MAPLEFORD, Ont. — November 6, 2026 — “We had the banners printed before we realised there was no hall to hang them in,” said Rosa Almeida, owner of a fictional small packaging firm in Mapleford. “The floor plan had our booth number on it. The welcome email had our load-in time. Everything about it felt like a real trade show — except the trade show.”

Almeida was one of 41 small businesses that paid for booth space at a fictional event called the Northern Makers Expo, advertised as a two-day manufacturing and retail trade show at the Mapleford Convention Centre this month. Booths were priced between $2,400 and $6,800, depending on size and position on the floor plan. By the time one exhibitor rang the venue to confirm a forklift booking, the organisers had collected an estimated $180,000 — and the venue had no record of any expo at all.

The event had not been hacked or hijacked. It had simply been invented. A polished website carried the expo’s name, a speaker list, a floor plan, and a countdown clock. A fictional organiser, Harbourline Events Group, sent exhibitor packs, invoices, and a payment link for a “booth services” account. The site even listed a local hotel partner offering an exhibitor rate. The hotel had never heard of the expo. Neither had the venue, the listed speakers, or the trade association whose logo appeared on the site.

The expo never existed. The invoices were real enough to pay.

According to the fictional exhibitors who spoke to ODTN News, the scheme worked because every step of it looked like the normal run-up to a trade show. The exhibitor pack arrived on schedule. The floor plan was updated twice, with booths marked sold. A “final details” email went out a week before the supposed opening, asking exhibitors to confirm their power requirements and their arrival times. Several businesses ordered stock, printed banners, and booked hotel rooms before anyone thought to call the venue directly.

“We did what we always do,” said Almeida. “We checked the website, we checked the floor plan, we paid the invoice from the email the organiser sent us. Nobody checks whether the hall itself has the event in its book — you assume the organiser has done that part. That is the whole point of an organiser.”

A trade show is a trust business — and trust was the only thing on sale.

Small-business fraud advisors say fake expos are attractive precisely because exhibitors are used to paying upfront, months ahead, for something that does not exist yet. A booth is a promise: a patch of carpet, a table, and two days of foot traffic, sold long before the doors open. That gap between payment and delivery is exactly where a copycat event can live, collecting deposits from dozens of businesses before any of them arrives to find an empty hall.

“A real expo sells you a space that will exist,” said Mara Ellison, a fictional advisor who works with small manufacturers on payment fraud. “A fake one sells you the paperwork around the space — the floor plan, the invoice, the welcome pack. Every document feels like proof, and every document can be produced on a laptop in an afternoon. The only document that matters is the venue’s own booking, and almost nobody asks for it.”

In this fictional case, the money moved fast and quietly. Most exhibitors paid by e-transfer or wire to the “booth services” account named on the invoice, and several paid in full rather than in instalments, lured by an early-bird discount that expired the week the expo was announced. By the time the venue confirmed it had no booking, the account had been emptied and the expo’s phone line had stopped answering. The website stayed up for another day, still counting down to an opening that would never happen.

The fictional exhibitors say they have since changed how they book events. New shows are now checked against the venue’s own events calendar before any deposit is paid, and payments go only to accounts named on the venue’s own exhibitor information — never to an account that appears only on the organiser’s invoice. Several of the businesses have begun sharing the names of events they have verified, so a new show with no track record gets a phone call to the hall before it gets a deposit.

The fix, experts say, is a single phone call made before the money moves.

That advice applies well beyond one expo. Across Canada, small businesses pay deposits for trade shows, markets, and craft fairs months in advance, usually on the strength of a website and an invoice. The defence is not a cleverer booking platform. It is a habit of checking the venue’s own calendar before paying for a space in it.

For exhibitors, the checklist is short: confirm the event on the venue’s own website or by phone, pay only to an account the venue itself confirms, and be suspicious of an early-bird discount that pressures a full payment before the event has a track record. For venues, it is equally simple: publish a public events calendar, answer exhibitor verification calls quickly, and flag any event using the venue’s name that is not in the book.

The fictional exhibitors say the expo’s website has been reported for removal, and the payments have been reported to their banks.

