An interview with cybercrime prevention expert Kathy Macdonald, M.O.M., MSc., CPP
By Edward Leslie-MacDonald, Communications Lead | Reviewed by Caroline O’Brien, Compliance Specialist
“Cybersecurity is about people, not technology. Cybercrime is an attack on our state of mind, so we are the human firewall.”
— Kathy Macdonald, M.O.M., MSc., CPP
AI has made scams harder to spot. Phishing emails now arrive with perfect grammar, and a cloned voice can sound exactly like someone you love. Video calls can be faked.
Kathy Macdonald has worked on this problem since the dial-up era. She began in cybercrime prevention with the Calgary Police Service in 2000, and she has since advised on the issue internationally.
Ahead of Bellwether’s October 20 webinar, Cybersecurity: Protect Yourself in the AI Era, our Communications Lead, Edward Leslie-MacDonald, sat down with Kathy to talk about how AI has changed the way these scams work and how people can protect themselves without becoming technical experts.
Fraud losses in Canada show the scale of the problem. In the first half of 2026 alone, the Canadian Anti-Fraud Centre (CAFC) recorded $351 million in reported losses. The real number is higher: the CAFC estimates that only 5% to 10% of frauds are reported.
| Category | Approximate reported loss |
| Investment fraud | $139.6 million |
| Spear phishing | $57.7 million |
| Bank investigator fraud | $28.6 million |
| Extortion | $25.5 million |
| Recovery fraud | $13.7 million |
| Source(s): Canadian Anti-Fraud Centre (CAFC), Fraud Trends–First 6 Months of 2026. As at August 25, 2026. | |
Edward: Kathy, you began your cybersecurity career in 2000, in the middle of your career with the Calgary Police Service. What drew you to this area in the first place?
Kathy: Back then, police services really were not prepared for what the internet was bringing. The public was starting to buy computers, use auction sites, get into social networking—and they were running into fraud, bullying, scams, exploits, hacks, and viruses.
They would call the police to report an incident, and often they were directed to crime prevention. Traditionally, that was physical crime prevention. But it became virtual or electronic crime prevention very quickly.
It was a steep learning curve. I was not a technical person, but I had to learn. I learned from the people who had been impacted—personally, professionally, socially, and emotionally—by things that were happening online.
Edward: You mentioned that people were directed to the crime prevention unit. How does being proactive connect with cybersecurity today?
Kathy: In crime prevention, we look at trends and try to see what is coming down the line. We were looking at different kinds of crime happening in the United States and heading our way. We became one of the first police agencies to build an identity-theft program.
Our team developed programs, delivered them in the community, and they kept evolving because technology kept evolving. The more people understood what was happening, the more proactive they could become.
Edward: You began in the dial-up days. What has changed most in how criminals, or “threat actors,” target ordinary people?
| Definition of threat actor: any person, group, or organization that intentionally or negligently causes harm, creates risk, or carries out an attack against digital systems, networks, or data. |
Kathy: Technology keeps evolving, progressing, and advancing at an accelerating rate. It often comes to us as something that can make life more convenient, healthier, happier, or more fun. Then, sure enough, it gets exploited in some way.
That is the constant: every technology can be exploited. The evolving part is that technology keeps improving. Something can be created for one purpose, then used for a completely different purpose. You do not always know what that purpose is until it hits the market.
Edward: What are you seeing now that concerns you most?
Kathy: Cybercriminals, organized crime, and other actors have embraced AI. They are using large language models for phishing, spear phishing, and business email compromise. There are no spelling mistakes or grammatical errors.
They are using photos to make people appear real. They are using deepfake video and voice apps to clone voices for scams and cons. The stories can be believable, well crafted, and available in any language instantly.
You may hear the voice of someone you recognize, see a photo that looks real, or believe the story being told. That is why these scams are an attack on people’s state of mind.
Edward: That phrase—an attack on someone’s state of mind—reminds me of a term I’ve heard thrown around: what does social engineering look like today?
| Definition of social engineering: the use of psychological manipulation to trick people into giving away sensitive information, downloading bad software, or breaking security rules. Instead of hacking a computer system with code, attackers hack human nature. |
Kathy: Social engineering is present in almost every kind of cyberattack, from ransomware through to cyberbullying. The tactics have been around for decades. They work. They have just modernized because of AI.
Timing is one example. Attacks may happen when we are busiest: tax season, graduations, weddings, holidays, floods, or other crises. That is when people can be distracted. They use disguises, anonymity, and stories that seem official or believable. The purpose is to influence our decisions.
Edward: How does the personal information we share online create opportunities for that?
Kathy: I think people do not realize there are people watching us. It could be something innocent: you are excited to go to Mexico and post about it online. It does not take much to find out where you live, what you look like, and where you are going.
We never really know what someone may be interested in about us. That is why we need to be selective, proactive, and recognize that our information is valuable.
Edward: Cybersecurity can sound intimidating. How much technical expertise does someone need to protect themselves online?
Kathy: I do not think it has to be technical. People need to be rational, not emotional, when they go online.
The internet is fast, and it is easy to become emotional—to pull out a credit card, talk to someone you should not, or let down your guard. Listen to your intuition. We sometimes rely too heavily on the technical side to warn us instead of paying attention to the red flags that tell us something does not quite make sense.
Ask why:
“Why” is a very powerful question.
Edward: Is there an easy way to remember these best practices for keeping yourself safe online?
Kathy: I wanted a proactive way for people to defend themselves against social engineering. The RISK model is:
Being kind does not just mean being pleasant online. It means telling someone if you see their photo being used, an email being sent in their name, or something else that looks suspicious.
Edward: Speaking of suspicious: If a call, email, text, or video appears to come from a financial advisor or another trusted person, but something feels off, what should someone do before acting?
Kathy: Ask someone you trust. Contact the bank, a close friend, or a trusted advisor—but do not follow the number or link in the email or text. Go independently to that trusted person. Use a phone number or URL you already know.
Get a second opinion. Emotions can be very powerful, and sometimes they overpower our better judgment. It helps to have somebody you can bounce things off of.
Edward: If you could encourage everyone to adopt one habit that protects them across different types of scams, what would it be?
Kathy: Understand how social engineering works. Realize that there is always more to the story. Ask why, take your time, and do not rush into things.
The internet is so fast. Sometimes we click on things without really thinking. Going slower can prevent a number of problems.
Edward: Looking ahead, what do you see as the greatest defence against cybercrime?
Kathy: People are going to realize that personally identifiable information, biometric information, and financial information are targets, and they will start protecting them more carefully.
Cybersecurity is about people, not technology. Cybercrime is an attack on our state of mind, so we are the human firewall. We need to become aware of the risks and understand how we can be more proactive.
Kathy Macdonald, M.O.M., MSc., CPP, is a retired Calgary Police Service officer with almost three decades of investigative and crime prevention experience. She holds a master’s degree with merit in Security and Risk Management from the University of Leicester and is an ASIS International Certified Protection Professional. In 2009, the Governor General of Canada invested her as a Member of the Order of Merit of the Police Forces, and IT World Canada named her one of the Top 20 Women in Cyber Security in 2020. She is the author of Cybercrime: Awareness, Prevention, and Response and has taught cybercrime prevention through the University of Calgary. kathymacdonald.ca
