The Fake Invoice Scam Targeting Canadian Businesses — and How to Stop It
A property management company in Winnipeg receives an invoice from their regular cleaning contractor. Same company name, same logo, familiar format. The only difference — invisible to anyone who isn’t looking closely — is that the banking details have changed. The accounts payable coordinator processes it. The real contractor never gets paid. The business spends weeks trying to recover the funds.
This is the fake invoice scam. It is not exotic. It does not require sophisticated technology. It works because it looks exactly like what it is pretending to be — and because most accounts payable processes are built around efficiency, not verification.
As Canadian businesses have shifted almost entirely to email for invoicing and accounts payable, the opportunity for this fraud has grown considerably. The Canadian Anti-Fraud Centre (CAFC) received 108,878 fraud reports in 2024, and invoice-related fraud is among the categories showing consistent growth. For small and mid-size businesses, a single successful fake invoice can represent a significant financial hit.
How the Scam Works
There are two main versions.
The spoofed vendor invoice arrives from an email address that closely resembles a real vendor’s domain — perhaps one letter different, or a different domain extension. The invoice may be for a service you do use, or for something plausible enough not to raise flags on a busy day. Staff process it as routine because it looks routine.
The banking detail redirect is more targeted. Here, the fraudster has either intercepted communications with a real vendor, or has compromised the vendor’s email account. They send a message — appearing to be from your vendor — advising that their banking information has changed. Future invoices, or an invoice attached to that email, direct payment to a fraudulent account.
In both cases, the money leaves your account and goes somewhere it cannot easily be recovered from. Canadian banks are generally unable to reverse completed wire transfers or electronic fund transfers once the receiving account has moved the funds.
How to Spot It
There are several signals worth training your accounts payable staff to catch.
An invoice for a service you did not contract. If your company does not have a relationship with the vendor named on the invoice — or has never used the specific service billed — that is the first question to ask before payment, not after.
A vendor name that looks right but isn’t quite. “Acme Supplies Ltd.” versus “Acme Supply Ltd.” versus “Acme Supplies Inc.” — fraudsters rely on the fact that small differences are easy to miss when you are processing dozens of invoices. Train staff to match vendor names exactly against your approved vendor list.
Changed payment details for a known vendor. This is the highest-risk scenario. A legitimate vendor does change their banking information occasionally — but it should be exceptional, and it should always be confirmed before the change is applied.
Urgency language on an invoice. Real invoices have payment terms. An invoice that emphasizes “please process immediately” or warns of a penalty for any delay is designed to push past your normal verification steps.
What Processes Prevent It
The businesses that catch these frauds before paying them have one thing in common: a verification step that sits outside the email channel.
An invoice approval workflow that requires a second set of eyes before payment goes out — particularly for invoices above a defined dollar threshold — catches discrepancies that one person reviewing quickly might miss. This does not need to be complex; even a simple two-step approval for invoices over $2,500 creates meaningful protection.
A policy requiring verbal confirmation for any banking change. This is the single most effective control. Before any vendor’s banking details are updated in your system, someone at your organization calls a known contact at that vendor — at a number already on file, not a number provided in the change request — to confirm the change is legitimate.
This step is not about distrust. It is about protecting a relationship and an asset. Most vendors, when they understand why you are calling, appreciate it.
One Thing to Do
Implement a written policy stating that any change to a vendor’s banking information in your accounts payable system requires verbal confirmation from a known contact at that organization, using a phone number already on file, before the change takes effect. Email confirmation is not sufficient. One phone call has recovered or prevented frauds worth tens of thousands of dollars at Canadian businesses — and it takes less than five minutes.