Email says your RESP statement and government grant summary are ready. Is it a scam?
Treat it as a scam. Check your RESP by logging in to your provider’s website yourself, never through an email link.
An email says your RESP statement and Canada Education Savings Grant summary are ready, and asks you to log in to check you received your full government matching grant. It uses the name of CG Direct, a real online brokerage, but it arrived from an unrelated email address. A Pickering resident received it in August 2026, and another in Oshawa.
Is this the message you received?
Received in DurhamSubject: [CG Direct] RESP Statement & CESG Summary Available. Hello [name removed]. Your RESP statement and CESG (Canada Education Savings Grant) summary are now available. Review your statement to confirm that you have received the full government matching grants you are entitled to. Every eligible contribution can attract up to 20% in CESG. Please log in to your CG Direct account to view your RESP statement and CESG summary. [link removed]
The email arrived in English and French from an email domain unrelated to the company it names. The 20% grant figure is real, which is what makes the message sound informed. The brand name and the recipient’s name change between waves. The log-in link is the constant.
How it works
The email borrows the name of CG Direct, the online investing arm of Canaccord Genuity, which does offer RESPs. That is what makes it dangerous: a parent or grandparent with an RESP somewhere sees a familiar kind of statement notice and clicks. The link leads to a fake sign-in page that collects your username and password, and then whatever else the real account holds.
The grant detail is accurate too. The Canada Education Savings Grant adds 20% to the first $2,500 contributed to an RESP each year. Scammers use real figures because they make the email feel like it came from someone who knows your account. Nobody who runs your RESP needs you to "confirm" your grant through an email link. The grant is applied by the government and shows on the statement you see when you log in yourself.
How a real RESP provider contacts you
Banks and brokerages do send notices that a statement is ready. The safe way to read one is the same every time: open your provider’s app, or type its website address into your browser, and sign in there. If the statement is real, it will be waiting. If the email was fake, you have lost nothing.
If you do not hold an RESP with the company named in the email, the email is not for you. If you do, call the number on your last real statement before trusting anything that arrived by email.
Does CG Direct or my bank email me about RESP statements?
Many providers do send a notice when a statement is ready. The difference is what happens next. A real notice is a reminder to sign in yourself. A scam needs you to sign in through its link. Never use the link. Open the app or type the website address yourself, and the real statement will be there.
What to do
- Do not click the link. Open your RESP provider’s app or website yourself and sign in there.
- If you entered a username and password, change that password now, and the same password anywhere else you used it, then turn on two-step verification.
- Report the email as phishing in your email program, and forward it to the real company if it names one.
- If you tapped the link, entered details or paid: here is exactly what to do next, step by step.
- If this one also reached you by text, forward that text to 7726 (SPAM). How to do that on iPhone and Android.
- Got a different message? Run it through our one-minute checker.
Sources
If this has already happened to you, our scam recovery visit can lock down your accounts and devices. And if you are just not sure whether something is a scam, asking us is always free.