Cybersecurity

How to stop invoice and payment fraud: a business email compromise guide for BC companies

Business email compromise (BEC) is when a criminal uses a real or look-alike email account to trick your staff into paying them. It's one of the most expensive scams small businesses face, and it targets companies that pay suppliers by wire or EFT, especially importers, wholesalers and logistics firms around Richmond and Delta.

By Star X Consulting technical teamPublished Updated 7 min read

Woman reviewing an invoice on a tablet

Fraud is a large and growing problem in Canada. The Canadian Anti-Fraud Centre's data shows over $704 million was reported lost to fraud in 2025 (Law360 Canada), and most fraud is never reported. BEC is a big part of that for businesses because a single successful payment can be tens or hundreds of thousands of dollars.

How the scam works

There are three common versions:

  1. Hacked mailbox. A criminal phishes the email password of someone at your company or at one of your suppliers. They quietly read email for weeks, learn who pays whom, then reply in a real email thread: "Our bank has changed, please use these new details for this invoice."
  2. Look-alike domain. They register a domain one letter different from your supplier's (for example starxx.ca instead of starx.ca) and send convincing invoices from it.
  3. CEO or executive fraud. An "urgent" email that appears to come from the owner asks the bookkeeper for a quick transfer or gift cards, often while the owner is travelling.

Hacked mailboxes often get a hidden rule that forwards or deletes replies, so the real person never sees the conversation.

Warning signs

  • A request to change bank or payment details, especially by email
  • Urgency or secrecy: "pay today", "don't call, I'm in meetings"
  • A sender address that's slightly different, or a reply-to address that doesn't match
  • Changes in tone, language or signature from a contact you know
  • Invoices for amounts or dates that don't quite match previous ones

7 steps to prevent it

  1. Verify every bank-detail change by phone, using a number you already had on file, never one from the email. Write this into your accounts payable process.
  2. Require two people to approve new payees and payments above a set amount.
  3. Turn on MFA for every Microsoft 365 or Google Workspace account, and block legacy sign-in methods that bypass it.
  4. Set up SPF, DKIM and DMARC on your domain, so criminals can't easily send email that appears to come from you.
  5. Block automatic forwarding to outside addresses and alert on new inbox rules.
  6. Flag external email with a visible banner, and warn on look-alike domains.
  7. Train the people who pay bills: a short session on the warning signs above, repeated once or twice a year.

Richmond and Delta businesses that pay suppliers overseas are frequent targets because international wire transfers are hard to reverse. If that's you, steps 1 and 2 matter most.

If it happens to you

  1. Call your bank immediately and ask them to recall or freeze the transfer. Hours matter.
  2. Report it to your local police and the Canadian Anti-Fraud Centre.
  3. Secure the mailbox: reset the password, sign out all sessions, check MFA and remove malicious inbox rules.
  4. Find out how they got in and whether other accounts or customer data were exposed. You may have privacy breach reporting obligations.
  5. Warn affected suppliers and customers so they don't pay fraudulent invoices that appear to come from you.

Star X can lock down your Microsoft 365 or Google Workspace, set up email authentication and run a short payment-fraud session for your finance staff. If you think it's happening right now, call (778) 312-2227 (24/7). See also our cybersecurity services.

Questions we hear a lot

Still unsure? Call (778) 312-2227 and ask a technician directly.

What is business email compromise?

Business email compromise is fraud in which a criminal impersonates a supplier, customer, executive or employee by email, usually from a hacked mailbox or a look-alike domain, and convinces someone to send money or sensitive information.

Can the bank get the money back?

Sometimes, if you act within hours. Call your bank immediately and ask them to recall the transfer, then report it to police and the Canadian Anti-Fraud Centre. The longer you wait, the less likely recovery becomes.

Is a phone call enough to verify new bank details?

Yes, if you call a number you already had on file, not one from the email requesting the change. Criminals often include their own phone number in the fraudulent email.

Does MFA prevent business email compromise?

It prevents the most common route in: a stolen password used to log into your mailbox. It won't stop a look-alike domain or a supplier's hacked account, which is why a payment verification process is also essential.

Keep reading

CybersecurityCybersecurity for Richmond and Delta businesses: MFA, endpoint protection, email security, phishing training, cyber insurance readiness and incident response.Cybersecurity for small businessesWhy Richmond small businesses are targeted by cybercriminals, the attacks we see most, and the 8 security controls that stop most of them.Privacy breach reporting in BCWhen BC businesses must report a privacy breach under PIPEDA and BC PIPA, who to notify, what records to keep for 24 months, and what to do first.

Stop fighting your IT. Hand it to us.

Call now for urgent problems, or book a free, no-obligation IT assessment for your office.

Call (778) 312-2227Get a free IT assessment
IT problem right now? Call (778) 312-2227