Ontario Exporters Wired Payments to Phantom Suppliers

COPPERTON, Ont. — November 10, 2026 — The wire transfer was for $214,000, and it took eleven seconds to send. Elena Marsh, who owns a mid-sized food export business in Copperton, had paid the same supplier the same way for four years. The invoice looked right. The email address looked right. The only thing that had changed was the bank account number at the bottom — and by the time anyone noticed, the money was gone.

Marsh is one of at least a dozen Ontario exporters who wired payments to bank accounts controlled by criminals this autumn, after attackers posed as a long-time supplier and sent out new payment instructions. The supplier was real. The invoices were real. The bank accounts were not.

A dozen Ontario exporters paid real invoices into accounts that did not belong to their supplier — and the money is gone.

The scheme was patient. For weeks, the attackers watched the email traffic between the exporters and Prairie Malt & Grain Co., a fictional Manitoba supplier that ships grain and milling products across the country. They learned the order cycle, the invoice format, and the names of the people who approve payments. Then, just as the autumn shipping season peaked, they sent a short message from an address one letter off the supplier’s real one: new banking details, effective immediately, please update your records.

“There was no urgency in it, no threat, nothing that would make you stop and think,” Marsh said. “It read like the kind of administrative note you get three times a year. I forwarded it to our bookkeeper the same afternoon, and the next invoice went to the new account. It felt like routine.”

The real supplier only discovered the switch when it called about an overdue balance. By then, the exporters had wired nearly $900,000 to accounts the criminals controlled, and the money had already been moved on. The fictional exporters say their banks were able to freeze a small portion of the transfers. The rest is gone.

The invoice was genuine. The supplier was genuine. Only the destination had changed.

Business email compromise works because it asks for nothing unusual. No malware, no ransom note, no locked system — just a familiar invoice, a familiar sender, and one changed detail at the bottom of the page. Finance teams process hundreds of supplier payments a month, and a new bank account notice arrives looking like the most boring email of the day. That is exactly why it works.

“Attackers don’t break into the payment system. They break into the conversation around it,” said Marcus Hale, a fictional payments-fraud consultant who advises mid-sized Canadian exporters. “They wait until the relationship is routine, then they change one thing. A company that would question a strange invoice will pay a familiar one without a second look — and by the time the real supplier calls, the money has crossed three borders.”

In this fictional case, the attackers had been inside the email chain for more than a month before sending the new banking details, according to investigators. They timed the switch for the busiest weeks of the shipping season, when finance staff were processing invoices at volume and had the least time to check. None of the exporters had a rule requiring a phone call to confirm a change of bank details.

The fictional exporters say they have since changed how supplier payments work. No bank account change is accepted by email alone — it must be confirmed by a phone call to a number the company already has on file. Payment approvals above a set amount now need a second person to sign off. And any message about new banking details is treated as suspicious until proven otherwise.

The defence is not a sharper eye for fake invoices. It is never changing where money goes on the strength of an email alone.

That advice applies well beyond one shipping season. Across Canada, small and mid-sized businesses pay suppliers the same way every month — same invoices, same senders, same routine — and a single changed account number is all it takes to redirect a payment. The defence is not a cleverer spam filter. It is a habit of verifying every change of payment details out of band, by phone, before a single dollar moves.

For businesses, the checklist is short: never update a supplier’s bank details from an email alone — confirm it by calling a number you already have; require two people to approve any payment above a set threshold; and treat any message about new banking details as a fraud attempt until proven otherwise. For suppliers, it is equally simple: never send new bank details by email, publish a standing warning that payment details only change by phone, and call your customers the moment an invoice goes unpaid.

The fictional exporters say the fraudulent accounts have been reported, and the real Prairie Malt & Grain Co. continues to ship to its Ontario customers.

The invoices were never fake. The supplier was never fake. And the difference — one phone call, made before the money moved instead of after — was all it took.

Watching the perimeter — and what slips past it.

ODTN News note: ODTN.News is a fictional news platform set within the Operation: Defend the North universe. All names, organizations, quotes, and events in this article are entirely fictitious. Any resemblance to real people, companies, or incidents is purely coincidental. The cybersecurity challenges it represents are very real.