It's the last week of the month at a 20-person property management firm in Montréal. The bookkeeper gets an email from the firm's longtime plumbing contractor. It's a reply in an existing thread about last month's invoices, with the usual signature and the usual tone. The contractor has switched banks, it says, and here are the new account details for the attached invoice.
She updates the payee and sends $27,000. Three weeks later, the real contractor calls asking why he hasn't been paid. His mailbox had been compromised for over a month. The fraudster had simply been waiting for the right invoice.
This is business email compromise (BEC). No malware, no hacking of your systems, just a convincing message and a payment process that trusts email too much. That's also why it's fixable.
TL;DR
- BEC tricks your own staff into sending money, in good faith, to a fraudster posing as an executive, supplier or employee.
- The strongest defences are process rules: call back on a known number, require two approvals, and hold any new banking details for verification.
- Technical controls like DMARC, MFA and mailbox rule alerts shrink the attack surface, but nothing replaces the verification call.
The four faces of business email compromise
The RCMP describes several recurring variations. They all share one thing: a message that appears to come from someone you trust.
| Variant | Typical scenario | Red flag |
|---|---|---|
| CEO fraud | An executive asks for an urgent, confidential wire transfer | Urgency, secrecy, bypassing normal approvals |
| Supplier invoice fraud | A vendor announces "new banking details" | Account change requested by email, often at month-end |
| Payroll diversion | An employee asks HR to change their direct deposit | Request comes by email only, with no in-person check |
| Gift card scam | The boss asks you to buy gift cards "for clients" | Request to photograph and send the card codes |
The classic CEO fraud is the one people have heard of: "I'm boarding a plane, I need this wire done before 4 p.m., keep it between us." The supplier variant is sneakier, because it blends into a routine you perform every month. A Gatineau general contractor paying the same concrete supplier every month has no reason to question an invoice for the usual amount. Only the account number changed.
How fraudsters set it up
These attacks look improvised. They're usually well prepared.
Research. Your website, LinkedIn and press releases reveal who signs off on payments, who your suppliers are, and when your executives are travelling. A cheerful "At the trade show in Las Vegas all week!" post tells a fraudster exactly when the CEO will be hard to reach.
Lookalike domains. The fraudster registers a domain that's almost yours, or almost your supplier's: a doubled letter, "rn" in place of "m," a .com instead of a .ca. On a phone screen, the difference is nearly invisible.
Compromised mailboxes. The most dangerous version uses a real mailbox, yours or a supplier's, taken over through a phishing page that harvested the password. The fraudster reads the conversations for weeks, then replies inside a genuine thread at the perfect moment. They often add an inbox rule that hides or forwards replies so the real owner never notices.
Voice and AI. Some fraudsters follow up with a phone call or a voicemail. With voice-cloning tools that need only a few public clips, a voice that sounds like your CEO is no longer proof of anything.
What it actually costs
According to industry data cited by Insurance Business Canada (October 2025), a funds transfer fraud costs a Canadian small business $118,000 on average. The Canadian Anti-Fraud Centre recorded $67.9 million in reported losses from spear phishing in 2025, the category where these schemes are counted, making it the second costliest fraud type of the year.
Those figures only include what victims reported. Embarrassment keeps many businesses from ever reporting a loss.
Process controls that stop the fraud
BEC succeeds when one person can move money based on one email. These rules cost next to nothing and break that pattern:
- Mandatory callback: any unusual payment request or change of banking details is confirmed by phone, using a number you already have on file, never one from the email.
- Dual approval: two people approve every transfer above a threshold set by management.
- Cooling-off period: new supplier banking details are only used after independent verification and a short waiting period.
- No exceptions for the boss: leadership commits in writing to never asking staff to skip these steps. An employee who interrupts the CEO's vacation to verify a request gets thanked, not scolded.
- Protected payroll: direct deposit changes happen in person or through the HR portal, never by email alone.
- A written, known procedure: finance staff know exactly what to do and whom to call when something feels off.
These rules work because they don't ask employees to spot a perfect fake. They make the fake useless.
Technical controls that back them up
Technology doesn't replace the process, but it removes a lot of opportunities:
- Protect your domain with SPF, DKIM and DMARC so nobody can send email using your exact address.
- Turn on multi-factor authentication for every mailbox, ideally a phishing-resistant method. Our guide to choosing the right MFA compares the options.
- Alert on suspicious inbox rules and automatic forwarding to outside addresses, two classic signs of a compromised account. It's one of the settings covered in a Microsoft 365 security audit.
- Tag external email with a visible banner, and register the obvious misspellings of your domain.
- Train finance staff with realistic examples, then test the reflexes with a phishing simulation.
Our Microsoft 365 and Google Workspace audit reviews these settings and flags the ones that leave the door open.
If the money has already gone out
Every hour counts. In this order:
- Call your financial institution immediately and ask for a recall or freeze of the funds. Don't rely on email.
- Report the fraud to your local police and the Canadian Anti-Fraud Centre.
- Keep everything: the original email with full headers, invoices and related messages. Delete nothing.
- Check for a compromised mailbox: reset the password, revoke active sessions and look for suspicious forwarding rules.
- Notify your insurer, and if the fraud came from a supplier's mailbox, let that supplier know.
If a mailbox holding personal information was compromised, privacy laws such as Quebec's Law 25 may also apply. Confirm your obligations with legal counsel.
The bottom line
Business email compromise doesn't attack your technology. It attacks your habits. A company that enforces callbacks and dual approval takes away the fraudster's best weapon: pressure in the moment.
Start this week. Write down the callback rule, have leadership sign it, and walk your finance team through it. It's the cheapest security control you'll adopt this year.
Frequently asked questions
Can my bank reverse a fraudulent wire transfer?+
Sometimes, if you call right away. Your bank can try to recall or freeze the funds at the receiving institution, but there is no guarantee once the money has been withdrawn or moved on. A payment authorized by one of your own employees is generally not refunded automatically, which is why prevention matters far more than recovery.
Does cyber insurance cover CEO fraud?+
Not always. These losses often fall under a separate coverage, usually called social engineering fraud or funds transfer fraud, which may carry a lower sublimit than the rest of the policy or be excluded altogether. Review the wording with your broker before you need it.
Should we report a BEC attempt that didn't work?+
Yes. The Canadian Anti-Fraud Centre also collects attempts where no money was lost, which helps it track the schemes in circulation. Internally, log the incident, thank the employee who caught it, and warn any supplier or client whose name was used: they may be the next target.