Spear Phishing Cost Canadians $67.9M in 2025: How BC Businesses Can Stop Invoice Fraud
The scam that costs Canadian businesses the most money is not a virus. It is a polite email that looks like it came from a supplier, a client or your own boss, asking you to pay an invoice or update banking details. In 2025, the Canadian Anti-Fraud Centre recorded $67.9 million in losses from spear phishing, making it the second most costly fraud type in Canada, behind only investment scams.
The good news: this fraud is almost completely preventable with a few simple rules and the right email settings. This guide shows you exactly how, in plain English.
The numbers (Canadian Anti-Fraud Centre, 2025)
- Spear phishing: 813 reports, 571 victims, $67.9 million lost
- That is an average of roughly $119,000 per victim
- All fraud combined: more than 112,000 reports and over $704 million in reported losses
What is spear phishing, in simple words?
Normal phishing is a fishing net: one fake email sent to thousands of people. Spear phishing is a spear: one carefully prepared message aimed at one business, often at the person who pays the bills. The criminal studies your company first, from your website, LinkedIn, or a mailbox they have already broken into, so the email mentions real names, real projects and real invoice amounts.
The 4 versions we see most often
- “Our bank details have changed.” A real supplier’s email account is hacked, or a look-alike address is used, and your next payment is sent to the criminal’s account.
- The fake boss. An email that appears to come from the owner or director: “I’m in a meeting, I need you to send this payment urgently and keep it quiet.”
- The hijacked email thread. The criminal is already inside a supplier’s mailbox and replies within a real conversation, so everything looks genuine.
- The real estate or deposit switch. Just before a large deposit or closing payment, “new wiring instructions” arrive. Firms handling big one-off payments are prime targets, which is why we work closely with real estate, law and accounting offices on this exact risk.
Why these emails get past smart people
Spear phishing emails rarely contain a virus or a suspicious link, so traditional antivirus has nothing to catch. They are often sent from a real but compromised mailbox, so they pass basic checks. And with AI writing tools, spelling mistakes are gone. The only reliable red flag left is the request itself: money, banking changes, urgency and secrecy.
The “call-back rule”: your most powerful defence
If you remember one thing from this article, make it this. Write it down and give it to everyone who touches money:
Any new or changed payment details, and any urgent or unusual payment request, must be confirmed by a phone call to a number we already have on file. Never use a phone number, link or contact given in the email itself.
This one rule defeats almost every version of the scam, because the criminal controls the email, not your supplier’s real phone line. Make it company policy, so staff feel safe to slow down even when the “boss” is pushing for speed.
A simple payment-change checklist
| Step | What to do |
|---|---|
| 1. Pause | Never act on a banking change on the same day it arrives. |
| 2. Verify by phone | Call the known contact using the number from your records, not the email. |
| 3. Second approval | A second person approves any payment above a set amount, for example $5,000. |
| 4. Test payment | For a brand-new account, send a small amount first and confirm receipt by phone. |
| 5. Record it | Note who verified the change, when and how. |
Email settings that stop many attacks before anyone sees them
Policies protect people. Settings protect the mailbox. If your business uses Microsoft 365, make sure these are in place:
- Multi-factor authentication on every mailbox. Most hijacked threads start with a stolen password. MFA blocks most of those logins.
- “External” tags on incoming email. A visible label on mail from outside your company makes a fake “boss” email stand out instantly.
- Impersonation protection. Microsoft Defender for Office 365 can flag emails pretending to be your executives or your domain.
- SPF, DKIM and DMARC records. These make it much harder for criminals to send email that pretends to be from your own domain.
- Alerts for new forwarding rules. Attackers often set up hidden rules to copy or hide your emails. You want to know the moment one appears.
Our email security service sets all of this up, and our full guide to Microsoft 365 security settings small businesses forget walks through each one.
Already paid a fraudster? Do this in the first hour
- Call your bank immediately and ask for a recall or freeze of the payment. Speed matters more than anything else.
- Do not delete the emails. They are evidence.
- Change the password of the mailbox that received or sent the request, and sign out of all sessions.
- Report it to the Canadian Anti-Fraud Centre and your local police.
- Call your IT provider to check for hidden forwarding rules and other compromised accounts.
- Tell your cyber insurer as early as your policy requires. See what cyber insurance actually requires from your IT.
Frequently asked questions
Is spear phishing the same as business email compromise (BEC)?
They overlap. Business email compromise is a common form of spear phishing in which criminals use a real or fake business email account to trick staff into sending money or data.
Will my bank refund the money?
Sometimes, if you act within hours and the money has not moved on. Because you authorized the payment, banks are not always required to refund it, which is why prevention matters.
Can antivirus stop these emails?
Usually not, because there is often no virus or bad link to detect. Process rules, MFA and email security settings are what stop them.
Is your email set up to stop invoice fraud?
Book a free IT assessment. We will check your Microsoft 365 security, forwarding rules and email authentication and show you exactly where the gaps are.
Insmart Technology provides cybersecurity services and managed IT support for businesses in Surrey, Vancouver and the Lower Mainland.
About the author: Naqash Bin Iqbal is an SEO Specialist at Insmart Technology, a Surrey-based managed IT and cybersecurity provider.