The booths were sold. The hall was never booked. And the difference — one call to the venue, made before the deposit — was all it took.

Watching the perimeter — and what slips past it.

ODTN News note: ODTN.News is a fictional news platform set within the Operation: Defend the North universe. All names, organizations, quotes, and events in this article are entirely fictitious. Any resemblance to real people, companies, or incidents is purely coincidental. The cybersecurity challenges it represents are very real.

CANMORE, Alta. — November 3, 2026 — The room was booked, the deposit was paid, and the confirmation email looked exactly right. When the guests arrived at Stonepine Lodge, the fictional Canmore inn at the centre of the story, there was no reservation under their name — and the room they thought they had paid for was already occupied. The inn had not lost their booking. Someone else had taken it over before they ever arrived.

The problem was not in the inn’s own booking system. It was in the listing most guests found first: the inn’s profile on a popular map and travel directory. Sometime in the autumn, the phone number and booking link on that listing had been quietly changed. Callers reached a polite voice who took deposits by card, and online bookers landed on a copy of the inn’s booking page, complete with its photos, its room names, and its rates. The money went to an account that had nothing to do with the inn, and the guests’ details went with it.

The room had not been double-booked. It had never been booked at all.

According to the fictional inn’s account, the pattern emerged only when several guests arrived in the same week with confirmations the front desk could not find. Staff compared the confirmations with their own system and found the mismatch — the email addresses were slightly different, the booking references did not exist, and the phone number on the guests’ confirmations was not the inn’s. One guest had even called “the inn” to confirm a late arrival, and been reassured by a stranger.

“We answer the phone with the same greeting we’ve used for years, and suddenly people are telling us about conversations we never had,” said June Calloway, Stonepine Lodge’s fictional owner. “Guests arrive tired after a long drive, holding a confirmation we can’t honour, and they think we’ve made a mistake. We hadn’t. Someone was standing in front of our front door, wearing our name, and collecting our guests before they reached us.”

Hijacked business listings are a quiet, growing target for small-business fraud.

Cybersecurity and small-business advisors say directory listings are attractive precisely because they are trusted, public, and rarely checked. A listing does not need to be hacked in the dramatic sense — an attacker only needs to submit a plausible “correction” to a phone number or website, or to claim an unverified profile, and wait for the platform to accept it. Guests, meanwhile, trust the first result they see, especially when the photos and reviews look familiar.

“The listing did exactly what it was designed to do. It sent guests to a booking page,” said one small-business fraud advisor familiar with listing-hijack cases. “The attacker did not need to break into the inn’s systems. They only needed to change where the listing pointed, and let honest guests do the rest.”

In this fictional case, the damage was not a single dramatic theft. Individual deposits ranged from one night’s stay to a full weekend, and the inn estimates several thousand dollars was diverted in total before the listing was corrected. For the guests, the loss was compounded by the moment of discovery — arriving late, in the mountains, to a room that was never theirs, with card details already handed to a stranger. For the inn, the damage was reputational as well as financial: guests who had done nothing wrong left believing the inn had failed them.

Stonepine Lodge says it has since changed how it guards its online presence. The inn reclaimed and verified its listings on every major directory, set up alerts for changes to its phone number and website, and now checks its listings weekly, the way it checks its smoke alarms. Its real phone number and booking link are printed on its door, its receipts, and its own website, and staff are trained to spot a confirmation that did not come from the inn’s own system.

The fix, experts say, is deliberately unglamorous: claim the listing before someone else does.

That advice applies well beyond one inn. Across Canada, restaurants, clinics, tradespeople, and small hotels all depend on listings they may never have claimed, and most owners check them only when a customer complains. The defence is not a cleverer directory. It is ownership of the profile guests actually see.

For guests, the checklist is short: book through the business’s own website or the phone number printed on its door or receipt, be suspicious of a booking page reached only through a directory link, and check that a confirmation email comes from the business’s own domain. For small businesses, it is equally simple: claim and verify every listing, lock it with two-factor authentication where available, set change alerts, and check the phone number and booking link regularly — especially before a busy season.

