Payment Redirection Fraud: When the Invoice Is Real but the Bank Account Isn’t

A customer receives a legitimate invoice from a supplier they have worked with for years. The amount looks right. The contact name is familiar. The email conversation may even contain details about an actual project or transaction.

There is just one problem: the banking information has been changed. The payment is sent, but instead of reaching the supplier, the money lands in an account controlled by a fraudster.

This type of scheme, commonly known as payment redirection fraud and often associated with business email compromise (BEC), is an important risk for Canadian businesses — and particularly for the finance, credit and accounts payable professionals responsible for moving and monitoring company funds.

For credit managers, understanding how these schemes work is increasingly important because a fraudulent payment can create more than an immediate financial loss. It can also leave two legitimate businesses trying to determine what happened to an invoice that one side believes was paid and the other never received.

What Is Payment Redirection Fraud?

Payment redirection fraud occurs when a fraudster deceives a business into sending a legitimate payment to a fraudulent bank account. Unlike a completely fabricated invoice scam, the underlying transaction may be real.

There may actually be:

• a legitimate supplier;

• a genuine customer relationship;

• a real invoice;

• an expected payment; and

• an authentic email conversation.

The fraudulent element is the payment instruction.

One common method involves business email compromise. A criminal may impersonate a supplier, contractor, executive or other trusted contact using a spoofed email address or, in some cases, gain access to a legitimate email account.

The fraudster then sends new banking instructions and asks that an upcoming payment be deposited into a different account. Because so much of the surrounding information is legitimate, the request may not immediately look suspicious.

How Does Business Email Compromise Lead to Payment Fraud?

Business email compromise is particularly effective because fraudsters can exploit established business relationships and normal payment processes.

A fraudulent request might say:

“Please note that our banking information has recently changed. Kindly use the attached account details for all future payments.”

On its own, that may not sound particularly unusual. The request becomes much more convincing when it appears within an existing email conversation, references a real invoice or comes from an address that looks almost identical to the supplier’s legitimate email address.

In more sophisticated cases, criminals may gain access to an actual email account and monitor conversations before intervening at the right moment. That means the message could reference the correct invoice amount, project, customer, supplier and expected payment date.

The Canadian Centre for Cyber Security refers to one version of this technique as thread hijacking — where a threat actor gains access to an email account and inserts themselves into an existing conversation, making the fraudulent communication considerably more believable.

How Significant Is Payment Redirection Fraud in Canada?

The potential losses are substantial.

In May 2026, the Canadian Anti-Fraud Centre announced that it had worked with a Canadian financial institution to help recover approximately $3.5 million CAD connected to a sophisticated payment redirection fraud involving a Quebec business.

According to the CAFC, criminals impersonated legitimate contacts and manipulated email communications to provide fraudulent payment instructions. The victim authorized two wire transfers believing those instructions were legitimate.

The CAFC also reported that Canadian losses associated with spear-phishing fraud exceeded $68 million in 2025, with nearly $31 million in reported losses during just the first three months of 2026.

Those figures are an important reminder that an unusual request to change banking information deserves considerably more scrutiny than an ordinary administrative update.

Why Should Credit Managers Pay Attention?

Payment fraud is often discussed as a cybersecurity or accounts payable issue, but it can quickly become a credit management and accounts receivable problem as well.

Consider a situation where your company issues a legitimate $75,000 invoice. Your customer’s accounting department receives fraudulent banking instructions and sends the $75,000 to the wrong account.

From the customer’s perspective, the invoice was paid. From your company’s perspective, the invoice remains outstanding.

Now both businesses may need to determine how the fraud occurred, what communications were compromised, whether the funds can be recovered and how the unpaid receivable should be handled.

What began as an email security incident has suddenly become a payment dispute involving a legitimate commercial account.

For credit professionals, preventing these situations is therefore about more than cybersecurity. It is also about protecting the integrity of the payment process.

Warning Signs of Payment Redirection Fraud

No single warning sign necessarily means a request is fraudulent. However, certain circumstances should trigger additional verification.

1. A Supplier Suddenly Changes Banking Information

Any request to redirect payments to a new financial institution or account should be independently verified. The fact that the request comes from a familiar email address should not, by itself, be considered confirmation.

2. There Is Pressure to Process the Change Quickly

Fraudsters frequently use urgency to reduce the likelihood that someone will stop and verify a request. Messages may suggest that a payment is already overdue, that an account is about to close or that the change must be made before the next payment run.

3. Normal Procedures Are Being Bypassed

A request to “just make this one exception” can be a warning sign, particularly when it involves changing established payment instructions.

4. The Email Address Is Slightly Different

An address can look legitimate at a glance while containing a changed letter, number, punctuation mark or domain. Credit and accounts payable teams should look beyond the sender’s display name and examine the actual email address.

5. The New Account Seems Inconsistent

An unexpected financial institution, geographic location or account holder deserves further verification. Even when there is a perfectly reasonable explanation, confirming the change before releasing funds is far easier than trying to recover money afterward.

How Should Businesses Verify a Banking Change Request?

One of the simplest safeguards is also one of the most important: Verify the request independently.

If a supplier emails new banking instructions, do not verify those instructions using a phone number contained in the same email requesting the change. Instead, contact a known representative using contact information your organization already has on file or another trusted source.

For example:

1. Receive the banking-change request.

2. Flag the supplier’s account so the new information cannot immediately be used.

3. Contact an established representative using a previously verified telephone number.

4. Confirm that the supplier requested the change.

5. Follow your organization’s authorization process before updating the account.

6. Document who verified and approved the change.

The RCMP recommends using a two-step verification process for payment requests and confirming requests through another means of communication rather than relying on email alone.

For significant transactions, businesses may also want more than one employee involved in approving changes to payment details.

What Should You Do If a Payment Has Already Been Redirected?

Speed matters. If your business discovers that funds may have been transferred to a fraudulent account, contact your financial institution immediately and provide the relevant transaction information.

The incident should also be reported internally to the appropriate IT or cybersecurity personnel so they can determine whether an email account or system has been compromised.

Businesses should preserve relevant documentation, including emails, invoices, banking instructions, payment confirmations and other communications. In Canada, suspected incidents can also be reported to local police and the Canadian Anti-Fraud Centre.

The sooner the situation is identified and reported, the greater the opportunity may be for financial institutions and authorities to intervene.

Payment Verification Should Be Part of Your Credit Procedures

Credit policies traditionally focus on questions such as:

• Who should receive credit?

• What credit limit should be approved?

• What payment terms should be offered?

• How should overdue accounts be managed?

• When should an account be placed on hold or escalated?

Modern credit procedures may need to consider another question: How do we know that a payment or banking change request is authentic?

Credit and finance departments do not need to become cybersecurity specialists. But they should recognize that fraudsters increasingly target the business processes surrounding legitimate transactions.

A clear verification policy can remove much of the uncertainty. Employees should know exactly what happens when banking information changes, who has authority to approve the change and what independent verification is required before money moves.

A Five-Minute Phone Call Can Protect a Much Larger Payment

Payment redirection fraud succeeds because the fraudulent request often does not look fraudulent. It may arrive from someone you know, refer to an invoice you recognize and appear in an email conversation you have already been following.

That is precisely why verification matters.

For credit managers and other financial professionals, a healthy degree of skepticism around changes to payment information is not unnecessary bureaucracy. It is an increasingly important part of protecting the company’s receivables, supplier relationships and cash flow.

A request to change banking information may be completely legitimate. Taking a few minutes to confirm it independently can help make sure the money reaches the legitimate account too.