COPPERTON, Ont. — November 10, 2026 — The wire transfer was for $214,000, and it took eleven seconds to send. Elena Marsh, who owns a mid-sized food export business in Copperton, had paid the same supplier the same way for four years. The invoice looked right. The email address looked right. The only thing that had changed was the bank account number at the bottom — and by the time anyone noticed, the money was gone.

Marsh is one of at least a dozen Ontario exporters who wired payments to bank accounts controlled by criminals this autumn, after attackers posed as a long-time supplier and sent out new payment instructions. The supplier was real. The invoices were real. The bank accounts were not.

A dozen Ontario exporters paid real invoices into accounts that did not belong to their supplier — and the money is gone.

The scheme was patient. For weeks, the attackers watched the email traffic between the exporters and Prairie Malt & Grain Co., a fictional Manitoba supplier that ships grain and milling products across the country. They learned the order cycle, the invoice format, and the names of the people who approve payments. Then, just as the autumn shipping season peaked, they sent a short message from an address one letter off the supplier’s real one: new banking details, effective immediately, please update your records.

“There was no urgency in it, no threat, nothing that would make you stop and think,” Marsh said. “It read like the kind of administrative note you get three times a year. I forwarded it to our bookkeeper the same afternoon, and the next invoice went to the new account. It felt like routine.”

The real supplier only discovered the switch when it called about an overdue balance. By then, the exporters had wired nearly $900,000 to accounts the criminals controlled, and the money had already been moved on. The fictional exporters say their banks were able to freeze a small portion of the transfers. The rest is gone.

The invoice was genuine. The supplier was genuine. Only the destination had changed.

Business email compromise works because it asks for nothing unusual. No malware, no ransom note, no locked system — just a familiar invoice, a familiar sender, and one changed detail at the bottom of the page. Finance teams process hundreds of supplier payments a month, and a new bank account notice arrives looking like the most boring email of the day. That is exactly why it works.

“Attackers don’t break into the payment system. They break into the conversation around it,” said Marcus Hale, a fictional payments-fraud consultant who advises mid-sized Canadian exporters. “They wait until the relationship is routine, then they change one thing. A company that would question a strange invoice will pay a familiar one without a second look — and by the time the real supplier calls, the money has crossed three borders.”

In this fictional case, the attackers had been inside the email chain for more than a month before sending the new banking details, according to investigators. They timed the switch for the busiest weeks of the shipping season, when finance staff were processing invoices at volume and had the least time to check. None of the exporters had a rule requiring a phone call to confirm a change of bank details.

The fictional exporters say they have since changed how supplier payments work. No bank account change is accepted by email alone — it must be confirmed by a phone call to a number the company already has on file. Payment approvals above a set amount now need a second person to sign off. And any message about new banking details is treated as suspicious until proven otherwise.

The defence is not a sharper eye for fake invoices. It is never changing where money goes on the strength of an email alone.

That advice applies well beyond one shipping season. Across Canada, small and mid-sized businesses pay suppliers the same way every month — same invoices, same senders, same routine — and a single changed account number is all it takes to redirect a payment. The defence is not a cleverer spam filter. It is a habit of verifying every change of payment details out of band, by phone, before a single dollar moves.

For businesses, the checklist is short: never update a supplier’s bank details from an email alone — confirm it by calling a number you already have; require two people to approve any payment above a set threshold; and treat any message about new banking details as a fraud attempt until proven otherwise. For suppliers, it is equally simple: never send new bank details by email, publish a standing warning that payment details only change by phone, and call your customers the moment an invoice goes unpaid.

The fictional exporters say the fraudulent accounts have been reported, and the real Prairie Malt & Grain Co. continues to ship to its Ontario customers.

The invoices were never fake. The supplier was never fake. And the difference — one phone call, made before the money moved instead of after — was all it took.

Watching the perimeter — and what slips past it.

ODTN News note: ODTN.News is a fictional news platform set within the Operation: Defend the North universe. All names, organizations, quotes, and events in this article are entirely fictitious. Any resemblance to real people, companies, or incidents is purely coincidental. The cybersecurity challenges it represents are very real.

MAPLEFORD, Ont. — November 6, 2026 — “We had the banners printed before we realised there was no hall to hang them in,” said Rosa Almeida, owner of a fictional small packaging firm in Mapleford. “The floor plan had our booth number on it. The welcome email had our load-in time. Everything about it felt like a real trade show — except the trade show.”

