Your antivirus software didn't flag it. Your email filter let it through. No attachment, no malicious link, no executable file — just an email that looked exactly like it came from your supplier, your lawyer, or your CEO.

The email asked you to change the banking details on an upcoming payment. It referenced the right invoice numbers, used the right tone, and came from an address that looked correct at a glance. You changed the banking details. The payment went out. The money went to a criminal's account in Eastern Europe, and your real supplier started calling about a missed payment.

This is Business Email Compromise (BEC). It's the fastest-growing financial fraud targeting Canadian businesses, it increased 171% between 2021 and 2025, and no security software in the world will reliably catch it — because it doesn't use malware. It uses trust.

How BEC Actually Works

Business Email Compromise comes in several variants, but the underlying mechanics are the same: an attacker impersonates a trusted party to redirect a financial transaction.

The CEO fraud variant involves an attacker impersonating an organization's executive — typically via a spoofed email address that resembles the real one — and emailing an employee (usually in finance or accounts payable) with an urgent request to wire funds or process a payment. The urgency and authority of the sender are designed to bypass normal verification procedures.

The vendor fraud variant — the one described above — involves impersonating a known supplier or service provider to redirect payment to a fraudulent bank account. The attacker often has detailed knowledge of the relationship: they may have access to legitimate email threads (from a prior breach of the supplier's email), know the invoice amounts, and understand the payment timing.

The account compromise variant is the most sophisticated: the attacker actually compromises a real email account — typically through phishing — and operates from inside it. Emails come from the real address, with the real signature, and the real email thread history. There is no spoofing to detect. The only tell is that payment instructions changed.

When the Email Is Real

Account compromise BEC is particularly dangerous because standard detection methods fail. The email is genuinely from your supplier's address — because an attacker has access to that account. There are no spelling errors, no odd formatting, no suspicious links. The only defence is a human verification step: a phone call to a known number before changing payment details.

Why It's Growing So Fast in Canada

Three factors have driven the explosive growth of BEC in Canada:

AI-generated phishing has become indistinguishable from human writing. BEC attacks historically were spotted by poor grammar and awkward phrasing. Attackers now use large language models to produce flawless, contextually appropriate emails. The tell that used to work doesn't work anymore.

Business data is widely available. Attackers research targets using LinkedIn (to identify who in finance has authority to approve payments), company websites, social media, and business registries. A convincing CEO fraud email only requires knowing who the CEO is, who the AP manager is, and roughly what kind of transactions the business processes.

Remote work created verification gaps. When everyone works in the same office, an employee who receives an unusual payment request can walk over and ask. Remote and hybrid work environments rely on email and messaging for communication — the same channels attackers control. The informal verification that happened naturally in offices doesn't happen remotely.

What BEC Looks Like for a Trades Business

Here's a scenario that plays out regularly with Canadian trades businesses. A plumbing contractor has a regular relationship with a large commercial supplier. The supplier sends invoices monthly; the contractor pays by EFT.

The contractor receives an email, apparently from the supplier's accounts receivable contact, noting that they've updated their banking information and asking the contractor to update their records before the next payment. The email references the correct supplier name, uses the correct letterhead layout (copied from a real email), and comes from an address that reads as ar@supplier-ca.com — almost but not quite ar@supplier.ca.

The next EFT goes to the fraudulent account. The real supplier calls the following month about a missed payment. By the time the contractor realizes what happened, the money has been moved through multiple accounts and is unrecoverable. The loss: $18,500. The fraud is reported to the RCMP; the likelihood of recovery is near zero.

The Controls That Actually Work

Because BEC doesn't use malware, traditional security tools offer limited protection. The defences that actually work are procedural and technical:

Verification procedure for payment changes. Any request to change banking information — regardless of who it appears to come from — must be verified by a phone call to a number that is already in your records. Not a number provided in the email. Not a reply to the email. A call to the phone number you have on file for that supplier or that person. This single procedure, consistently applied, stops BEC.

Email authentication: DMARC, DKIM, and SPF. These three email standards, when properly configured, tell receiving mail servers to reject or quarantine emails that claim to be from your domain but weren't sent through your authorized email systems. They protect your domain from being spoofed (used in BEC attacks on your clients), and receiving servers with proper DMARC configuration are less likely to accept spoofed emails purporting to come from other protected domains.

Multi-factor authentication on all email accounts. The account compromise variant of BEC — where an attacker operates from inside a legitimate email account — requires them to first gain access to that account. MFA makes that access significantly harder. If your suppliers use MFA, and you use MFA, the account compromise vector is effectively closed.

BEC Prevention Checklist

  • Written policy: any change to supplier banking details requires a phone verification call
  • Multi-factor authentication on all company email accounts
  • SPF, DKIM, and DMARC configured for your domain
  • Staff trained to check "From" addresses carefully — not just display names
  • Dual-approval for EFT payments above a threshold (e.g., $5,000)
  • Regular review of email forwarding rules (attackers often set up rules to monitor accounts silently)

If It Happens to You

Speed is everything. If you discover a BEC-related fraudulent payment, you have a window — sometimes as short as hours — to attempt recovery.

Call your bank immediately and report a fraudulent wire transfer. Ask them to issue a SWIFT recall or contact the receiving bank to freeze the funds. The success rate of recovery drops sharply after 24 hours, as attackers move funds through intermediary accounts rapidly.

Simultaneously: report to the Canadian Anti-Fraud Centre (CAFC) at 1-888-495-8501 or antifraudcentre.ca. Report to your local police. If client or employee data was accessed as part of the compromise, begin your PIPEDA breach assessment.

The hard truth is that the majority of BEC losses are not recovered. The criminal infrastructure that processes these payments is designed for speed of movement, and Canadian law enforcement has limited reach into the jurisdictions where the money goes. The only reliable strategy is prevention.

The Bottom Line

BEC succeeds not because your technology failed — it succeeds because a human was deceived by social engineering that was designed to bypass the verification habits most people have. The only defence is building verification into your processes so that certain categories of action (changing banking details, transferring funds above a threshold) cannot be taken based on email alone.

It takes one conversation to implement a payment verification policy. It takes one BEC incident to understand why the policy mattered.