The Government Health-Card Email That Looked Safe to Scanners

1. What we investigated

Are the emails claiming to come from the government of Canada fraudulent and if so can we identify their source and intent?

The reported email

On July 17, 2026, a potential victim forwarded an email to InboxSpotter and opted in for CSRF to research it. InboxSpotter says: "Emails are anonymized and never sold or shared." The recipient's name and email address are redacted from this public report.

The message impersonated the Government of Canada and Service Canada with a health-card renewal lure. It claimed the recipient needed to update and verify an account, offered a "Continue to Portal" link, and described supposed home-delivery and service-location pickup options for a replacement card.

2. What we found

The July 17, 2026 email is a phishing scam impersonating the Government of Canada / Service Canada, built to harvest people's personal and identity details. It is heavily disguised: the link runs through a fake "security check," and the page only reveals itself to visitors who look like genuine Canadian targets. Anyone else (wrong location, a VPN, or a researcher) is redirected to the real canada.ca, so nothing looks wrong and most automated scanners rate it clean. We confirmed the whole chain was live during our analysis and mapped every step, but could not reach the final form itself, which stays hidden behind those checks. The evidence points to a single group running this wave of emails, though the disguise technique it relies on is a common one seen across many unrelated scams.

Status update (August 7, 2026): Since this investigation was conducted, the Vercel deployment that handled the email's redirect has been taken down and the chain we mapped is no longer active. The operator, however, is still at work: on August 7 the same GitHub account was uploading fresh logo assets, including the logo of Germany's Federal Motor Transport Authority (KBA). That strongly suggests the campaign is continuing on new addresses and expanding beyond Canada to German government lures. We have reported the account to GitHub. This doesn't change the lesson: the operation is cheap and disposable, the same setup can be rebuilt quickly under a new address, and a "clean" scan result still doesn't prove an email is genuine.

3. Why this matters

This scam targets ordinary Canadians with a government and health-card lure and is built to steal identity information, so warning the public directly has real protective value. It matters more than the average scam because its layered disguise makes it nearly invisible to automated defenses. Scanners and browsers rate it clean, so people won't get an automatic warning, and a plainly written explanation is one of the few things that can actually reach them. It is also part of a wider wave that can reappear under new addresses, so the guidance stays relevant even now that the chain we mapped has gone offline.

4. How we reviewed the email

Work period: Email received July 17, 2026, analysis conducted July 28 – August 3, 2026.

Sources covered:

• Phishing email
• Sender domain and its Amazon SES delivery record
• GitHub account and repositories hosting the lure image
• Redirect/gate and the landing infrastructure
• urlscan.io (existing public scans plus our own unlisted Canada/mobile scans)
• ANY.RUN interactive detonation
• Certificate Transparency logs
• Public reference sources (Canadian Anti-Fraud Centre guidance, Amazon SES documentation).

Exclusions:

• We did not reach or capture the form or its exact fields.
• We did not establish the identity of the operator.
• The email's original authentication results were stripped when the message was forwarded, so it is uncertain whether the sender is spoofed or compromised.

5. What we observed directly

6. What other sources reported

7. How the evidence fits together

The trap only springs for the "right" victim. The scam checks each visitor and shows its fake Service Canada form only to someone who looks like a real Canadian target on a normal home or mobile connection. Everyone else, including security scanners and researchers, is redirected to the legitimate canada.ca instead. Because of this, automated tools rate it clean: most of the time it appears to be a real government site. It's also cheap and disposable, run on free, trusted internet services and sent through an ordinary bulk-email tool. Therefore shutting down one piece doesn't stop it as the operators are able to rebuild quickly.

The evidence gives us a profile of who is behind it but not an identifiable person. Independent clues (a reused image, the timing of the work, and language traces) line up, and together they suggest a single operator working in an East-Asian, Chinese-language setting.

We found several near-identical versions of the same setup, which points to one group running an ongoing operation rather than a single email. At the same time, the particular hiding trick it uses turns up across many unrelated scams, so that technique is not something unique to this group.

Finally, the email reached inboxes by abusing a small, unrelated business's identity: it was pushed out through a legitimate mass-email service under that business's address. What we still can't say is exactly what the final form asks victims for. We never got past its defenses to see it.

8. Why this is a scam

9. What we could not confirm

10. Bottom line

This is a hidden phishing operation impersonating the Government of Canada / Service Canada to steal Canadians' personal and identity information. It showed its fake form only to the "right" victims and quietly sent everyone else, including security scanners and researchers, to the real canada.ca, which is why it slipped past automated checks. The specific chain we mapped is no longer active as of August 7, 2026, but the operator remains active: on August 7 the same GitHub account was uploading new government logo assets, including Germany's Federal Motor Transport Authority (KBA), indicating the campaign is continuing and expanding to German government lures.

Confidence

High — that it's a phishing scam; that the chain worked as described, with layered cloaking and a decoy to the real government site; that it was live during our analysis and running as more than one campaign (one operator behind this cluster).

Moderate — the operator's location/language profile; that the sender's identity was abused.

Low / unresolved — exactly what the final form collects (never captured); who the operators actually are; any real link to the separate Canadian-branded toolkit lead.

What we will do next

The scam's landing page sat on a .my.id domain — a cheap corner of the internet's naming system that offers scammers disposable, trusted-looking web addresses. CSRF will follow up with a dedicated investigation into abuse of the .my.id domain space and publish what we find.