What to do if you sent a payment to a fraudster

Phone your bank's business fraud line, not your branch's general number, and say clearly that you have sent a fraudulent payment and want it recalled or frozen. Have ready: the date and time, amount, payment type (wire, EFT, Interac e-Transfer, cheque), the receiving bank and account details, and any confirmation or reference number.

Ask the bank to contact the receiving institution directly. Banks can sometimes stop or freeze funds that haven't been moved on yet, but how much can be done depends on timing and the institutions involved. Ask for a reference number for your fraud claim and the name of the person you spoke to.

If more payments are scheduled to the same account, cancel them now.

Report to your local police and get an occurrence or file number; your bank and your insurer may ask for it.

Report to the Canadian Anti-Fraud Centre (CAFC). The CAFC and the RCMP's National Cybercrime Coordination Centre (NC3) share an online reporting system at reportcyberandfraud.canada.ca, or you can call the CAFC at 1-888-495-8501 (staffed weekdays, Eastern time). The CAFC doesn't investigate individual cases; police do, but reports help link related crimes.

If you have cyber or crime insurance, notify the insurer now. Social engineering and funds-transfer fraud coverage often has specific conditions, so read the wording or ask your broker.

• Do not delete the fraudulent emails, the invoice, or the thread they sat in.
• Save each message with full headers (in Outlook: File > Properties, or save as .msg/.eml). Headers show which servers really sent the mail.
• Keep the PDF invoice exactly as received; its metadata can matter.
• Write a short timeline: when the change request arrived, who approved the payment, and any phone calls.
• Screenshot online banking confirmations.

Most payment fraud starts with a compromised mailbox, either yours or the vendor's. Attackers read the real conversation, then insert themselves at the right moment, often with a lookalike domain or by sending from the real account.

Have your IT administrator or a responder check, for the people involved in the payment: recent sign-ins from unfamiliar locations, inbox rules that move or forward mail, external forwarding, newly registered MFA methods, and app consents. Microsoft's incident response playbooks for phishing and compromised accounts list these checks. If anything is found, follow What to do if a Microsoft 365 account is hacked and treat it as a security incident, not just a fraud.

Call your real contact at a known number and tell them what happened. If the fraudulent request came from their genuine address, their mailbox is probably compromised and they may have other victims. If it came from a lookalike domain, they need to warn their other customers.

Agree what each of you will tell your insurers and banks, and keep a record of the conversation. Who bears the loss is a contract and insurance question; don't make admissions in the heat of the moment, and involve your lawyer if the amount is significant.

• Require a callback to a number already on file for any new or changed banking details, no exceptions for urgency.
• Use two-person approval for new payees and for payments above a set amount.
• Enforce phishing-resistant MFA on email and banking.
• Publish DMARC at enforcement on your own domains so they're harder to spoof.
• Train accounts payable staff on what these requests look like; see What to do when a vendor asks to change their bank details.