Manufacturer sues to recover $203,000 lost to look-alike e-mail domain
A Quebec packaging manufacturer has gone to court in Manitoba to try to recover $203,664.31 it says was diverted to fraudsters who impersonated its insurance broker by e-mail, CTV News reported on May 15.
The case illustrates how a single altered character in an e-mail address can cost a business a six-figure sum, and how long such a loss can go unnoticed.
What the lawsuit alleges
According to a statement of claim filed May 11 in Manitoba's Court of King's Bench, Pro-Pals Industries Ltd. received invoices from its broker on Feb. 2, 2026. About eight days later, an e-mail arrived from what looked like the same broker but came from a domain ending in "-ca.com" instead of ".ca." It reused the original subject line, attached copies of some invoices and said the broker's banking information had changed. A follow-up claimed the old account was for international transfers only.
The company says it wired the full amount on Feb. 13. It learned of the fraud on March 18, when the real broker called about unpaid invoices.
The claim names unknown defendants and the Canadian Imperial Bank of Commerce, alleging the fraudsters opened the receiving account at a CIBC branch in Carman, Man. The company understands the account has been temporarily frozen. It is seeking freezing and tracing orders, disclosure of account-opening records, return of the funds and damages. The claim says "it is presently unknown how or by what means the fraudsters infiltrated the email."
CIBC declined to comment because the matter is before the courts. No statement of defence had been filed, and none of the allegations have been tested in court.
Context
The Canadian Anti-Fraud Centre classifies this as payment redirection fraud, a form of spear phishing. Jeff Horncastle of the CAFC told CTV News that reported losses were above $68 million in 2025 and $31 million in the first three months of 2026. Two days earlier, the CAFC announced it had helped a separate Quebec business recover about $3.5 million after a similar attack.
What to do
- Treat any e-mail announcing new banking details as suspect until confirmed by phone at a number already on file.
- Check the full sender domain, not just the display name. Look for added words, hyphens or swapped endings such as -ca.com.
- Require a second approver for payments to new or changed accounts.
- Report quickly to your bank, police and the CAFC; early reports improve the chance of freezing funds.
