A vendor emails you to say their bank has changed and to update their payment details. The email looks legitimate — same logo, same signature, same tone. You update the banking information and approve the next wire transfer. The money goes out. Three days later, the real vendor calls asking why they haven't been paid.
The money is gone. And recovering it is unlikely.
This is a business email compromise (BEC) wire transfer attack, and it's one of the most financially damaging cybercrimes targeting Canadian businesses. The fix isn't software — it's a wire transfer policy that every person involved in payments follows without exception.
This is happening right now in Canada
This isn't a theoretical risk. Major Canadian financial institutions are already proactively warning their clients about wire transfer fraud. Take a look at what MCAP — one of Canada's largest mortgage lenders — recently sent to their clients:
MCAP is telling their clients point-blank: we will never change banking details by email. If you get an email claiming to update MCAP's wire instructions, it's fraud. Verify through their website or by phone — not by replying to the email.
If one of Canada's largest mortgage companies is sending fraud warnings to every client, the threat is real and it's active. Your business should be doing the same thing — both as a sender and a receiver of wire transfers.
How the attack works
Business email compromise isn't a single technique — it's a category of attacks where the attacker inserts themselves into a legitimate business conversation and manipulates payment instructions. The most common variants targeting Canadian businesses:
An attacker compromises a vendor's email account (or registers a lookalike domain) and sends you a message that appears to be from the vendor: "We've changed banks, please update our payment details for all future wire transfers."
The new banking details belong to an account the attacker controls. The email looks perfect because it's either sent from the real (compromised) account or from a domain like yourvendor-payments.com instead of yourvendor.com.
An attacker spoofs or compromises an executive's email and sends a message to someone in finance: "I'm in a meeting and need you to process a wire transfer urgently. Here are the details. Don't discuss this with anyone — it's confidential."
The urgency and confidentiality instructions are deliberate — they're designed to prevent the recipient from doing exactly what they should do: verify the request through another channel.
An attacker gains access to either your email or a vendor's email and silently monitors an ongoing payment conversation. At the critical moment — right before the wire is sent — they intercept the thread and inject new banking details. The recipient doesn't notice because the email appears to be part of the existing conversation.
This is the hardest to detect because everything looks normal until you compare the banking details against what was originally agreed.
BEC attacks don't use malware, malicious links, or attachments. They use plain text emails with normal language. Traditional email security tools are designed to detect malicious content — not social engineering. A well-crafted BEC email is indistinguishable from a legitimate business email to a security scanner.
The defense is a human process, not a technology.
The wire transfer policy
The following policy framework is designed for Canadian SMBs that send or receive wire transfers, EFTs, or electronic payments above a threshold amount. Adapt the thresholds and roles to your organization.
Any electronic payment above $10,000 CAD (adjust to your risk tolerance) must follow this policy in full. Payments below the threshold follow standard procedures but should still use call-back verification for any banking change — regardless of amount.
Any request to change, add, or update banking information — whether from a vendor, client, or internal executive — must be verified by phone call to a known number before any payment is processed. This is the single most important control. MCAP's notice above is exactly this principle in practice.
- Do not use the phone number in the email. Use the phone number on file from the vendor setup form, a prior contract, or the company's official website.
- Do not reply to the email to ask "is this real?" — if the email account is compromised, the attacker will confirm it.
- Document the verification: who you spoke to, what number you called, date and time, and what was confirmed.
- For new vendors: verify banking details by phone before the first payment, not after.
Wire transfers above the threshold require two authorized signatories:
- Initiator: Prepares the wire request, verifies vendor details, and submits the payment request.
- Approver: Reviews the request independently, confirms the call-back verification was completed, and authorizes the transfer.
- The initiator and approver cannot be the same person.
- For wires above $50,000 CAD, a third approval (CFO or equivalent) is required.
Any wire transfer request marked "urgent," "confidential," or that bypasses normal procedures must be verified out-of-band — meaning through a different communication channel than the one the request came in on.
- Email request → verify by phone call
- Text message request → verify by phone call
- Voicemail request → verify by calling the person back at their known number
- If you cannot reach the person by phone, the transfer does not proceed until you do. No exceptions for urgency.
