Spear phishing losses near $58 million in first half of 2026, Anti-Fraud Centre says
Canadians reported about $351 million in fraud losses in the first six months of 2026, and losses to spear phishing, the fraud most often aimed at businesses, are on track to exceed last year's total, according to mid-year figures from the Canadian Anti-Fraud Centre (CAFC).
The centre's fraud trends update, last modified Aug. 25, puts spear phishing losses at about $57.7 million for January to June, compared with more than $68 million for all of 2025. The CAFC estimates only five to 10 per cent of fraud is reported.
The five categories to watch
- Investment fraud: about $139.6 million, the largest category, often promoted through social media, ads and messaging apps with fake balances that encourage more deposits.
- Spear phishing: about $57.7 million.
- Bank investigator fraud: about $28.6 million, versus about $37.4 million in 2025. Callers pose as a bank or police and ask victims to move money to a "safe" account.
- Extortion: about $25.5 million, already above the roughly $23 million reported for all of 2025.
- Recovery fraud: about $13.7 million, in which previous victims are targeted again by people promising to recover their money for a fee. The CAFC warns scammers may impersonate the CAFC itself.
The legal research site SiLaw compiled the same figures in October, noting the CAFC gave no provincial or age breakdown.
What it means for businesses
The CAFC says spear phishing against businesses usually relies on compromised or spoofed e-mail, with criminals impersonating executives, suppliers or contractors to redirect payments or change banking information. Police warnings this year in Cranbrook, B.C., Moncton and northwestern Ontario described the same pattern, and the CAFC has helped recover money in some cases, including about $3.5 million for a Quebec business in May.
What to do
- Verify any change to payment or banking details directly with the person or company, using contact information you already have.
- Slow down when a request involves urgency, secrecy or skipping normal procedures.
- Never share passwords, verification codes or remote access with an unexpected caller.
- Never pay upfront to recover money lost to fraud.
- If targeted, contact your financial institution immediately, then report to local police and the CAFC.
