CANMORE, Alta. — November 3, 2026 — The room was booked, the deposit was paid, and the confirmation email looked exactly right. When the guests arrived at Stonepine Lodge, the fictional Canmore inn at the centre of the story, there was no reservation under their name — and the room they thought they had paid for was already occupied. The inn had not lost their booking. Someone else had taken it over before they ever arrived.

The problem was not in the inn’s own booking system. It was in the listing most guests found first: the inn’s profile on a popular map and travel directory. Sometime in the autumn, the phone number and booking link on that listing had been quietly changed. Callers reached a polite voice who took deposits by card, and online bookers landed on a copy of the inn’s booking page, complete with its photos, its room names, and its rates. The money went to an account that had nothing to do with the inn, and the guests’ details went with it.

The room had not been double-booked. It had never been booked at all.

According to the fictional inn’s account, the pattern emerged only when several guests arrived in the same week with confirmations the front desk could not find. Staff compared the confirmations with their own system and found the mismatch — the email addresses were slightly different, the booking references did not exist, and the phone number on the guests’ confirmations was not the inn’s. One guest had even called “the inn” to confirm a late arrival, and been reassured by a stranger.

“We answer the phone with the same greeting we’ve used for years, and suddenly people are telling us about conversations we never had,” said June Calloway, Stonepine Lodge’s fictional owner. “Guests arrive tired after a long drive, holding a confirmation we can’t honour, and they think we’ve made a mistake. We hadn’t. Someone was standing in front of our front door, wearing our name, and collecting our guests before they reached us.”

Hijacked business listings are a quiet, growing target for small-business fraud.

Cybersecurity and small-business advisors say directory listings are attractive precisely because they are trusted, public, and rarely checked. A listing does not need to be hacked in the dramatic sense — an attacker only needs to submit a plausible “correction” to a phone number or website, or to claim an unverified profile, and wait for the platform to accept it. Guests, meanwhile, trust the first result they see, especially when the photos and reviews look familiar.

“The listing did exactly what it was designed to do. It sent guests to a booking page,” said one small-business fraud advisor familiar with listing-hijack cases. “The attacker did not need to break into the inn’s systems. They only needed to change where the listing pointed, and let honest guests do the rest.”

In this fictional case, the damage was not a single dramatic theft. Individual deposits ranged from one night’s stay to a full weekend, and the inn estimates several thousand dollars was diverted in total before the listing was corrected. For the guests, the loss was compounded by the moment of discovery — arriving late, in the mountains, to a room that was never theirs, with card details already handed to a stranger. For the inn, the damage was reputational as well as financial: guests who had done nothing wrong left believing the inn had failed them.

Stonepine Lodge says it has since changed how it guards its online presence. The inn reclaimed and verified its listings on every major directory, set up alerts for changes to its phone number and website, and now checks its listings weekly, the way it checks its smoke alarms. Its real phone number and booking link are printed on its door, its receipts, and its own website, and staff are trained to spot a confirmation that did not come from the inn’s own system.

The fix, experts say, is deliberately unglamorous: claim the listing before someone else does.

That advice applies well beyond one inn. Across Canada, restaurants, clinics, tradespeople, and small hotels all depend on listings they may never have claimed, and most owners check them only when a customer complains. The defence is not a cleverer directory. It is ownership of the profile guests actually see.

For guests, the checklist is short: book through the business’s own website or the phone number printed on its door or receipt, be suspicious of a booking page reached only through a directory link, and check that a confirmation email comes from the business’s own domain. For small businesses, it is equally simple: claim and verify every listing, lock it with two-factor authentication where available, set change alerts, and check the phone number and booking link regularly — especially before a busy season.

Stonepine Lodge says affected guests are being offered rebooked stays where a diverted deposit can be proven, and the inn is asking guests to forward suspicious confirmations so the copycat pages can be reported and taken down.

The room was booked in good faith. The listing guests trusted was no longer the inn’s. And the difference — one phone number, checked before the season began — was all it took.

Watching the perimeter — and what slips past it.

ODTN News note: ODTN.News is a fictional news platform set within the Operation: Defend the North universe. All names, organizations, quotes, and events in this article are entirely fictitious. Any resemblance to real people, companies, or incidents is purely coincidental. The cybersecurity challenges it represents are very real.

SASKATOON, Sask. — October 31, 2026 — The bid was ready days early. The numbers had been checked twice, the submission had been uploaded through the client’s tender portal, and the confirmation email had arrived with its usual green tick. Prairieview Builders, the fictional Saskatoon construction firm at the centre of the story, expected to win the job. Instead, it lost — to a bid that was higher than its own, on a tender it had priced to win.

The mystery was not the rival’s price. It was Prairieview’s own submission, which no longer matched the numbers the company had approved. Somewhere between upload and evaluation, a single figure in the bid had changed — a subcontractor line, quietly altered, that pushed the total just far enough out of contention.

The bid had not been miscalculated. It had been tampered with.

According to the fictional company’s account, the alteration was discovered only when a staff member compared the portal’s stored copy of the submission against the firm’s own signed-off version. The two documents looked identical at a glance. The difference was one line, one figure, and one very expensive outcome.

“We build buildings. We don’t expect to have to defend a PDF,” said Elise Moreau, Prairieview’s fictional project lead. “Our bid was right when it left this office. The version the client scored was not the version we sent. That is the part that still keeps me up at night.”

Bid portals are a quiet, growing target for business fraud.

Cybersecurity advisors familiar with procurement fraud say tender and bid-submission portals are attractive precisely because they sit between two organizations, trusted by both and closely watched by neither. An attacker who gains access — through a reused password, a shared login, or a vendor account left active after a project ends — can alter a submission, view a competitor’s pricing, or quietly lock a bidder out until the deadline passes.

