Best practices for online security
Use stronger passwords.

Make sure you use a range of passwords across multiple sites. Long, unique and complex passwords with a range of upper and lowercase letters, numbers and special characters are best. Always verify the strength of your passwords, and never share them or enter them into public or shared computers.

Become a phishing detective.

Monitor your personal and work email to ensure emails containing mismatched URLS, spelling and grammar mistakes or urgent requests for personal information are flagged and reported. If you’re not sure, always report!

Never share passwords.

Even the strongest and most secure passwords should never be shared. Your passwords are the central source of protection against cybercrime. Always keep them private.

Lock your screen.

When not in use, be sure to secure your cell phone or your computer by turning on sleep mode or activating the screen lock. Failing to do this increases the risk of someone obtaining personal or sensitive information.

Enable multi-factor authentication (MFA).

By combining your strong and unique passwords with multi-factor authentication, you’re adding an extra layer of security by requiring an additional form of self-verification. This makes it more difficult for hackers to gain access to your personal information. 

Maintain your software.

Keep your operating system and applications regularly updated to protect against potential vulnerabilities. Regularly backing up important data from personal devices to an external hard drive or cloud storage can help prevent data loss in case of a cyber-attack. Visit the Canadian Centre for Cyber Security in additional resources to learn more about backing up your data.

Common types of scams.

Many times, these scam attempts follow a certain playbook. Here are a few of the most common types of fraud that you may encounter.

  • Grandparents scams: Scammers call or email posing as a grandchild/family member in distress who needs money (usually via gift card or cash) immediately.
  • Romance scams: Criminals use dating websites, apps or social media to build rapport and trust and then start asking for money.
  • Lottery/inheritance scams: Fraudsters send fake letters or emails claiming that you have won a lottery or inherited a large sum of money, and demand an up-front fee to claim the prize.
  • Imposter scams: A criminal calls pretending to be from Fidelity or another reputable service provider, and requests you send them back a one-time passcode that the criminal has generated through fraudulent web activity, such as attempting to reset your password.
  • Remote access scams: A criminal will call and claim to be from a well-known company. They’ll request access to your computer, and if granted access, they’ll try to make you believe that you have a serious problem, like a malicious software infection, that you’ll have to pay them to fix. Alternatively, they may use this access to your computer to log in to various accounts you have with different providers, using your stored browser passwords.
Common red flags

Common red flags to watch out for

Knowing what to look for is an important step in maintaining your cybersecurity.
 

Unusual or out-of-pattern activities. For example, you have no business with a company, but it is asking for account activation or further details.

Callers and senders have trouble identifying themselves, or avoid questions when probed.

Marketing materials with spelling or grammatical errors.

Websites that look poorly designed and unprofessional and have broken links.

Unexpected emails or contact.

Aggressive tactics, such as rushing you to not miss an opportunity. Take time to research and see if it is legitimate.

Investment opportunities promising unrealistic returns.

At Fidelity, we won’t

  • Contact you unexpectedly to ask you to disclose sensitive information like your account credentials, passwords or credit card information through unapproved channels such as WhatsApp or social media platforms.
  • Threaten account closure if you do not provide information immediately.
  • Use high-pressure or aggressive tactics to sell you investments.
  • Ask you to download software to fix a “security issue” – be wary of requests to install software or apps.
  • Ask for remote access to your computer or device – granting remote access can allow fraudsters to steal your personal information.
  • Ask you to wire or transfer money through unapproved channels such as email money transfer. 
Deepfake awareness

Deepfake Awareness

Fraudsters are increasingly using generative artificial intelligence (gen-AI) to conduct cyber scams. Learn more about what to look out for and how to protect yourself, family and information. 

Staying vigilant on social media

Protecting yourself on social media

It’s important to maintain your online security on social media. Cybersecurity breaches often occur when information is posted on social media in an unsafe way. Below, you’ll find tips on how to improve your cybersafety while on social media.
 

Never share personal information.

Never post addresses, email addresses, phone numbers or your date of birth on social media.

Think twice. Post once.

Make sure you pause to ensure your post does not contain any personal information linked to your passwords or security questions.

Remove old emails and delete old accounts.

These accounts may open the door for a security breach. If you’ve moved on, make sure you take the steps to delete the account entirely.

Talk to your loved ones

Talk to your loved ones

You’re not the only one at risk – fraudsters can use your personal information or photos to then scam your loved ones. Know the warning signs of fraudulent communication to keep you and your loved ones safe.
 

Make sure you have discussions with your loved ones on a regular basis about scams, phishing emails and unsolicited phone calls and text messages.

Talk to your elderly loved ones about adding a trusted contact to their accounts, including any held at Fidelity. If there’s a concern about suspicious activity in the elderly person’s account and they can’t be reached, the financial institution can reach out to the trusted contact instead.

Trusted contacts don’t have authority to act on the account holder’s behalf or engage in activity on the account, but they can add another layer of vigilance against scams.

Help other family members identify the red flags of suspicious behaviour by loved ones, such as a drastic rise in expenses, adding authorized users to accounts, changing beneficiaries, the sudden development of a significant relationship (online or otherwise) or requests for payment in cryptocurrency, gift cards or bank wires.

Content Credentials

Content Credentials

Starting August 21, 2025, Fidelity began adding Content Credentials to new videos on Vidyard and Fidelity.ca.

Look for the “Cr” button on a video - hover over it to see the credentials and confirm the content is authentic.

Read the FAQ

Additional resources

If you suspect your personal information is at risk, please refer to the government resources below for more information. 

What to do if you suspect fraud has occurred

  • If you think you’ve fallen victim to any of the tactics used by scammers, the first thing to do is stop communication with the criminal immediately. Be sure to update your password, review all your accounts and balances and add multi-factor authentication to your account.
  • If you are concerned your Fidelity account may have been compromised, or you’d like to report some other type of security concern related to your account, please report it immediately, and email us at FICCustService@fidelity.ca.

Please refer to the government resources below for more ways to report fraud:

 

Canada's Credit Bureaus:

TransUnion Fraud Victim Assistance Department
1-800-663-9980 (EN)
1-877-713-3393 (FR)

 

Equifax Consumer Fraud Division
1-866-828-5961(EN- option 2)
1-800-465-7166 (FR- option 3)