Category: Uncategorized

Smishing is phishing delivered by SMS, where attackers send fraudulent text messages to steal credentials, payment details, or personal information. The Canadian Anti-Fraud Centre received 886 smishing reports in the first half of 2025. A centre spokesperson told The Canadian Press that smishing is likely increasing anyway. Reports understate the problem, since only 5% to 10% of fraud victims come forward.

You're halfway through a busy day when a text appears about a missed delivery, a locked bank account, or a tax refund. The message seems ordinary, but it asks you to tap a link before something goes wrong. The safest response is to pause, avoid the link, and verify the claim through the organization's official app, website, or phone number.

Smishing isn't just unwanted marketing. It's social engineering, which means someone is trying to influence your behaviour so they can obtain login details, banking information, passwords, personal identification numbers, or your Social Insurance Number. The message may lead to a fraudulent website or malware, creating a path to stolen data, financial loss, or identity theft.

What Smishing Actually Means

The word smishing combines SMS, the technology behind text messaging, with phishing, the practice of pretending to be trustworthy in order to steal information. Canada's national cyber authority formally defines it as SMS-based phishing that uses fraudulent texts and social engineering to persuade people to disclose sensitive information (Canadian Centre for Cyber Security guidance).

A typical message creates a short story and asks you to act. It might say that a parcel needs a delivery fee, your account has been locked, or a payment requires confirmation. The link then leads to a fake login page, a payment form, or a site that attempts to install malware.

SMS works well for criminals because people often treat texts as personal and immediate. A short message also gives you less context to inspect than a full email. You may see a familiar brand name, a convincing logo, or a link that appears to belong to a bank, courier, or government service.

Why SMS deserves the same caution as email

Many people have learned to question unexpected email attachments and login requests. They may not apply the same caution to a message that arrives in a familiar conversation thread or appears to come from a known contact.

That appearance isn't proof of safety. Canadian guidance warns that fraudulent messages can appear inside a legitimate-looking SMS thread, so the sender display and conversation history can't authenticate the message.

Plain-English definition: Smishing is a text message scam that tries to make you reveal information, send money, or install something harmful.

The distinction matters because a text can be the first step in a longer attack. Stolen credentials may later be used against your email account, workplace systems, banking services, or other accounts connected to the same password.

How a Smishing Attack Actually Works

A smishing attack follows a simple human pattern. A con artist pretends to represent a trusted company, creates a problem that needs immediate attention, and offers a convenient solution. The SMS version compresses that entire conversation into a few lines.

The Canadian Centre for Cyber Security warns that SMS blasters use cell-site-simulator-based systems to send fraudulent texts at scale within an area. Campaigns can be generic or customized to a particular organization, event, or authentication scenario (guidance on SMS blasters).

The attack pipeline

1. A believable lure arrives. The criminal chooses a situation you recognise, such as a delivery problem, suspicious bank activity, an account reset, or a benefits notice.

2. The message creates pressure. Words such as “urgent,” “locked,” or “final notice” push you towards a quick decision. The attacker wants you to solve the problem before checking whether it exists.

3. A link or contact route appears. The message may direct you to a lookalike website, a phone number, an app download, or a reply prompt. Shortened links and slightly altered web addresses can make inspection harder.

4. The page collects information. A fake site may request your username, password, card details, personal identification, or a one-time code. Some messages instead lead to malware that can affect the device.

5. The stolen information supports the next attack. Criminals may try to access an account immediately, or use the details to impersonate you, target your email, or approach your employer.

A sender can also be spoofed, which means the message is made to appear as if it came from another number or organization. SMS blasters make this problem harder because the campaign can reach many devices quickly, and a fraudulent message may blend into a real thread.

For a short technical explanation of the attack flow, this smishing attack video provides additional context.

The counter-move is simple. Slow down, leave the message, and verify through a channel the sender doesn't control.

Smishing Compared to Phishing and Other Channels

Smishing, email phishing, and voice phishing use different delivery methods, but they pursue the same result. The attacker wants credentials, payment information, access codes, or identity details.

