Vendor Banking Change Fraud: How It Works and How to Stop It

The email really does come from your roofing contractor. Same address, same signature, same thread as last month. Only one thing is new: "Please note our updated banking information for payment of the attached invoice."

Three weeks later, the real contractor calls about a late payment. The $58,000 went somewhere else.

This is vendor banking change fraud, one of the costliest forms of business email compromise. Picture a property management company in Ottawa or a distributor in Laval: any business that pays suppliers by transfer is a candidate. If it's happening to you right now, start with the first section.

The payment already went out: six steps, in order

1. Call your financial institution's fraud line and ask for the funds to be frozen or recalled. Don't settle for an email. In 2025, the Canadian Anti-Fraud Centre announced the recovery of $2.3 million taken from a law firm in the Vancouver area, because a foreign bank quickly flagged the suspicious transfer. Speed makes the difference.
2. Report the fraud to your local police and to the Canadian Anti-Fraud Centre, through the Report Cybercrime and Fraud platform or at 1-888-495-8501.
3. Warn the real supplier, at their known number. Their mailbox may be compromised, and their other customers may be targeted right now.
4. Keep everything: the email with its headers, the altered invoice, the bank letter or void cheque you received, a log of calls. Delete nothing.
5. Check your own mailboxes. The fraudster may have come in through your side: unusual sign-ins, forwarding rules, sent messages nobody wrote.
6. Notify your insurer and broker. Social engineering fraud is often covered under a separate, sometimes limited, insuring agreement.

How the scheme works

The fraudster doesn't need to hack your bank. They just need to sit in the middle of an ordinary conversation.

The supplier's mailbox is compromised. This is the most dangerous version. The fraudster stole an employee's password at the supplier, often through phishing. They read the email traffic for weeks, spot the big invoices and wait for the right moment. Then they reply in the real thread, from the real address. They often add a rule that hides your replies from the supplier.

The lookalike domain. The fraudster registers an address that is nearly identical: northroofing.example becomes north-roofing.example. On a phone, nobody notices.

Your own mailbox is compromised. The fraudster intercepts the invoice sent to your accounts payable team, edits the PDF and drops it back in the inbox.

The props follow: a letter "from the bank," a void cheque, a clean logo. All of it can be forged in minutes. The timing is no accident either: month-end, summer holidays, peak season. Contractors, who pay many subcontractors, are especially exposed; we cover this in our article on cybersecurity for construction companies.

Red flags

None of these signals is guaranteed to appear. The best-prepared fraud sometimes shows none of them, which is why you need a process that doesn't rely on gut feeling.

The process that stops the fraud

According to industry data cited by Insurance Business Canada (October 2025), a wire transfer fraud costs a Canadian small business $118,000 on average. The fix costs almost nothing. It fits in one written procedure:

• No banking change is applied on the strength of an email, letter or incoming call alone.
• The change is confirmed by calling the number already in the vendor file, never the one in the message or the new invoice.
• A second person approves the change in the accounting system.
• A waiting period of a few business days applies before the first payment to the new account.
• Transfers above a set threshold require dual authorization, as the Canadian Anti-Fraud Centre recommends.
• After the first payment, someone confirms receipt with the supplier.
• A report of vendor master file changes is reviewed every month.
• Management signs the procedure and commits to never asking for an exception.

The callback is the key control. It works because it doesn't ask an employee to spot a perfect fake: it makes the fake useless.

When your company is the bait

If your mailbox is compromised, your customers are the ones who receive fake banking change notices signed by you.

The signs: a customer calls about your "new account," replies you never sent, a forwarding rule nobody recognizes.

The steps: reset the account, sign out every session, turn on MFA, then warn your customers by phone or another known channel. Remind them of your rule: "We will never change our banking details by email." Better yet, print that line on your invoices starting today.

If the mailbox held personal information and you operate in Quebec, the incident may fall under Law 25: record it in your register (s. 3.8) and, if there's a risk of serious injury, promptly notify the Commission d'accès à l'information and affected individuals (s. 3.5). Our article Cyberattack: who to notify in Canada walks through everyone to contact. Confirm with legal counsel.

Technical controls as backup

The process does most of the work. Technology reduces the openings:

• MFA on every mailbox and on banking access, as the Canadian Anti-Fraud Centre recommends.
• SPF, DKIM and DMARC on your domain, so a fraudster can't email your customers from your exact address.
• Alerts on forwarding rules and unusual sign-ins.
• A clear "external sender" banner on email from outside the company.

These settings are part of our Microsoft 365 and Google Workspace audit. For the other faces of the same scam, from the fake CEO to diverted payroll, read our guide to business email compromise and CEO fraud.

Start Monday: write down the callback rule, have management sign it and send it to your suppliers.