What are the red flags of this scam?

An email arrives from a familiar supplier or executive just before a large payment is due — with 'updated' banking details • The sender's email address has a one-letter typo or uses a look-alike domain (e.g. vendor-corp.ca vs vendor-corp.com) • The request carries urgency: 'process today or we lose the contract / the client / the property' • The email asks you to keep the change confidential or to bypass your normal two-person approval process • The 'executive' asks by email or text to wire funds right now — without a voice confirmation on a known number • A callback number is provided in the same email — fraudsters answer it; call the number you already have on file

What should I do if this happened to me?

Before changing any payee's banking details, call the supplier or executive directly on a phone number from your own records — not one provided in the suspicious email • Establish a two-person approval rule: no single employee can authorise a wire change or a new payee alone • If you have already sent a wire, call your bank within minutes — same-day reporting is the only realistic window for recall • Enable multi-factor authentication on all company email accounts — compromised inboxes give fraudsters months of payment intelligence before they strike • Report to the CAFC's Report Cybercrime and Fraud portal immediately — fast reporting coordinates financial institution intercept requests • Report to the Canadian Anti-Fraud Centre at https://antifraudcentre-centreantifraude.ca or call 1-888-495-8501.

CRITICAL phishing Last reported: Oct 7, 2026 Share

A spoofed supplier or executive email redirects your company's wire payment to a fraudster's account

Q: Is this a scam?

Yes. This is a documented scam pattern. A fraudster spoofs or compromises a supplier, lawyer, or executive email and sends updated banking details just before a large payment is due. The company wires to the fraudster. CAFC reports $57.7M in spear-phishing losses in H1 2026 alone — nearly matching all of 2025.

A fraudster spoofs or compromises a supplier, lawyer, or executive email and sends updated banking details just before a large payment is due. The company wires to the fraudster. CAFC reports $57.7M in spear-phishing losses in H1 2026 alone — nearly matching all of 2025.

Also known as: business email compromise Canada, BEC scam Canada, payment redirection fraud Canada, fake invoice bank details Canada, CEO fraud Canada, vendor email compromise Canada, spear phishing wire transfer Canada

Already happened to you? Do this in the next few minutes

1 Call your bank or card's fraud line right now. Use the number on the back of your card — not any number from the message or caller. Ask them to stop or reverse the payment and freeze the account.
2 If you paid by gift card, wire, or an app (Zelle, Venmo, Cash App): contact that company immediately and report it as fraud. Acting fast sometimes recovers the money.
3 Report to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. The sooner, the better.

What to do right now

1 Before changing any payee's banking details, call the supplier or executive directly on a phone number from your own records — not one provided in the suspicious email
2 Establish a two-person approval rule: no single employee can authorise a wire change or a new payee alone
3 If you have already sent a wire, call your bank within minutes — same-day reporting is the only realistic window for recall
4 Enable multi-factor authentication on all company email accounts — compromised inboxes give fraudsters months of payment intelligence before they strike
5 Report to the CAFC's Report Cybercrime and Fraud portal immediately — fast reporting coordinates financial institution intercept requests
6 Report to the Canadian Anti-Fraud Centre at https://antifraudcentre-centreantifraude.ca or call 1-888-495-8501.

Red flags

⚠ An email arrives from a familiar supplier or executive just before a large payment is due — with 'updated' banking details
⚠ The sender's email address has a one-letter typo or uses a look-alike domain (e.g. vendor-corp.ca vs vendor-corp.com)
⚠ The request carries urgency: 'process today or we lose the contract / the client / the property'
⚠ The email asks you to keep the change confidential or to bypass your normal two-person approval process
⚠ The 'executive' asks by email or text to wire funds right now — without a voice confirmation on a known number
⚠ A callback number is provided in the same email — fraudsters answer it; call the number you already have on file

Known variants

Small-business customer list compromise: fraudsters access a service company's customer management software (snow removal, landscaping, HVAC) and send fake pre-season invoices demanding Interac e-Transfer. Customers familiar with recurring billing pay before verifying. ~40 Quebec snow removal companies affected Sept 2026.

Last seen: 9/22/2026

Already happened to you? Do this in the next few minutes

What to do right now

Red flags

Known variants

Sources