Attack type	Channel	Typical lure	Common impersonation	Safest defensive move
Smishing	SMS or text message	Delivery issue, locked account, payment request	Banks, couriers, government services	Open the official app or type the known website address yourself
Email phishing	Email	Password reset, invoice, security alert	Employers, online services, financial institutions	Visit the service directly, without using the email link
Vishing	Phone call or voicemail	Fraud alert, account problem, identity check	Banks, government agencies, technical support	End the call and use an official number to make contact

Email gives you more visible information, such as the sender address and full link, but those details can still be forged. A text message feels more direct, while a phone call creates pressure through conversation and voice. The response should remain consistent: don't trust the contact route just because it feels familiar.

Smishing and phishing also overlap in their technical consequences. A fake page can capture a password regardless of whether the link arrived by text or email. If you reuse that password, the attacker may test it against your email account and other services.

Voice scams add another layer because the caller can react to your answers. They may ask for a code sent to your phone, guide you through a login, or encourage you to install remote-access software. We explain that pattern in our guide to vishing and voice phishing scams.

Modern fraud often moves between channels. A text might start the interaction, an email might provide a fake receipt, and a phone call might ask you to confirm a code. Defending only your inbox leaves the mobile and voice parts of the attack unprotected.

Real-World Smishing Examples Worth Recognising

The same story templates appear again and again because they fit ordinary routines. The details change, but the requested behaviour stays familiar: click, pay, log in, reply, or provide a code.

The delivery or customs message

You receive a text saying a parcel is waiting because of a small outstanding fee or an address problem. The message includes a short link to “reschedule delivery” or “pay customs.”

The link opens a courier-looking page that asks for your card number and billing details. The safest response is to open the courier's official website or app independently and check for a delivery notice there. Don't use the contact details supplied only inside the text.

This pattern can also appear as a QR-code scam, which we cover in our guide to quishing.

The bank or credit union warning

A message claims that your account has been locked or that a suspicious transaction needs approval. It may use the bank's name, a familiar logo, and a button that says “verify now.”

The pressure comes from the possibility of financial loss. Instead of tapping, open your banking app yourself or call the number printed on your bank card. The Financial Consumer Agency of Canada warns that banks won't ask for personal information, login credentials, or account information by email or text message (Financial Consumer Agency of Canada).

The tax or benefits notice

A text says that you're eligible for a refund, benefit payment, or account update involving the Canada Revenue Agency or Service Canada. It asks for personal identifiers, payment details, or a login.

Official branding doesn't make the message authentic. Type the known government website address into your browser, or use the official service you already trust. A real-looking story still needs independent verification.

Mental checklist: What problem does the message claim exists, what action does it demand, and what information would that action reveal?

How to Spot a Smishing Text in the AI Era

Perfect grammar no longer proves that a message is genuine. Criminals can create polished, personal-sounding text, and they can add local details that make a story feel connected to your life.

The more reliable test is behavioural. Ask what the message wants you to do, rather than judging how well it is written.

Watch for these requests:

• Unexpected authentication: A text asks for a password, one-time code, personal identification number, or Social Insurance Number when you didn't begin the process.

• A login through a message link: The branding may look perfect, but the safest approach is to open the official app or type the known website yourself.

• Urgency around money or access: The message claims that a payment, delivery, account, refund, or benefit will fail unless you act immediately.

• A reply or call: The sender asks you to respond, call a supplied number, or install an app. That gives the criminal another way to guide the conversation.

• A sender name that looks familiar: A visible name or logo doesn't prove who sent the message. The Competition Bureau recommends stopping the interaction and using the organization's official app or known website instead (Competition Bureau guidance).

SMS blasters can also make the sender and thread appear more credible. That's why “it arrived in my bank thread” isn't a reliable reason to trust it.

You can read more about inspecting suspicious URLs in our guide to checking a phishing link. The central rule remains simpler than any visual checklist: verify the requested action through a separate channel.

What to Do If You Receive or Click a Smishing Text

Your next move depends on what happened. In every case, step outside the text thread so the sender cannot dictate what you do next. A suspicious SMS is often the doorway, while your email password and recovery options are the assets an attacker wants.

If you didn't click

Do not reply, including with “STOP” or “NO.” A response can confirm that your number is active and invite more messages.

Forward the suspicious text to 7726, which spells “SPAM.” Your mobile provider can investigate and help block similar messages. Delete the text afterward. If it claims to involve your bank, a courier, or a government service, check through the organization's official app, website, or phone number found independently.

If you clicked but didn't submit information

Close the page without downloading anything. If it asked you to install an app or configuration profile, remove it through your device's normal settings. Check for unfamiliar apps, permissions, or account changes.

