Cranbrook RCMP warn businesses after Microsoft 365 accounts used to redirect payments
The Cranbrook RCMP warned local businesses on May 7 that fraudsters have been taking over company e-mail accounts hosted on Microsoft 365 and using them to send clients payment requests that direct money to the wrong bank account. Police said they are investigating several cases.
The scheme is hard to spot because the messages come from the business's real address. According to the RCMP release, the fraudsters had accurate invoice details and exact amounts owed, so requests to pay outstanding bills into a "new" account looked routine to customers.
How the fraud worked
Police said some of the compromised accounts were protected by two-factor authentication. Once inside, the fraudsters e-mailed the business's clients, cited unpaid invoices and supplied different banking details. They also intercepted or rerouted client replies, which meant the business did not see the correspondence and the fraud went unnoticed for longer.
The detachment alerted members of the Cranbrook Chamber of Commerce and said it was concerned that other victims had not yet come forward, e-KNOW reported.
"Public awareness and verification remain the most effective tools in preventing financial loss," Const. Carlee Munro, the detachment's media relations officer, said in the release.
Why it matters
This kind of payment redirection is one of the costliest frauds facing Canadian businesses. The Canadian Anti-Fraud Centre has reported more than $68 million in spear phishing losses for 2025 and about $57.7 million in the first six months of 2026. Police did not say how the Cranbrook accounts were first accessed. Attacks that get past two-factor codes commonly rely on fake login pages that relay a session in real time, or on tricking a user into approving a sign-in.
What to do
- Never confirm a change in banking details by e-mail alone. Call a known contact using a number you already have on file, or verify in person.
- Tell your clients, in writing, that you will never change your banking details by e-mail.
- Review Microsoft 365 mailbox forwarding and inbox rules regularly, along with sign-in logs, for anything you did not set up.
- Move staff to phishing-resistant sign-in methods such as passkeys or security keys where possible.
- If money has been sent, call your bank immediately, then report to your local RCMP detachment and the Canadian Anti-Fraud Centre.
