An email arrives from a supplier you have paid for years. Same logo, same signature, same tone. It says they have changed banks and asks you to update their details before the next payment. You do, the payment goes out, and a week later the real supplier calls asking where their money is. This is business email compromise, sometimes called payment redirection fraud, and the Canadian Anti-Fraud Centre lists it among the main frauds targeting Canadian businesses. Small firms in the Fraser Valley and the Lower Mainland are attractive targets because one person often handles both the email and the payments.
How the scam usually works
- Supplier impersonation. A criminal sends an invoice or a "new banking details" notice that looks like it comes from a vendor you already pay.
- A compromised mailbox. Sometimes the supplier's real email account, or yours, has been taken over. The fraudster reads the conversation for weeks, then replies inside a genuine thread at exactly the right moment.
- Look-alike domains. An address such as accounts@abc-supp1y.ca instead of abc-supply.ca is easy to miss on a phone.
- Owner or manager impersonation. A message that appears to come from the owner asks the bookkeeper to make an urgent transfer or buy gift cards, usually while the owner is "in a meeting" or travelling.
The common thread is pressure and a change to how money moves. That is exactly where a few controls make the biggest difference.
Warning signs to train your team on
- Any request to change banking or payment details, however routine it looks.
- Urgency, secrecy or a request to skip the usual approval.
- A sender address or reply-to address that is slightly different from normal.
- A first-time payee, an unusual amount or payment to an account in a different name or country.
- A request to move the conversation to text or a personal email address.
Process controls that stop it
- Call back on a known number. Before changing any supplier's banking details, phone them using a number from your own records or their website, never a number in the email asking for the change.
- Two people for payment changes. One person requests the change, another approves it. Even in a three-person office this is possible.
- Hold new or changed payees. A short waiting period and a small test payment confirmed by phone catches most attempts.
- Write it down. A one-page payment procedure that everyone follows, including the owner, removes the awkwardness of questioning a request from the boss.
Technical controls that close the door
- Multi-factor sign-in on every mailbox, especially for anyone who touches finance. Most mailbox takeovers start with a stolen password.
- Alerts on suspicious mailbox rules. Attackers often create rules that hide or forward replies. Microsoft 365 and Google Workspace can alert you when these appear.
- External sender tags so staff can see at a glance when a message comes from outside the organization.
- Email authentication (SPF, DKIM and DMARC) on your own domain, so criminals have a harder time sending email that appears to come from you.
- Separate accounts for banking, with the bank's own alerts and approval features switched on.
If money has already been sent
- Call your bank immediately and ask them to contact the receiving bank to try to stop or recall the transfer. Speed matters more than anything else.
- Report it to your local police (RCMP or municipal police, depending on where you are) and to the Canadian Anti-Fraud Centre online at reportcyberandfraud.canada.ca or by phone at 1-888-495-8501.
- Secure the mailbox. Reset passwords, sign out all sessions, remove unknown forwarding rules and check what else the attacker could see.
- Consider privacy obligations. If personal information about customers or employees was exposed, BC's PIPA and, for some organizations, the federal PIPEDA may require you to assess the breach and in some cases notify people or a privacy commissioner.
- Tell your insurer if you carry cyber or crime coverage, and keep copies of every email and transaction record.
This article is general information, not legal advice. A lawyer can confirm your obligations under PIPA or PIPEDA after an incident.
How we help
Bitlogix helps small businesses in Mission, Abbotsford, Chilliwack, Langley and across the Lower Mainland lock down Microsoft 365 and Google Workspace, set up multi-factor sign-in, configure email authentication and put simple payment-approval steps in place, with remote support anywhere in BC. Book a free 30-minute consultation and we will review your email security and payment process with you.
Useful references
- Frauds targeting businesses, Canadian Anti-Fraud Centre
- Report Cybercrime and Fraud, RCMP and Canadian Anti-Fraud Centre
- Baseline cyber security controls for small and medium organizations, Canadian Centre for Cyber Security
- Office of the Information and Privacy Commissioner for British Columbia: guidance on privacy breaches under PIPA
Cover photo by Nathan Dumlao on Unsplash.