A login page can still expose a password even if you stopped before completing another step. Change any password you entered, starting with email if that password is reused elsewhere. Your email account can reset other services and may let an attacker take over more than the account named in the text. Turn on multifactor authentication, and change it if you shared a code or approved a login you did not start.

If you shared information or lost money

Contact the impersonated organization through a verified channel. If you provided banking or card details, call your financial institution immediately and monitor the account for unfamiliar activity. Report the incident to the Canadian Anti-Fraud Centre through its online fraud reporting system, which creates a record for law enforcement and bank investigation teams. Reported numbers understate the true volume, so treat each suspicious text as part of a wider pattern.

Do not post screenshots containing your phone number, account details, names, addresses, or one-time codes. If you need assistance, remove those details first and use a trusted support channel. Keep the original message available for investigators, but share it only through that channel.

How to Protect Yourself and Your Team From Smishing

Durable protection comes from changing the default response to unexpected messages. Don't decide whether a text is safe based only on its spelling, logo, or sender name. Decide whether its requested action makes sense, then verify it somewhere else.

For personal devices, enable your carrier's SMS spam protection and keep your phone's operating system updated. Where your device supports it, consider disabling 2G, which can reduce exposure to certain downgrade and legacy-network techniques. Keep your phone number off public profiles where practical, and never share a one-time code in response to an unexpected text.

Small businesses need a clear rule for payment and account changes. A convincing text can bypass email filtering because the interaction starts on a mobile channel, so staff should use a known verification route for payroll changes, invoice requests, password resets, and MFA prompts.

Simple team controls

• Separate work and personal contact details: This can reduce confusion when an unexpected request arrives.

• Verify payment changes verbally through a known number: Don't call the number supplied in the message.

• Treat unexpected MFA prompts as suspicious: A prompt you didn't initiate may signal an attempted account takeover.

• Report near-misses internally: Security teams can identify repeated messages without asking staff to forward sensitive screenshots publicly.

• Protect the email account behind the phone number: Use multifactor authentication, unique passwords, and phishing-resistant methods where available.

The connection to email matters. An attacker may begin with an SMS, collect enough information to impersonate a colleague, and then target a business mailbox. Email protections such as phishing detection, virus filtering, blocked tracking pixels, and limited personal data exposure can reduce what the attacker learns and how far the campaign travels.

Canadian reporting data shows why this deserves attention. During the 2023–24 reporting period, the Canadian Anti-Fraud Centre received 5,395 reports of phishing text messages, and Canadians lost nearly $24 million in fraud cases where a text was the first point of contact (Canada's Anti-Spam Legislation performance report). Those reported cases don't capture every incident, but they show that a text can open a much larger fraud.

Forward suspicious messages to 7726 and report suspected fraud to the Canadian Anti-Fraud Centre. For email accounts, choose services and settings that limit tracking and unnecessary data collection, while recognising that no provider can remove every social-engineering risk.

Frequently Asked Questions

What is the difference between smishing and phishing?

Phishing is the broad term for scams that impersonate a trusted organization to steal information. Smishing is phishing delivered by text message. Email phishing arrives in your inbox, while smishing arrives as an SMS on your phone. Both aim to get your passwords, payment details, or personal information. Texts can feel more urgent and personal, and they show less detail to inspect. That makes smishing easier to fall for, even for people who spot phishing emails easily.

What should I do if I clicked a link in a smishing text?

Close the page right away and don’t enter any information. If the site asked you to install an app or profile, remove it through your device settings. If you entered a password, change it immediately, starting with your email account. Turn on multifactor authentication wherever you can. If you shared banking or card details, call your financial institution using the number on your card. Then report the incident to the Canadian Anti-Fraud Centre.

Should I reply STOP to a scam text?

No. Replying to a scam text, even with STOP or NO, confirms that your number is active. That can lead to more scam messages. Instead, forward the text to 7726 so your mobile provider can investigate, then delete it. Replying STOP is only safe with businesses you know and have dealt with before. Under Canada’s anti-spam law, legitimate senders must honour unsubscribe requests. Scammers ignore the law and use replies to target you again.

How do I report a smishing text in Canada?

Start by forwarding the text to 7726, which spells SPAM on most keypads. Your mobile provider uses these reports to block similar messages. You can also report the message to the CRTC’s Spam Reporting Centre. If you lost money or shared personal information, report it to the Canadian Anti-Fraud Centre. You should also contact your bank directly. Delete the text after reporting it, but keep a screenshot in case investigators need it.

