Interac Transfers can show “completed” and still land in the wrong account. Waterloo Regional Police recently described a case in which an organization’s billing email was compromised, and the email address registered to its bank account was fraudulently reassigned. Clients kept paying through a familiar channel. The money went elsewhere.
Why the receipt didn’t tell the whole story
According to the police warning issued in August 2026, the fraudulent activity ran from July 30 through August 4. Legitimate clients sent e-Transfers, received normal confirmations, and had little reason to suspect a problem. The intended organization didn’t receive the funds. Police said the redirection stopped once Autodeposit was disabled.
That detail matters. Most fraud warnings train us to spot a fake invoice, a misspelled domain, or a sudden demand for a new bank account. Those signs still matter, but this case reaches deeper into the payment routine. The sender can follow the usual process and still pay the wrong account if the receiving setup has been altered.
Waterloo Regional Police did not say how the email account was compromised or how the Autodeposit change happened. We shouldn’t fill in those blanks. One compromised billing identity affected both the business and its customers.
Read the name before you transfer
Interac says that when a recipient has Autodeposit enabled, the sender can see the recipient’s full legal name before confirming the transfer. That moment deserves more attention than it usually gets.
People tend to focus on the email address and amount. If those details look familiar, the final screen becomes muscle memory.
Slow down. If the legal name is unfamiliar or doesn’t fit the business you’re paying, don’t send the money. Call the business using a number from an earlier invoice, its official website, or your saved contacts.
Email alone shouldn’t authorize a change to a supplier’s payment details. A short call can feel inconvenient when an invoice is due, but it’s far easier than recovering a completed transfer.
Businesses need to watch the receiving side
A company that accepts e-Transfers should know which email address and bank account are registered for Autodeposit. Protect the billing inbox with a strong, unique password and multi-factor authentication. Review sign-in activity and unexpected changes, and limit who can alter payment settings.
Then reconcile. Match paid invoices with money that arrived. If customers say they paid and the deposits aren’t there, check the Autodeposit registration, contact the bank, and examine the billing account immediately.
The Canadian Anti-Fraud Centre said on May 13 that rapid reporting helped partners recover about $3.5 million in a separate payment-redirection case. It reported more than $68 million in Canadian spear-phishing losses during 2025 and nearly $31 million in the first quarter of 2026.
A payment needs two confirmations
The sender confirms the legal recipient name before sending. The business confirms that the deposit arrived and matches the right invoice. Neither side should rely on an email thread as the only proof.
Companies can set a clear rule: staff must verify any new payment destination through a trusted second channel. Finance teams can also establish who may approve changes and who reviews them.
If money goes missing, act at once. Contact the financial institution that sent the transfer, notify the intended recipient, preserve emails and transaction records, and report the incident to local police and the Canadian Anti-Fraud Centre. A quick response can’t guarantee recovery, but delay works in the fraudster’s favour.
Routine creates trust. We pay the same daycare, contractor, clinic, or supplier and stop examining the final screen. Criminals count on that.
The answer isn’t panic or abandoning e-Transfers. It’s a deliberate pause when money changes hands, followed by prompt confirmation on the receiving side.
Digital risks shift constantly, requiring a vigilant and ready workforce. Penetration testing offers practical exercises and live simulations designed to uncover weak points before attackers exploit them. As a dedicated security partner, we fit each assessment to your specific operational landscape. Adopt a preventative mindset. Arrange a discussion now at www.CybersecurityMadeEasy.com to better protect your enterprise.
