Most invoice fraud isn’t hacking in the movie sense. A criminal gets into, or convincingly imitates, an email account — yours, a supplier’s, or your boss’s — and asks for a payment to go somewhere new. The email often comes from the real address, arrives in an existing conversation and references a genuine invoice. Canada’s Anti-Fraud Centre recorded more than $68 million in reported spear-phishing losses in 2025, and about $57.7 million in the first six months of 2026 alone.
The control that stops it is procedural, not technical: never change payment details because an email says so; confirm by phone, on a number you already have. Email security makes the attack harder, and this guide covers both — how the fraud works, the warning signs, the payment controls, the Microsoft 365 settings that matter, and what to do in the first hour if money has gone.
How invoice fraud actually happens
The Anti-Fraud Centre describes these frauds as often involving compromised or spoofed communications that target businesses by impersonating executives, suppliers, contractors or other trusted contacts to redirect payments. In practice that takes a few shapes.
- Your mailbox is taken over. Someone on your team enters their password on a convincing fake sign-in page. The attacker signs in, reads quietly for days or weeks, and learns who pays whom and when. They often create an inbox rule that moves replies containing words like “invoice” or “payment” out of sight, then email a client from your real account asking them to pay into a “new” account.
- Your supplier’s mailbox is taken over. The same thing happens at the other end. You receive a perfectly genuine email, from the supplier’s real address, in an existing thread, with new banking details. No filter will flag it, because nothing about the email is fake.
- A lookalike domain. The attacker registers a domain one character off — an extra letter, “rn” instead of “m”, a .com instead of a .ca — and copies the supplier’s signature and invoice layout.
- The urgent executive. A message that appears to come from the owner asks someone in accounts to make a quick, confidential payment, or to buy gift cards, today.
- Deposits and trust payments. Businesses that move large sums on instructions — law firms, property managers, real estate and construction — are targeted with redirected deposits, progress draws and closing funds.
How big the problem is
| Source | Period | Reported figure |
|---|---|---|
| Canadian Anti-Fraud Centre — spear phishing | 2025 | More than $68 million in reported losses |
| Canadian Anti-Fraud Centre — spear phishing | January to June 2026 | About $57.7 million in reported losses |
| Canadian Anti-Fraud Centre — all fraud | January to June 2026 | About $351 million in reported losses |
| FBI Internet Crime Complaint Center — business email compromise (U.S.) | 2025 | 24,768 complaints and US$3.05 billion in reported losses, up from US$2.77 billion in 2024 |
The Anti-Fraud Centre estimates that only 5% to 10% of fraud is reported. Businesses in particular tend not to report a payment they sent themselves, which means the true figure in Canada is far larger than the reported one.
Warning signs
- Any change to banking details, especially near a payment date.
- Urgency, secrecy or an unusual reason: “our bank is being audited,” “use this account this time only.”
- A sender address that is almost right — check the domain, not the display name.
- A reply-to address that differs from the sender.
- A new account in a different name, province or country from the supplier.
- Requests to pay by a method the supplier has never used, including gift cards or cryptocurrency.
- A phone number in the email that’s different from the one you have on file.
- On your side: replies you never saw, sent-mail you didn’t write, or clients mentioning emails you don’t recognise.
Payment controls that stop it
These cost nothing, and they work even when the email is genuine. Write them down, so the junior person in accounts has the authority to slow down a payment the owner seems to be demanding.
A payment-change procedure
- Never change payment details because of an email, text or invoice alone.
- Confirm every change by phone, using a number from your vendor records or a previous invoice — never from the message requesting the change.
- Speak to someone you know at the supplier, and ask them to confirm the details back to you rather than reading them out.
- Require a second person to approve any new payee or changed banking details, and any payment above a set amount.
- Hold the first payment to new details for an agreed period while it's verified.
- Record who verified the change, when and on what number.
- Treat urgency and secrecy as reasons to slow down, especially when the request appears to come from the owner.
- Tell your own clients in writing that you will never change your banking details by email, and that they should call you if anyone asks.
For larger transfers, agree a code word or call-back routine with the people who can authorise them. It’s a small habit that defeats both impersonation and the newer voice-cloning attacks.
Email and Microsoft 365 controls
Technical controls make account takeover and impersonation harder, and help you notice when something is wrong. In Microsoft 365, the ones that matter most are:
| Control | What it does |
|---|---|
| Multifactor authentication on every account | A stolen password alone no longer opens the mailbox. The single most effective control |
| External sender tag | Outlook marks messages from outside the organization, so a fake “owner” email stands out |
| Impersonation protection | Anti-phishing policies in Microsoft Defender for Office 365 can protect named people and domains — your executives and key suppliers — from lookalike senders. Defender for Office 365 Plan 1 is included in Microsoft 365 Business Premium |
| Alerts on forwarding and inbox rules | Warns you when a mailbox starts forwarding mail or hiding messages — a common sign of takeover |
| Blocking automatic external forwarding | Stops a compromised mailbox quietly copying all mail to an outside address |
| Email authentication on your domain | SPF, DKIM and DMARC make it harder for criminals to send email that appears to come from your domain |
Our small business cybersecurity checklist covers these alongside the rest of the baseline. If you’re not sure which Microsoft 365 plan includes what, our Google Workspace vs Microsoft 365 comparison explains the plans.
What AI changes
Phishing emails used to give themselves away with poor spelling and odd phrasing. Generative AI has largely removed that tell: fraudulent emails are now fluent, well formatted and tailored to the recipient. The FBI’s 2025 Internet Crime Report attributed more than US$30 million in business email compromise losses to cases with a confirmed AI connection, including cloned voices used to approve transfers.
The defence doesn’t change — it becomes more important. A phone call to a known number, and a second approver, still beat a perfect email. For voice requests, call back on the number you have, or use a pre-agreed code word.
What to do if you’ve been hit
- Call your bank immediately. Ask them to stop or recall the payment and to contact the receiving bank. Do this before anything else.
- Report it. To your local police and to the Canadian Anti-Fraud Centre, online or at 1-888-495-8501. Keep the emails, invoice and payment records.
- Secure the account. Reset the password, sign the user out of all sessions, re-register multifactor authentication, remove any inbox rules and forwarding the attacker created, and check for third-party apps granted access to the mailbox.
- Find out what they saw. Review sign-in and audit logs to see when the attacker got in and what they read or sent. They may have harvested clients and invoices to target next.
- Warn the people who need to know. Clients or suppliers who may have received fraudulent requests from your account, and the supplier whose identity was used.
- Call your insurer. Cyber and crime policies often have notification deadlines and conditions. Our guide to cyber insurance requirements in B.C. covers what insurers ask for.
- Fix the gap. Whether it was a missing control or a skipped call-back, change the process so the same route doesn’t work twice.
YVR Technology sets up the email and account security that makes these attacks harder, and helps businesses recover when one gets through, as part of our cybersecurity services and managed IT. We work with businesses across Greater Vancouver and the Fraser Valley — including Vancouver, Surrey and Abbotsford — and remotely elsewhere in B.C. If you’d like your setup checked, get in touch.