“The portal is treated as a mailbox, and mailboxes are assumed to be honest,” said one cybersecurity advisor familiar with procurement-system cases. “But a portal is a system, and systems can be changed. If nobody compares what was sent with what was scored, a tampered bid looks exactly like a losing bid.”

In this fictional case, the stakes were a single contract — the firm’s largest of the year — and the jobs and subcontractor bookings that went with it. No ransom note arrived, no systems were locked, and nothing was stolen in the usual sense. The damage was done with an edit, not an attack that announced itself.

Prairieview says it has since changed how it bids. Submissions are now exported and stored in a locked, time-stamped copy the moment they are uploaded, portal access is limited to named individuals with multi-factor authentication, and shared logins have been removed entirely. The company also now asks clients to confirm receipt of the exact file it sent, not just that a submission arrived.

The fix, experts say, is deliberately unglamorous: keep your own copy, and compare it.

That advice applies well beyond construction. Across Canada, small and mid-sized businesses submit bids, quotes, and proposals through client and government portals every day, and most never check what the portal holds after they press send. The defence is not better bidding. It is proof of what was bid.

For businesses, the checklist is short: save a time-stamped copy of every submission the moment it is uploaded, restrict portal access to named accounts with multi-factor authentication, close vendor and former-staff accounts promptly, and ask the receiving side to confirm the file itself — not just its arrival. For portal operators, it is equally simple: log every change to a submitted document, show bidders an unchangeable receipt of exactly what they filed, and alert both sides when a submission is edited after upload.

Prairieview says it raised the altered bid with the client, which is reviewing its portal’s access logs. The contract has already been awarded, and the firm says it does not expect the decision to be revisited.

The bid was right when it left the office. The version that was scored was not. And the difference — one line, changed in a system nobody was watching — was all it took.

Watching the perimeter — and what slips past it.

ODTN News note: ODTN.News is a fictional news platform set within the Operation: Defend the North universe. All names, organizations, quotes, and events in this article are entirely fictitious. Any resemblance to real people, companies, or incidents is purely coincidental. The cybersecurity challenges it represents are very real.

**THUNDER BAY, Ont. — October 29, 2026 —** The load looked legitimate. It had a pickup address, a delivery window, a reference number, and a contact name that matched a company the driver had hauled for before. It appeared on a freight board the dispatcher checked every morning, and it paid a fair rate for a run north in late October.

There was only one problem: the company that supposedly posted it had never heard of the load.

Northpine Freight, the fictional Thunder Bay trucking company at the centre of the story, says one of its drivers was dispatched to a warehouse on the edge of town to collect a trailer of winter supplies — road salt, de-icing fluid, and cold-weather gear bound for a fictional northern depot. When the driver arrived, the warehouse staff had no such trailer ready, no such order on file, and no record of the contact name on the posting.

**The load did not exist. The diversion was the point.**

By the time the dispatcher traced the posting back, the trail had already forked. A second driver — working for a different carrier, answering what appeared to be the same load from a different board — had reportedly collected a trailer from a nearby yard and headed north with goods that were never meant to move that day. Northpine says it is still unclear whether the two postings were copies of each other, or whether one was built to legitimize the other.

“We run a small board check every morning, and this one passed it,” said Marla Jensen, the company’s fictional dispatch manager. “The rate was normal, the lane was normal, the paperwork looked normal. It was only when our driver got to an empty dock that we realized the load itself was the scam.”

**Fake freight postings are a quiet, growing corner of supply-chain fraud.**

Unlike a hacked system or a stolen truck, this tactic needs no break-in. Fraud prevention advisors say attackers copy the look of a real posting — a plausible shipper, a real-sounding lane, a rate just fair enough not to raise questions — and use it to redirect a driver, a trailer, or a payment to a place they control.

“The driver is not the target. The driver’s trust is,” said one supply-chain fraud advisor familiar with load-board scams. “If the posting looks right and the dispatcher is under pressure to keep trucks moving, the truck moves first and the questions come later.”

In this fictional case, the pressure was seasonal. Late October is the last comfortable window to move winter supplies north before ice and snow narrow the roads, and dispatchers are juggling tight windows, driver hours, and customers who cannot afford a missed delivery.

Northpine Freight says it has since changed its dispatch process. New postings from unfamiliar accounts now require a callback to a number already on file — never a number printed in the posting itself — plus a confirmation from the shipper before a driver is sent to a pickup. Drivers have also been told to stop and call dispatch if a pickup address, contact, or trailer number does not match the paperwork exactly.

**The fix, experts say, is deliberately unglamorous: verify the load before the wheels turn.**

That advice applies well beyond trucking. Across Canada, small and mid-sized carriers remain prime targets precisely because their dispatch processes are lean: one person often books, verifies, and dispatches a load, and a familiar-looking posting is treated as a trusted partner, not a suspect.

For carriers, the checklist is short: confirm new shippers by phone using a number already on file, require a second check on any posting that arrives with urgency attached, and treat a pickup that does not match the paperwork as a stop-and-verify moment, not a delay to work around. For shippers, it is equally simple: tell carriers, in advance, which boards you actually post on — and that you will never change a pickup by message alone.

Northpine Freight says it is working with the yard operators and its industry contacts to trace the diverted trailer. No estimate of recovery has been released.

The posting itself looked real. The load did not. And the difference — a few copied details, and one unchecked dispatch — was all it took.

*Watching the perimeter — and what slips past it.*

**ODTN News note:** ODTN.News is a fictional news platform set within the Operation: Defend the North universe. All names, organizations, quotes, and events in this article are entirely fictitious. Any resemblance to real people, companies, or incidents is purely coincidental. The cybersecurity challenges it represents are very real.