Stonepine Lodge says affected guests are being offered rebooked stays where a diverted deposit can be proven, and the inn is asking guests to forward suspicious confirmations so the copycat pages can be reported and taken down.

The room was booked in good faith. The listing guests trusted was no longer the inn’s. And the difference — one phone number, checked before the season began — was all it took.

Watching the perimeter — and what slips past it.

ODTN News note: ODTN.News is a fictional news platform set within the Operation: Defend the North universe. All names, organizations, quotes, and events in this article are entirely fictitious. Any resemblance to real people, companies, or incidents is purely coincidental. The cybersecurity challenges it represents are very real.

SASKATOON, Sask. — October 31, 2026 — The bid was ready days early. The numbers had been checked twice, the submission had been uploaded through the client’s tender portal, and the confirmation email had arrived with its usual green tick. Prairieview Builders, the fictional Saskatoon construction firm at the centre of the story, expected to win the job. Instead, it lost — to a bid that was higher than its own, on a tender it had priced to win.

The mystery was not the rival’s price. It was Prairieview’s own submission, which no longer matched the numbers the company had approved. Somewhere between upload and evaluation, a single figure in the bid had changed — a subcontractor line, quietly altered, that pushed the total just far enough out of contention.

The bid had not been miscalculated. It had been tampered with.

According to the fictional company’s account, the alteration was discovered only when a staff member compared the portal’s stored copy of the submission against the firm’s own signed-off version. The two documents looked identical at a glance. The difference was one line, one figure, and one very expensive outcome.

“We build buildings. We don’t expect to have to defend a PDF,” said Elise Moreau, Prairieview’s fictional project lead. “Our bid was right when it left this office. The version the client scored was not the version we sent. That is the part that still keeps me up at night.”

Bid portals are a quiet, growing target for business fraud.

Cybersecurity advisors familiar with procurement fraud say tender and bid-submission portals are attractive precisely because they sit between two organizations, trusted by both and closely watched by neither. An attacker who gains access — through a reused password, a shared login, or a vendor account left active after a project ends — can alter a submission, view a competitor’s pricing, or quietly lock a bidder out until the deadline passes.

“The portal is treated as a mailbox, and mailboxes are assumed to be honest,” said one cybersecurity advisor familiar with procurement-system cases. “But a portal is a system, and systems can be changed. If nobody compares what was sent with what was scored, a tampered bid looks exactly like a losing bid.”

In this fictional case, the stakes were a single contract — the firm’s largest of the year — and the jobs and subcontractor bookings that went with it. No ransom note arrived, no systems were locked, and nothing was stolen in the usual sense. The damage was done with an edit, not an attack that announced itself.

Prairieview says it has since changed how it bids. Submissions are now exported and stored in a locked, time-stamped copy the moment they are uploaded, portal access is limited to named individuals with multi-factor authentication, and shared logins have been removed entirely. The company also now asks clients to confirm receipt of the exact file it sent, not just that a submission arrived.

The fix, experts say, is deliberately unglamorous: keep your own copy, and compare it.

That advice applies well beyond construction. Across Canada, small and mid-sized businesses submit bids, quotes, and proposals through client and government portals every day, and most never check what the portal holds after they press send. The defence is not better bidding. It is proof of what was bid.

For businesses, the checklist is short: save a time-stamped copy of every submission the moment it is uploaded, restrict portal access to named accounts with multi-factor authentication, close vendor and former-staff accounts promptly, and ask the receiving side to confirm the file itself — not just its arrival. For portal operators, it is equally simple: log every change to a submitted document, show bidders an unchangeable receipt of exactly what they filed, and alert both sides when a submission is edited after upload.

Prairieview says it raised the altered bid with the client, which is reviewing its portal’s access logs. The contract has already been awarded, and the firm says it does not expect the decision to be revisited.

The bid was right when it left the office. The version that was scored was not. And the difference — one line, changed in a system nobody was watching — was all it took.

Watching the perimeter — and what slips past it.

ODTN News note: ODTN.News is a fictional news platform set within the Operation: Defend the North universe. All names, organizations, quotes, and events in this article are entirely fictitious. Any resemblance to real people, companies, or incidents is purely coincidental. The cybersecurity challenges it represents are very real.