The two-minute call-back rule that catches fake invoices
One phone call to a number you already had catches the fake "new bank details" invoice, one of the most common frauds against Canadian businesses.
By Sahib Dhaliwal · All posts
The email looks right. It has your supplier’s name, their logo and a real invoice number. It even arrives in the week their invoices always do. One line is new: “We have changed banks. Please send payment to the account below.”
That line is how one of the most common frauds against Canadian businesses works. The Canadian Anti-Fraud Centre counts it as spear phishing. It reported more than $68 million in losses to spear phishing in 2025, and nearly $31 million more in the first three months of 2026. The same release names businesses in construction and contracting as common targets.
The rule
Before anyone pays new or changed bank details, they call the supplier on a phone number the business already had. That means your own contacts, an old invoice or the supplier’s own website, never the email that asked for the change. If nobody can confirm the change, the payment waits.
That is the whole rule. It takes about two minutes. It works because the fraudster controls everything in the email, including any phone number in it, but not the number already in your records.
Make it a rule, not a judgement call
The emails that work are the ones that feel urgent and look ordinary. A written rule removes the judgement.
- Write it down, and make it apply to everyone who pays bills, the owner included.
- Have a second person approve any new payee or changed bank details. The Anti-Fraud Centre recommends dual authorization for transfers and limiting who can approve payments.
- Treat a request to keep it quiet, or to pay today, as a reason to slow down.
Signs worth a second look
- A new bank, especially in another province or country.
- A reply-to address that is one letter off from the usual one.
- A message that arrives right after a real invoice and refers to it.
- Pressure: an audit, a deadline or a penalty.
If a payment already went out
- Call your bank right away and ask whether the payment can be stopped or recalled.
- Report it to the Canadian Anti-Fraud Centre and your local police.
- Change the password on the email account involved, and turn on multi-factor sign-in.
- Check that mailbox for forwarding rules you did not set up. An attacker who gets into a mailbox often adds a quiet forwarding rule to keep reading it.
Look after the mailbox too
Many of these frauds start with a hijacked mailbox, on your side or the supplier’s. Multi-factor sign-in on email is the best single step, and the Anti-Fraud Centre recommends it for both email and banking. Email that is set up properly on your own domain is also harder to fake. More on that is on the websites and email page.
How I help
In a free IT check-up, I look at:
- how bank changes get checked in your office
- whether your email has multi-factor sign-in
- whether your domain is set up so your email is harder to fake
You get a one-page summary in plain English, and nothing is changed on your systems. If you want to see how I look after a trades office first, there is a working sample of a trades office.
Sources
Book a free IT check-up
About an hour at your office, nothing changed on your systems, and a one-page summary in plain English.
- Your website, domain and email
- Your computers and updates
- Your backups
- How people sign in
- A quick look at your network
Prefer email? Write to info@sd-techsolutions.com. I reply within one business day.