The Changed Bank Details: How One Spoofed Email Diverted a Winnipeg Distributor’s Payment

WINNIPEG, Man. — October 28, 2026 — The email arrived on a Friday afternoon, at the exact moment the accounts office was clearing its end-of-week payments. It looked like it came from a long-time supplier. It used the supplier’s name, its usual sign-off, and a familiar invoice reference. It asked for one small change before the money went out: please update our bank details.

Prairie Frost Distribution, the fictional Winnipeg cold-storage company at the centre of the story, made the change — and sent a five-figure payment to an account it had never used before.

The supplier had not sent the email. The supplier had not changed its bank details.

“We had paid this supplier dozens of times,” said Dana Whitfield, the company’s fictional finance manager. “The email sounded like them, the invoice number matched, and the request seemed routine. It was only on Monday, when the real supplier called about an overdue invoice, that we realized the money had gone somewhere else entirely.”

The message was a classic business email compromise: not a hacked system, but a carefully impersonated one. Investigators familiar with the fictional case say the sender’s address was a near-copy of the real domain — close enough to pass a busy Friday glance, different enough to route replies to the attacker.

The fraud did not need malware. It needed timing, familiarity, and a process with no second check.

Friday afternoons are a known pressure point, fraud prevention advisors say. Staff are clearing queues, suppliers are closing their own weeks, and a request framed as urgent — “please update before this payment runs” — is more likely to be actioned than questioned.

“People don’t fall for these emails because they are careless,” said one fraud prevention advisor familiar with payment scams. “They fall for them because the email arrives inside a real workflow, about a real invoice, at the moment they are trying to finish the job.”

In this case, the warning signs were small and easy to miss in isolation: a reply-to address that did not match the sender, a bank account in a different institution from the supplier’s usual one, and a request to change payment details by email alone — something the real supplier had never asked for.

Prairie Frost Distribution says it has since changed its payment process. Bank-detail changes now require a callback to a known number — never a number printed in the email making the request — plus a second approver before any altered payment is released. Staff have also been briefed to treat any payment-change request, however routine it looks, as a stop-and-verify moment.

The fix, experts say, is deliberately unglamorous: slow the payment down, check it another way, and never let an email alone move money to a new account.

That advice applies well beyond cold storage. Across Canada, small and mid-sized businesses remain prime targets precisely because their payment processes are lean: one person often prepares, approves, and sends a payment, and suppliers are trusted partners, not suspects.

For businesses, the checklist is short: verify bank changes by phone using a number already on file, require two people to approve any new payee account, and flag any change request that arrives with urgency attached. For suppliers, it is equally simple: tell customers, in advance, that you will never change bank details by email alone.

Prairie Frost Distribution says it is working with its bank and payment provider to trace the diverted funds. No estimate of recovery has been released.

The invoice itself was real. The account was not. And the difference — a few characters in an email address, and one unchecked change — was all it took.

Watching the perimeter — and what slips past it.

ODTN News note: ODTN.News is a fictional news platform set within the Operation: Defend the North universe. All names, organizations, quotes, and events in this article are entirely fictitious. Any resemblance to real people, companies, or incidents is purely coincidental. The cybersecurity challenges it represents are very real.