Can a smishing text come from a number I recognize?

Yes. Scammers can spoof phone numbers so a text appears to come from your bank, a government agency, or a known contact. Some use devices called SMS blasters, which imitate cell towers to send fake texts to nearby phones. A familiar number or an existing message thread doesn’t prove a text is real. If a message asks you to log in, pay, or share a code, verify it first. Use the organization’s official app, website, or a phone number you already trust.

---

Typewire provides ad-free, encrypted email hosted on infrastructure we operate in Canada, with phishing detection, virus filtering, tracking-pixel blocking, aliases, and custom-domain support. If you want to reduce data exposure and keep email security part of your broader smishing defence, visit Typewire to learn about our plans and free trial.

Last updated: October 5, 2026

You've checked your junk folder three times, searched for the invoice, and still can't find the client's reply. Then you notice the message was filtered because your mailbox didn't recognise the sender. Adding that address to your contacts can help, but it doesn't always create a true safe sender list.

To whitelist an email address, first verify the sender, then add the address or domain to your provider's trusted-sender controls. In Gmail, create a filter with Never send it to Spam. In Outlook, add the address under Safe senders and domains. In Apple Mail, use a contact, VIP, or rule. If you manage a business domain, also check authentication and server-side filtering.

The important detail is that whitelisting is only one layer of deliverability. Provider rules, sender reputation, authentication, security policies, and privacy obligations can still affect where a message goes.

What does whitelisting mean

Whitelisting means telling your email system that a specific sender is trusted. Many providers now use the term allowlisting, but the practical idea is the same. You add an email address or domain to a safe sender list so messages from that source receive more favourable treatment during filtering.

Adding someone to your contacts isn't always the same thing. A contact entry helps your address book recognise the sender, but it may not instruct the spam filter to bypass its normal checks. A filter or safe-sender rule usually has a stronger effect because it creates a direct instruction for matching messages.

Think of your inbox as a building with a reception desk. A contact is a name in the visitor book. An allowlist rule is a note telling reception to send a known visitor to a specific office. Neither instruction should replace checking identification, especially when an attacker can imitate a trusted name.

What happens when a message arrives

Your provider evaluates several signals before placing a message. These can include the sender address, domain reputation, message patterns, authentication results, links, attachments, and your own rules. A whitelist rule can influence that decision, but it doesn't rewrite the message or prove that the sender is legitimate.

That distinction matters when you add an entire domain. If you allowlist example.ca, you may trust every address using that domain. That can be useful for a company with several departments, but it also creates a wider permission than approving one known address.

For a clear explanation of the filtering layer behind these decisions, see how spam filtering protects your email security.

Practical rule: Approve the narrowest sender identity that solves the problem. Use a single address when you only need one person's messages, and use a domain only when you trust the organisation as a whole.

Before you add a sender, inspect the complete address, not just the display name. A message labelled “Your accountant” could come from an unrelated domain. Whitelisting should reduce false positives, not turn off your judgement.

Why whitelist a sender

A customer is waiting for an invoice, but the billing platform sent it from an address your team does not recognise. Your provider sees an automated message, unfamiliar sender, or link-heavy template and moves it to junk. The business is legitimate, yet the message still misses the inbox.

Whitelisting can reduce that kind of false positive by giving your mailbox a clearer instruction about a sender you already trust. Its scope is narrow. It leaves a compromised account, a broken sender domain, and delivery from other addresses in the organisation untouched.

Canadian inbox placement isn't uniform

Mailbox providers apply different filtering rules. Validity's 2025 benchmark report found 86.7% inbox placement in Canada overall, with 5.4% of mail sent to spam and 7.9% missing. Microsoft performed worse, at 78.9% inbox placement and 10.6% spam.

The same report found that Shaw, Bell, Rogers, Videotron, and Teksavvy averaged 84.1% inbox placement, below the country benchmark. Those results explain why “just add us to your contacts” can be incomplete advice. A provider may still apply reputation, authentication, and security controls after a sender is added.

Convenience must not weaken security

A safe-sender rule suits recurring, legitimate communication, such as messages from a payroll service, known legal adviser, or customer who regularly sends project files. A broad rule for an unfamiliar marketing domain can grant more access than the business need requires.