Almeida was one of 41 small businesses that paid for booth space at a fictional event called the Northern Makers Expo, advertised as a two-day manufacturing and retail trade show at the Mapleford Convention Centre this month. Booths were priced between $2,400 and $6,800, depending on size and position on the floor plan. By the time one exhibitor rang the venue to confirm a forklift booking, the organisers had collected an estimated $180,000 — and the venue had no record of any expo at all.

The event had not been hacked or hijacked. It had simply been invented. A polished website carried the expo’s name, a speaker list, a floor plan, and a countdown clock. A fictional organiser, Harbourline Events Group, sent exhibitor packs, invoices, and a payment link for a “booth services” account. The site even listed a local hotel partner offering an exhibitor rate. The hotel had never heard of the expo. Neither had the venue, the listed speakers, or the trade association whose logo appeared on the site.

The expo never existed. The invoices were real enough to pay.

According to the fictional exhibitors who spoke to ODTN News, the scheme worked because every step of it looked like the normal run-up to a trade show. The exhibitor pack arrived on schedule. The floor plan was updated twice, with booths marked sold. A “final details” email went out a week before the supposed opening, asking exhibitors to confirm their power requirements and their arrival times. Several businesses ordered stock, printed banners, and booked hotel rooms before anyone thought to call the venue directly.

“We did what we always do,” said Almeida. “We checked the website, we checked the floor plan, we paid the invoice from the email the organiser sent us. Nobody checks whether the hall itself has the event in its book — you assume the organiser has done that part. That is the whole point of an organiser.”

A trade show is a trust business — and trust was the only thing on sale.

Small-business fraud advisors say fake expos are attractive precisely because exhibitors are used to paying upfront, months ahead, for something that does not exist yet. A booth is a promise: a patch of carpet, a table, and two days of foot traffic, sold long before the doors open. That gap between payment and delivery is exactly where a copycat event can live, collecting deposits from dozens of businesses before any of them arrives to find an empty hall.

“A real expo sells you a space that will exist,” said Mara Ellison, a fictional advisor who works with small manufacturers on payment fraud. “A fake one sells you the paperwork around the space — the floor plan, the invoice, the welcome pack. Every document feels like proof, and every document can be produced on a laptop in an afternoon. The only document that matters is the venue’s own booking, and almost nobody asks for it.”

In this fictional case, the money moved fast and quietly. Most exhibitors paid by e-transfer or wire to the “booth services” account named on the invoice, and several paid in full rather than in instalments, lured by an early-bird discount that expired the week the expo was announced. By the time the venue confirmed it had no booking, the account had been emptied and the expo’s phone line had stopped answering. The website stayed up for another day, still counting down to an opening that would never happen.

The fictional exhibitors say they have since changed how they book events. New shows are now checked against the venue’s own events calendar before any deposit is paid, and payments go only to accounts named on the venue’s own exhibitor information — never to an account that appears only on the organiser’s invoice. Several of the businesses have begun sharing the names of events they have verified, so a new show with no track record gets a phone call to the hall before it gets a deposit.

The fix, experts say, is a single phone call made before the money moves.

That advice applies well beyond one expo. Across Canada, small businesses pay deposits for trade shows, markets, and craft fairs months in advance, usually on the strength of a website and an invoice. The defence is not a cleverer booking platform. It is a habit of checking the venue’s own calendar before paying for a space in it.

For exhibitors, the checklist is short: confirm the event on the venue’s own website or by phone, pay only to an account the venue itself confirms, and be suspicious of an early-bird discount that pressures a full payment before the event has a track record. For venues, it is equally simple: publish a public events calendar, answer exhibitor verification calls quickly, and flag any event using the venue’s name that is not in the book.

The fictional exhibitors say the expo’s website has been reported for removal, and the payments have been reported to their banks.

The booths were sold. The hall was never booked. And the difference — one call to the venue, made before the deposit — was all it took.

Watching the perimeter — and what slips past it.

ODTN News note: ODTN.News is a fictional news platform set within the Operation: Defend the North universe. All names, organizations, quotes, and events in this article are entirely fictitious. Any resemblance to real people, companies, or incidents is purely coincidental. The cybersecurity challenges it represents are very real.

