ETR-Invspt.ca SMS Scam Leads to Fake Interac Deposit Page

The SMS message

The reported text message uses vague official language and a direct link:

-QST confirmed and recorded-

-Update review is complete-

-Update accepted for records-

Visit update directly etr-invspt.ca/tael?XXXXXXXXXXX

The wording looks administrative but gives no real organization name, amount, file number, due date, or reason. QST may be used to make the message feel Canadian or Quebec-related, while ETR may make some users think about a toll road or transport notice. The domain is not an official Interac, bank, 407 ETR, or Government of Canada domain.

How the scam works

The chain has two stages. The SMS link on etr-invspt.ca acts as the lure and tracking step. The victim then lands on inc-gdep.com, where the page imitates an Interac deposit screen and offers a fake “Government of Canada” payment.

The amount, expiry date, reference number, Interac styling, and bank logos are there to make the page feel familiar. The important red flag is the browser address: inc-gdep.com. A real bank login or Interac flow should not be hosted on a random newly created domain.

Bank selection leads to fake login pages

After the victim selects a financial institution, the phishing site changes into a fake bank login page. The examples below show cloned CIBC and Manulife pages. They are designed to harvest credentials directly from the victim.

These pages can ask for a card number, username, password, security questions, or a one-time verification code. If the victim provides that information, the attackers may try to log in to the real banking account immediately.

Red flags in this campaign

• Strange domains: etr-invspt.ca and inc-gdep.com are not official Interac, bank, 407 ETR, or Government of Canada domains.
• Vague official wording: “QST confirmed and recorded” and “Update accepted for records” sound official but do not explain anything.
• Tracking parameter: the tael? value in the SMS link appears to identify or track the recipient.
• No real case details: there is no agency name, proper file number, amount in the SMS, or reason for the payment.
• Fake Interac flow: the page asks the user to choose a bank from a non-Interac domain.
• Credential collection: the next step is a bank login page hosted on inc-gdep.com, not on the bank’s real website.

Gridinsoft URL Scanner results

Gridinsoft URL Scanner currently classifies both domains as phishing:

• etr-invspt.ca: phishing, trust score 1/100, domain maturity around 1 day at the time of analysis.
• inc-gdep.com: phishing, trust score 1/100, domain maturity around 7 days at the time of analysis.

What to do if you opened the link

If you only opened the page and did not type anything, the immediate risk is usually low. Close the page, do not return to it, and delete the SMS. If you downloaded anything, installed anything, or allowed notifications, remove the download, revoke notification permission, and scan the device.

What to do if you entered banking details

If you entered a card number, username, password, security question, or one-time code, treat it as urgent:

1. Call your bank using the number on the back of your card or the official app.
2. Tell the bank your online banking credentials may have been entered on a phishing site.
3. Change the password from a clean device.
4. Reset security questions and review trusted devices or remembered browsers.
5. Ask the bank whether the card, online banking access, or Interac settings should be locked or reissued.
6. Review recent transactions and pending transfers.
7. If a one-time code was shared, tell the bank that too. It may mean the attacker tried to pass multi-factor authentication.

How to report it in Canada

• Forward suspicious text messages to 7726 (SPAM), which Canadian carriers use for spam reporting.
• Report fake Interac messages to Interac’s phishing reporting channel: [email protected].
• Report fraud or attempted fraud to the Canadian Anti-Fraud Centre.
• For messages impersonating the Government of Canada or CRA-style refunds, verify only through official Canada.ca scam alert guidance.

Indicators of compromise

Bottom line

This is a credential-harvesting campaign. The SMS creates curiosity with vague transport/tax-style language, then the fake Interac page creates reward pressure with a “Government of Canada” deposit. The bank selection step is the trap. Once a bank is selected, the phishing kit presents a cloned login page and attempts to collect banking credentials.

FAQ