Protect Your Business from the Phish Family
From phishing emails to fake QR codes, every member of the “Phish Family” relies on one thing: human trust. The good news is that a few consistent habits and safeguards can protect your business from most of their tricks.
1) Train and Test Your Team
Regular security awareness training helps employees recognize suspicious messages, links, and calls. Follow it up with simulated phishing exercises so awareness becomes instinct, not theory.
2) Strengthen Email and Account Security
Implement multi-factor authentication (MFA) across all accounts and enforce strong password policies. Protect your domain with SPF, DKIM, and DMARC to prevent spoofing and impersonation.
3) Verify, Don’t Trust
Build simple, consistent verification steps into your processes. Whether it’s a vendor payment change, a link in a text, or a “support” message on social media — always confirm using an official channel before acting.
4) Keep Systems Updated
Apply software and firmware updates promptly to close vulnerabilities that attackers can exploit if phishing leads to malware installation.
5) Back Up and Segment Critical Data
Maintain regular, verified backups and store them separately from your main network. If a phishing incident leads to ransomware, this ensures you can recover quickly.
6) Build a Culture of Reporting
Make it easy for employees to report suspicious messages or incidents without fear of blame. Rapid reporting often stops a phishing attempt before damage spreads.
Your Trusted Defence Partner
At allCare IT, we help businesses stay one step ahead of evolving cyber threats with proactive monitoring, employee awareness programs, and layered protection strategies.
From phishing simulations to AI-driven security tools and compliance support, we provide the expertise and systems that keep your data — and your reputation — safe.
Don’t wait until you’ve been hooked
Book a free Cybersecurity Consultation to assess your defenses and learn how to build lasting resilience against the Phish Family.
Our team will review your current protections, identify gaps, and suggest a roadmap to cyber safety.