Blog

Before You Pay That Invoice: How Manitoba Businesses Can Stop Payment Redirection Fraud

Personal Cyber ProtectionBusiness InsuranceBusiness Cyber Insurance

The email looks routine.

A supplier says its banking information has changed. A contractor sends updated wire instructions. A manager asks for an urgent payment before the end of the day.

Everything appears legitimate—until the real supplier calls about an unpaid invoice.

This type of cyber-enabled crime is often called payment redirection fraud, business email compromise, or spear phishing. Criminals impersonate a trusted person or take control of a real email account, then convince an employee to send money to the wrong destination.

It is not limited to large corporations. Construction companies, farms, professional firms, property managers, retailers, and other small and medium-sized businesses can all be targeted.

Canadian businesses are losing real money

On May 13, 2026, the Canadian Anti-Fraud Centre announced that it had helped recover approximately $3.5 million connected to a payment redirection fraud involving a Canadian business.

Fraudsters had manipulated email communications during a high-value commercial transaction and provided false payment instructions. The business authorized two wire transfers before the fraud was discovered.

The quick response helped—but recovery is never guaranteed.

According to the Canadian Anti-Fraud Centre, Canadians reported more than $68 million in spear-phishing losses during 2025. Nearly $31 million in additional losses were reported during the first three months of 2026 alone.

For Manitoba businesses, the best defence is a payment process that does not depend on whether one employee spots a convincing fake.

How payment redirection fraud works

Some criminals create an email address that is only one letter or punctuation mark different from a legitimate address. Others gain access to a real mailbox through a stolen password or deceptive login page.

They may quietly monitor conversations for days or weeks. This helps them learn:

• Who approves payments
• Which suppliers the business uses
• When large invoices are expected
• How employees normally write
• Which transactions are urgent or confidential

The criminal then joins the conversation at the right moment. They might provide “updated” banking details, replace an invoice attachment, or ask that a payment be sent to a different account.

Because the message fits an existing transaction, it may not look like an obvious scam.

Watch for these warning signs

Slow down when a message includes:

• A request to change banking or payment information
• Unexpected wire-transfer or e-transfer instructions
• Pressure to act immediately or bypass normal procedures
• A new account in another province or country
• An email address that closely resembles a familiar one
• A request for secrecy
• A past-due notice for an invoice already paid
• Unusual wording from a person you know

Good spelling, correct logos, and knowledge of a real transaction do not prove that a message is authentic.

Seven ways to protect your business

1. Verify every banking change outside email

Never approve new payment information using the same email thread that requested the change.

Call the supplier using a phone number already stored in your records—not a number included in the suspicious message. Confirm the account change with a known contact.

This one extra step can stop a very expensive mistake.

2. Require two approvals for significant payments

Set a dollar threshold above which two authorized people must approve a payment. Apply the rule to owners and senior managers too.

Criminals often create urgency specifically to make employees skip controls. A clear written policy gives staff permission to pause, even when the message appears to come from the boss.

3. Use multi-factor authentication

Enable multi-factor authentication on business email, accounting software, banking platforms, cloud storage, and remote-access tools.

Where available, consider stronger phishing-resistant methods such as security keys or passkeys. The Canadian Centre for Cyber Security recommends phishing-resistant multi-factor authentication because sophisticated phishing systems can sometimes intercept conventional login codes.

Multi-factor authentication is important, but it should support—not replace—payment-verification procedures.

4. Limit payment authority

Not every employee needs permission to create vendors, change banking details, and release funds.

Separating these duties makes it harder for one compromised account to complete a fraudulent transaction. Review user permissions when an employee changes roles or leaves the company.

For smaller businesses where one person handles several functions, use owner approval or an independent callback for account changes.

5. Train employees with realistic examples

Cyber training should cover the messages your team actually receives: supplier invoices, payroll requests, delivery notices, document-sharing links, and requests from executives.

Make reporting easy and blame-free. An employee who thinks they clicked a suspicious link should feel comfortable raising the alarm immediately. Fast reporting can limit damage.

6. Keep your vendor records clean

Maintain an approved vendor list with verified contact and payment information. Record who requested a banking change, how it was confirmed, who approved it, and when it took effect.

Consider sending automatic notices to the supplier’s established contact whenever payment details are changed.

7. Build an incident-response checklist before you need it

Your plan should identify who will contact:

• The financial institution
• Your IT or cyber-security provider
• Your insurance broker or insurer
• Local police
• The Canadian Anti-Fraud Centre
• Legal or privacy professionals, when necessary

Keep a copy somewhere accessible if your systems are unavailable. Include policy numbers, emergency contacts, and instructions for preserving email and transaction records.

What to do if money has already been sent

Act immediately.

Contact your financial institution and ask it to stop or recall the payment. Notify the receiving institution if its details are available. Report the incident to local police and through Canada’s Report Cybercrime and Fraud system.

Do not delete suspicious emails. Preserve headers, attachments, invoices, login alerts, payment confirmations, and notes about who did what and when.

Contact your insurance broker or insurer promptly as well. Some policies require notice before certain response costs are incurred or outside professionals are hired.

Where cyber insurance may help

Cyber insurance can support more than the replacement of stolen funds. Depending on the policy, coverage may help provide access to breach coaches, forensic specialists, privacy counsel, notification services, public-relations support, data restoration, business interruption coverage, or cyber-extortion response.

However, social-engineering and misdirected-payment coverage can have separate limits, deductibles, verification requirements, or exclusions. A crime policy and a cyber policy may also respond differently.

The goal is not simply to ask, “Do we have cyber insurance?” It is to understand which events are covered, what controls are required, and who to call first.

Fast Insurance helps local businesses understand those details before an incident happens. Learn more about Business Cyber Insurance or contact our Winnipeg or Steinbach team for a plain-language review of your protection.

This article is for general information only. Insurance coverage depends on the specific policy wording, limits, conditions, exclusions, and circumstances of each loss.