Treaty #3 Police say two Indigenous organizations lost $470,000 to invoice fraud
The Treaty #3 Police Service is investigating two business e-mail compromise cases in northwestern Ontario in which Indigenous organizations lost more than $470,000 combined, the service said in a bulletin issued April 20.
Police described it as an "active and serious fraud" aimed at First Nations governments, Indigenous health bodies and social service agencies, Turtle Island News reported. The method is one any small organization that pays suppliers by bank transfer could fall for.
What happened
In both cases, the organization had received a legitimate invoice from a vendor. Shortly afterward a follow-up e-mail arrived that looked genuine but came from an address that differed from the real one by a single character. It said the vendor's banking information had changed and gave new payment instructions. The organizations paid in good faith, Your Kenora reported.
Police said the fraudsters appeared to know about vendor relationships, invoicing processes and who handles accounts payable, which suggests they had studied the targets or had access to their correspondence. How they obtained that knowledge has not been disclosed.
The service, a self-administered First Nations police force covering Treaty #3 territory in northwestern Ontario and southeastern Manitoba, said it has brought in RCMP cybercrime investigators, the FBI legal attaché in Ottawa and OPP digital forensics.
What we don't know yet
Police did not name the organizations or say whether any money has been recovered.
The cases fit a pattern the Canadian Anti-Fraud Centre has been warning about all year. The centre reported about $57.7 million in spear phishing losses in the first six months of 2026, compared with more than $68 million for all of 2025. It says these frauds typically involve compromised or spoofed e-mail and impersonation of suppliers, contractors or executives, with the aim of redirecting a payment. Because only a small share of fraud is ever reported, the real total is likely higher.
What to do
- Verify any change to a vendor's banking details by phone, using a number you already have.
- Check sender addresses character by character, especially on follow-up messages about payment.
- Turn on two-factor authentication for e-mail accounts.
- If you have already paid, contact your bank immediately to ask for a recall or freeze, keep every related e-mail, and report to police. Treaty #3 Police said quick reporting improves the chances of getting money back.