All vendor banking details must be established and changed through a formal process, not via email:
- New vendors: Complete a vendor setup form that includes banking details, authorized contact persons, and a verified phone number. The form is signed by both the vendor and an internal approver.
- Banking changes: Require a new signed form (or letter on company letterhead) plus phone verification. Email alone is never sufficient to change banking details — as MCAP's policy demonstrates.
- Maintain a vendor master file with authorized banking details. Compare wire instructions against this file every time. If the instructions don't match, stop and verify.
Stop the payment process immediately if any of the following occur:
- An email requests a change to banking details, especially with urgency
- An executive requests a wire transfer you weren't expecting, especially "confidentially"
- The email domain doesn't exactly match the vendor's known domain — check for extra characters, hyphens, or country codes
- The email is part of an ongoing thread but the writing style, tone, or formatting changes suddenly
- The request asks you to bypass normal procedures or not discuss it with colleagues
- A "new" contact person at an existing vendor sends banking instructions
- The reply-to address differs from the sender address
Speed is critical. The first 72 hours determine whether funds can be recovered.
The CAFC coordinates with banks and law enforcement to attempt fund recovery. The faster you report, the better the odds. Their wire transfer recovery process works best within the first 72 hours — but they accept reports at any time. Call 1-888-495-8501 or report online at antifraudcentre.ca.
Technology that supports the policy
A policy is only as strong as its enforcement. These technical controls complement — but don't replace — the human verification steps above:
- DMARC with p=reject on your domain — prevents attackers from spoofing your executives' email addresses. This also protects your vendors from emails pretending to be from you.
- Email tagging/banners — configure your email system to flag emails from external senders with a visible banner ("⚠️ External Email"). This helps recipients spot when an "internal" request actually came from outside.
- Mailbox rule monitoring — attackers create inbox rules to hide their activity (e.g., auto-filing sent items, deleting incoming replies). Monitor for unexpected rules, especially on finance and executive accounts.
- Payment approval workflows — use your accounting/ERP system's built-in approval workflows to enforce dual authorization. Don't rely on email alone for payment instructions.
- Vendor master file controls — restrict who can add or modify vendor banking details in your accounting system. Changes should require the same dual approval as the wire transfer itself.
- MFA on all email and finance accounts — phishing-resistant MFA (FIDO2/passcodes) for anyone who initiates or approves wire transfers.
Canada has no federal requirement for banks to reverse wire transfers once funds have been withdrawn by the recipient. Unlike credit card fraud, where the bank often absorbs the loss, wire transfer fraud is generally your loss. The bank's obligation ends once they've sent the money where you told them to. This is why prevention through policy is the only reliable defense.
Implementing the policy
A policy that sits in a binder does nothing. Here's how to make it work:
- Draft the policy using the framework above. Adjust thresholds and roles to match your organization.
- Get executive buy-in — the CEO/CFO must publicly support the policy, including being subject to it themselves. If the CEO can bypass verification "because I said so," the policy is dead.
- Train everyone involved in payments — not just finance. Anyone who can initiate or influence a payment needs to know the red flags and the verification steps.
- Run a tabletop exercise — simulate a BEC attack and see if your team follows the policy. This is the fastest way to find gaps.
- Test with a real (small) transfer — have a known vendor send a legitimate banking change request and verify your team follows the call-back process.
- Review quarterly — threat patterns evolve, staff turnover happens, and bad habits creep in. Review the policy, test it, and reinforce it regularly.
Every BEC attack that succeeds does so because someone trusted an email without verifying it through another channel. MCAP — one of Canada's largest mortgage lenders — is already telling their clients they will never update wire details via email. Your business should adopt the same standard: phone call verification for any banking change, dual authorization for wires above a threshold, and no exceptions for urgency. The policy costs nothing to implement. Not having it could cost you everything.
Read our guide to spotting malicious emails in 2026 and our stolen laptop incident response checklist for more cybersecurity guidance for Canadian businesses.
Free IT Assessment
Not sure where your IT stands? Get a free, no-obligation assessment of your infrastructure, security, and cloud setup.
Get Your Free Assessment →
