How to protect your business from email compromise and payment fraud

Business email compromise (BEC) is fraud by email: a criminal poses as your boss, a supplier, a lawyer or an employee and convinces someone to send money or change banking details. The Canadian Anti-Fraud Centre (CAFC) groups these schemes under spear phishing. It reported more than $68 million in spear phishing losses in 2025, and nearly $31 million in the first three months of 2026 alone. This guide sets out the payment controls, email settings and staff habits that stop most attempts, and what to do in the first hour if money has gone out.

In May 2026, the CAFC said it helped recover about $3.5 million for a Quebec business that wired money on fraudulent payment instructions. It said the fast report was what made recovery possible, and that payment redirection fraud commonly targets small and medium businesses, especially in construction, contracting and real estate.

How the scams work

The CAFC describes these common variations:

• Executive spoof: an email that appears to be from the owner or president asks an employee to buy gift cards or send an urgent wire transfer.
• Supplier or contractor swindle: a message that appears to be from a real supplier announces new banking details for future payments.
• Payroll spoof: a message that appears to be from an employee asks to change their direct deposit account.
• Head office spoof: a caller claiming to be from a franchise head office asks staff to activate prepaid cards or send money transfers.
• Client spoof: aimed at financial firms, an email that appears to be from an existing client asks for an urgent transfer.

The sender may be a look-alike address, a spoofed address or a genuine account that criminals have taken over. That is why checking the email address alone is not enough.

Step 1: Set a payment verification rule

This single rule stops most BEC losses. Write it down and give it to everyone who handles money:

1. Any new payee, or any change to banking details, must be confirmed by phone using a number already on file or from the organization's official website, never one from the email or invoice.
2. Urgent or unusual payment requests from the owner or a manager are confirmed in person or by phone, even if the person is travelling. The owner should say up front that they will never be offended by a call-back.
3. Payroll deposit changes are made only by the employee through your payroll system or in person, not by email.
4. Gift card purchases are never paid for on an email request.

The CAFC recommends independently verifying payment instructions and confirming banking changes using trusted contact information.

Step 2: Split payment duties

1. Limit the number of staff who can approve purchases and pay bills, as the CAFC advises.
2. Require two people for payments above a set amount: one prepares the payment, a second approves it in online banking. Most business banking platforms support dual approval; ask your bank to turn it on.
3. Set daily wire and e-transfer limits that match your normal business, and ask your bank about payee verification or alerts for new payees.
4. Match each invoice against a purchase order or contract before paying. The CAFC also warns about notices of overdue invoices you have already paid.

Step 3: Lock down the mailboxes

Many BEC attacks start with a stolen password to a real mailbox. The criminal reads the email for weeks, then strikes at the moment an invoice is due.

1. Require multi-factor authentication on every mailbox, as the CAFC recommends. In Microsoft 365, turn on security defaults; in Google Workspace, enforce 2-Step Verification.
2. Block automatic forwarding to outside addresses in your email admin settings, and review existing forwarding rules. Criminals often add a rule that forwards or hides replies.
3. Turn on external sender warnings, which tag messages that come from outside your organization. This makes a look-alike "CEO" email stand out.
4. Review sign-in alerts and the list of active sessions for staff who handle money.

Step 4: Protect your domain from spoofing

The Canadian Centre for Cyber Security's baseline controls for small and medium organizations say to implement DMARC on all email services. Together, three DNS records make it much harder for someone to send email that appears to come from your exact domain:

• SPF lists the servers allowed to send mail for your domain.
• DKIM adds a digital signature to outgoing mail.
• DMARC tells receiving servers what to do with mail that fails those checks, and sends you reports.

Your email provider's admin documentation explains how to publish them. Start DMARC in monitoring mode, review the reports for a few weeks to make sure your legitimate senders (billing software, newsletters) pass, then move to quarantine or reject. Also consider registering obvious look-alike versions of your domain.

Step 5: Train staff on the warning signs

The CAFC lists these red flags for payment redirection fraud:

• requests to change or update banking or payment information;
• pressure to act quickly or skip normal procedures;
• email addresses that closely resemble legitimate ones;
• unexpected wire transfer instructions or requests to pay a new account;
• notices of past-due invoices you have already paid.

Run a 15-minute session at least twice a year, using real examples. Make it easy and blame-free to pause a payment and ask.

Step 6: Tell your clients and suppliers how you work

Add a line to your invoices and email signatures stating that you will never change your banking details by email, and that clients should call a known number to confirm. This protects your customers from criminals who impersonate you.

If money has been sent

Speed matters. The CAFC says reporting quickly may improve the chances of recovering funds.

1. Call your bank's fraud line immediately and ask it to recall the payment and contact the receiving bank. Have the date, amount and recipient account details ready.
2. Report to your local police and get a file number.
3. Report to the CAFC at reportcyberandfraud.canada.ca or 1-888-495-8501.
4. Secure the mailbox: reset the password, sign out all sessions, reset MFA methods, and delete malicious forwarding and inbox rules. Keep copies of the fraudulent emails with full headers as evidence.
5. Warn the real supplier or client by phone, since their account may be compromised.
6. Notify your insurer if you have cyber or crime coverage.
7. Check for a privacy breach. If the criminal had access to a mailbox containing client personal information, assess whether you must report to the Office of the Privacy Commissioner of Canada and notify affected people under PIPEDA, or to Quebec's Commission d'accès à l'information under Law 25.

Sources

• Canadian Anti-Fraud Centre: Canadian Anti-Fraud Centre and partners assist in $3.5M recovery linked to sophisticated payment redirection fraud (May 13, 2026)
• Canadian Anti-Fraud Centre: Spear phishing
• Canadian Anti-Fraud Centre: Protect yourself
• Canadian Centre for Cyber Security: Baseline cyber security controls for small and medium organizations