CANMORE, Alta. — November 3, 2026 — The room was booked, the deposit was paid, and the confirmation email looked exactly right. When the guests arrived at Stonepine Lodge, the fictional Canmore inn at the centre of the story, there was no reservation under their name — and the room they thought they had paid for was already occupied. The inn had not lost their booking. Someone else had taken it over before they ever arrived.

The problem was not in the inn’s own booking system. It was in the listing most guests found first: the inn’s profile on a popular map and travel directory. Sometime in the autumn, the phone number and booking link on that listing had been quietly changed. Callers reached a polite voice who took deposits by card, and online bookers landed on a copy of the inn’s booking page, complete with its photos, its room names, and its rates. The money went to an account that had nothing to do with the inn, and the guests’ details went with it.

The room had not been double-booked. It had never been booked at all.

According to the fictional inn’s account, the pattern emerged only when several guests arrived in the same week with confirmations the front desk could not find. Staff compared the confirmations with their own system and found the mismatch — the email addresses were slightly different, the booking references did not exist, and the phone number on the guests’ confirmations was not the inn’s. One guest had even called “the inn” to confirm a late arrival, and been reassured by a stranger.

“We answer the phone with the same greeting we’ve used for years, and suddenly people are telling us about conversations we never had,” said June Calloway, Stonepine Lodge’s fictional owner. “Guests arrive tired after a long drive, holding a confirmation we can’t honour, and they think we’ve made a mistake. We hadn’t. Someone was standing in front of our front door, wearing our name, and collecting our guests before they reached us.”

Hijacked business listings are a quiet, growing target for small-business fraud.

Cybersecurity and small-business advisors say directory listings are attractive precisely because they are trusted, public, and rarely checked. A listing does not need to be hacked in the dramatic sense — an attacker only needs to submit a plausible “correction” to a phone number or website, or to claim an unverified profile, and wait for the platform to accept it. Guests, meanwhile, trust the first result they see, especially when the photos and reviews look familiar.

“The listing did exactly what it was designed to do. It sent guests to a booking page,” said one small-business fraud advisor familiar with listing-hijack cases. “The attacker did not need to break into the inn’s systems. They only needed to change where the listing pointed, and let honest guests do the rest.”

In this fictional case, the damage was not a single dramatic theft. Individual deposits ranged from one night’s stay to a full weekend, and the inn estimates several thousand dollars was diverted in total before the listing was corrected. For the guests, the loss was compounded by the moment of discovery — arriving late, in the mountains, to a room that was never theirs, with card details already handed to a stranger. For the inn, the damage was reputational as well as financial: guests who had done nothing wrong left believing the inn had failed them.

Stonepine Lodge says it has since changed how it guards its online presence. The inn reclaimed and verified its listings on every major directory, set up alerts for changes to its phone number and website, and now checks its listings weekly, the way it checks its smoke alarms. Its real phone number and booking link are printed on its door, its receipts, and its own website, and staff are trained to spot a confirmation that did not come from the inn’s own system.

The fix, experts say, is deliberately unglamorous: claim the listing before someone else does.

That advice applies well beyond one inn. Across Canada, restaurants, clinics, tradespeople, and small hotels all depend on listings they may never have claimed, and most owners check them only when a customer complains. The defence is not a cleverer directory. It is ownership of the profile guests actually see.

For guests, the checklist is short: book through the business’s own website or the phone number printed on its door or receipt, be suspicious of a booking page reached only through a directory link, and check that a confirmation email comes from the business’s own domain. For small businesses, it is equally simple: claim and verify every listing, lock it with two-factor authentication where available, set change alerts, and check the phone number and booking link regularly — especially before a busy season.

Stonepine Lodge says affected guests are being offered rebooked stays where a diverted deposit can be proven, and the inn is asking guests to forward suspicious confirmations so the copycat pages can be reported and taken down.

The room was booked in good faith. The listing guests trusted was no longer the inn’s. And the difference — one phone number, checked before the season began — was all it took.

Watching the perimeter — and what slips past it.

ODTN News note: ODTN.News is a fictional news platform set within the Operation: Defend the North universe. All names, organizations, quotes, and events in this article are entirely fictitious. Any resemblance to real people, companies, or incidents is purely coincidental. The cybersecurity challenges it represents are very real.