The Canadian Consumer Handbook guidance on spam warns that opening spam can confirm an address is active because hidden code may report that the mailbox was opened. It recommends deleting spam without opening it and using your email software's filtering controls. Whitelist known senders, then review messages from them with the same care as any other email.

Privacy gives Canadian businesses another reason to keep rules narrow. PIPEDA doesn't regulate whitelists directly. Its safeguards principle does expect organisations to protect personal information with security suited to its sensitivity. A broad domain rule can let more unverified mail reach staff who handle client records. Approve a whole domain only when you have a clear business reason. Review your rules whenever a supplier, employee, or service changes.

A whitelist answers one question, “Should this sender receive more favourable delivery treatment?” It does not answer, “Is this particular message safe?”

For a practical explanation of common filtering causes, read why email goes to spam and how to fix it.

How to whitelist in Gmail, Outlook, Apple Mail

Start with the exact sender address from a message you trust. Don't copy only the display name, and don't add a whole domain until you understand who controls it. If a message is already in spam, mark it as Not spam or move it to the inbox before creating a permanent rule.

Gmail

Gmail doesn't provide a button named “whitelist,” so you create a filter:

1. Open Gmail in a browser.

2. Select the settings gear, then choose See all settings.

3. Open Filters and Blocked Addresses.

4. Select Create a new filter.

5. Enter the sender address in the From field. You can enter a domain if you intentionally trust the whole organisation.

6. Choose Create filter.

7. Select Never send it to Spam, then choose Create filter again.

Add the verified sender to Google Contacts as a second, narrower signal. On a phone, Gmail generally gives you actions such as Report not spam or Move to Inbox, while detailed filter creation usually requires the web interface.

Outlook

Outlook has a dedicated safe-sender control. In Outlook.com, open settings, choose View all Outlook settings, then go to Mail and Junk email. Under Safe senders and domains, select Add, enter the address or domain, and save.

In Outlook for Windows, open Home, select Junk, and choose Junk Email Options. Open Safe Senders, select Add, enter the address, and confirm. The web and desktop settings may not always behave identically if a workplace administrator applies additional policies.

Apple Mail

Apple Mail doesn't use one universal safe-sender list across every account. The underlying provider, such as iCloud, Gmail, or a business server, may control the actual filtering. In the Mail app, open a trusted message and add the sender to Contacts. You can also mark important people as VIPs so their messages receive priority in your mailbox.

For a stronger rule on a Mac, open Mail, go to Settings or Preferences, select Rules, and create a rule that matches the sender. Set the action to move matching messages to the inbox. Test the rule with a non-sensitive message before applying it broadly.

Typewire

We provide custom filters, anti-spam protection, phishing detection, and virus filtering. The practical result is that you can create a trusted-sender rule while keeping separate security checks active. Our ad-free service also avoids using message contents for targeted advertising or data mining, and paid plans support custom domains and unlimited sending.

That doesn't mean a trusted-sender rule should cover every message from an unknown domain. Keep the address specific, review older rules, and check the full sender identity before approving it.

How to whitelist on your own domain or server

A small business often needs more than personal inbox settings. If messages arrive through a company domain, a provider or administrator may filter them before an individual user ever sees them. A personal safe sender list cannot override every organisation-wide policy.

Start by separating inbound allowlisting from sender authentication. An allowlist tells your system which external sources it may trust more. Authentication helps receiving systems check whether a message was authorised by the sending domain.

Confirm the sending domain

Three common standards matter here:

• SPF, or Sender Policy Framework, lists the servers authorised to send mail for a domain.

• DKIM, or DomainKeys Identified Mail, adds a cryptographic signature that receiving systems can verify.

• DMARC, or Domain-based Message Authentication, Reporting, and Conformance, tells receivers how to handle messages that fail authentication and helps domain owners monitor abuse.

These standards don't create a personal whitelist. They establish a technical identity for the domain, which helps receiving providers distinguish authorised mail from messages that merely claim to come from that domain.

For a practical explanation of SPF and its role in approved sending servers, see what an SPF record does.

Use domain rules carefully

If your team needs messages from a software vendor, ask for the exact sending domain and confirm that the vendor controls it. Avoid approving a broad parent domain when the vendor uses a narrower subdomain for transactional mail. Keep a record of who approved the rule and why.

A business should also review its email security gateway, mailbox policies, and antivirus filtering. A gateway rule may override a user's Outlook or Gmail setting. Ask your administrator to test a legitimate message and an unauthorised message, then confirm which layer made the delivery decision.

