Stopping invoice and e-transfer fraud

How the fraud works

Business email compromise is one of the most costly frauds affecting Canadian businesses. In a typical case, a criminal gains access to a mailbox at your business or at one of your suppliers, often through phishing. They read past conversations quietly, sometimes for weeks, learning who pays whom, how invoices look and when large payments are due.

At the right moment, they send a convincing message, often from the real account or a lookalike domain, saying that banking details have changed. The invoice looks genuine because it is based on real ones. The payment goes to an account the criminal controls, and the money is moved on quickly. Variations include fake executive requests for urgent transfers and payroll deposit changes for employees.

Make verification a firm rule

The single most effective control is a simple, non-negotiable rule: any change to banking details, or any unusual payment request, must be verified by phone using contact information already on file, never a number or link supplied in the request. The call should confirm the details directly with a known person, not just ask whether the email is genuine.

Apply the rule to everyone, including the owner. Criminals frequently impersonate senior leaders because staff hesitate to question them. Leaders should tell their teams, in writing, that they will never be offended by a verification call and that bypassing the process is not acceptable even when they appear to request it.

• Verify all banking changes by phone from known records
• Require two people to approve new payees or large payments
• Hold first payments to new accounts for a set period
• Never verify using contact details in the request

Interac e-Transfer and payment platform risks

Interac e-Transfers are fast and convenient, which also makes them attractive to fraudsters. Once a transfer is deposited, recovering it can be very difficult. Be cautious with autodeposit requests from new contacts, and confirm any request to send an e-Transfer to a new email address or phone number through a separate channel.

Use your bank's business controls where available, such as dual approval, daily limits, and alerts for new payees and large transactions. Ask your bank what fraud protections it offers for business accounts and what its reporting process is. Knowing who to call before something goes wrong saves valuable time. Keep that number handy.

Strengthen the email side

Because this fraud usually begins with email, technical controls matter. Require multi-factor authentication on every mailbox, especially in finance. Block automatic forwarding to external addresses and alert on new inbox rules, which attackers create to hide replies. Configure SPF, DKIM and DMARC to make spoofing your domain harder, and tag external email clearly.

Train finance and administrative staff specifically on payment fraud, not just general phishing. Share real examples, explain how lookalike domains work and practise the verification call. People who handle payments are the targets of these attacks, so they deserve focused, practical training. Refresh this training at least once a year and whenever a new person joins the finance team.

If a fraudulent payment is made

Act immediately. Call your bank and ask it to attempt a recall of the funds, giving the date, amount and receiving account details. The chance of recovery drops quickly as time passes. Then contact your IT provider to secure any compromised mailboxes, reset passwords and check for forwarding rules. Do not wait until you are certain.

Report the fraud to your local police and to the Canadian Anti-Fraud Centre. Notify your insurer if you have cyber or crime coverage, and inform the supplier or client whose identity was used, since their systems may also be compromised. Afterward, review exactly where the process failed and fix that gap.