Keep privacy in the process

PIPEDA covers private-sector organisations that collect, use, or disclose personal information during commercial activity. Alberta, British Columbia, and Quebec have their own private-sector privacy laws for most activity within those provinces. PIPEDA still applies to federally regulated businesses, such as banks and telecoms, and to information that crosses provincial or national borders.

The Office of the Privacy Commissioner of Canada (OPC) sets out 10 fair information principles in its PIPEDA overview. Email addresses and message contents can count as personal information, depending on context. Your allowlist contains email addresses, so treat it as operational data. Limit who can edit it, remove entries you no longer need, and don't share message contents with a third party just to fix a filtering issue. See the Commissioner's PIPEDA overview for organizations.

Treat allowlist records as operational data. Limit access, remove obsolete entries, and don't share message contents with a third party just to resolve a filtering issue.

Troubleshooting

Adding a sender to Contacts does not guarantee inbox placement. Filtering may occur at the provider, organisation, gateway, or sender level, and a message may be rejected before it reaches your mailbox. Diagnose the failure in this order:

1. Search every folder. Check Spam, Junk, Trash, Archive, quarantine, and focused inbox views.

2. Inspect the exact address. Confirm the domain, spelling, and display name. A familiar name can mask an unrelated address.

3. Review rule priority. Delete, archive, forwarding, or quarantine rules may run before your allowlist.

4. Check provider policy. Work and school accounts can override personal settings.

5. Ask the sender to verify authentication. SPF, DKIM, and DMARC failures can affect delivery even when you trust the sender.

6. Test safely. Do not load images or click links in a suspicious message while investigating.

Don't approve an impersonator

A trusted display name can conceal a different address. Confirm the complete address and sending domain before approving a rule. Broad approvals can make phishing easier, particularly when an attacker copies a familiar brand or contact name.

Check the sender's identity against a source you already trust before you approve them. For example, compare the address with a signed contract, a past invoice, or the vendor's official website. Don't rely on contact details inside the suspicious message itself. The OPC's interpretation bulletin on safeguards makes a similar point for businesses. It expects organisations to authenticate people properly before granting access to personal information. Several OPC findings involve imposters who got through because checks were weak.

The OPC's spam guidance notes that most email providers filter spam before it reaches your inbox. Whitelisting works alongside those filters, not instead of them.

Frequently Asked Questions

Is whitelisting the same as adding someone to my contacts?

Not always. Adding a sender to your contacts helps your mailbox recognise them, but it may not override the spam filter. A whitelist rule gives the filter a direct instruction. Examples include a Gmail filter set to Never send it to Spam, or an Outlook safe sender entry. For the best result, do both. Add the verified sender to your contacts, then create a rule for their exact address.

Should I whitelist an email address or a whole domain?

Whitelist a single address when you only need messages from one person or service. Whitelist a domain only when you trust the whole organisation and have confirmed it controls that domain. A domain rule covers every address on it, including ones you've never seen. If a vendor sends invoices from a subdomain, such as billing.example.ca, approve that subdomain instead of the parent domain.

Why are emails from a whitelisted sender still going to spam?

A whitelist rule is one signal among many. Your provider may still filter messages that fail SPF, DKIM, or DMARC checks. A sender with a poor reputation can also be filtered. Workplace accounts may have server-side policies that override personal settings. To fix it, confirm the rule matches the exact sending address and check whether another rule runs first. Then ask your administrator or the sender to verify their authentication.

Can I whitelist an email address on my phone?

Partly. Most mobile email apps let you mark a message as not spam or move it to your inbox, which helps train the filter. Creating a permanent rule usually requires a browser or desktop app. Gmail filters need the web version. Outlook safe senders are easiest to manage in Outlook.com or the desktop app. Apple Mail rules require the Mail app on a Mac.

Is it safe to whitelist an email address?

Yes, if you verify the sender first. Check the full email address, not just the display name, since attackers often copy familiar names. If an approved account is hacked or spoofed, a whitelist rule can help phishing reach your inbox. Keep rules specific and remove ones you no longer need. Treat links and attachments from whitelisted senders with the same caution as any other email.

Typewire provides ad-free, encrypted email with Canadian hosting, custom-domain support, filtering controls, and no data mining. Visit Typewire for a private mailbox with trusted-sender rules alongside phishing and virus protection.