On July 6, the Canadian Anti-Fraud Centre (CAFC) shared a notification about a possible Business Email Compromise (BEC) scam with the United States Secret Service (USSS) Ottawa Field Office that resulted in saving a U.S. based company from losing almost $750,000 (U.S.) and a number of jobs. In order to respect the privacy of the victim, we will not be sharing the name of the company at this time.
This success was made possible because a Canadian company reported the scam to CAFC in June. The CAFC notified partners, including the USSS, about the scam and the related account. The USSS shared the notification further with their contacts leading a bank investigator to discover that a U.S. company was transferring almost $750,000 (U.S.) to this fraudulent account.
The bank investigator put a hold on the transfer, contacted the company and began procedures to reverse the funds. A company employee expressed their thanks and said the interception had potentially saved jobs.
BEC scams among the most financially damaging online scams. In a BEC scam, a fraudster will send an email that is spoofed to look like it's coming from a known and trusted source. The following are examples of a BEC message:
- A business receives a duplicate invoice with updated payment details supposedly from an existing supplier or contractor.
- An accountant or financial planner receives a large withdrawal request that looks like it's coming from their client's email.
- Payroll receives an email claiming to be from an employee looking to update their bank account information.
- An email that seems to come from a trusted source asks you to download an attachment, but the attachment is malware that infiltrates an entire network or infrastructure
- An email that seems to come from trusted source asks you to buy gift cards.
If you have been a victim of scam, fraud or cybercrime, please contact your local police. We also encourage you to report an instance, whether you are a victim or not, with the CAFC via the Online Reporting System or by phone at 1-888-495-8501. By filing a report, you can provide invaluable information that could protect others.
Quotes
Unlike many traditional crimes, scams and fraud span over a number of jurisdictional borders. This incident is an excellent example of the importance of international partnerships and reporting to the Canadian Anti-Fraud Centre. Without the initial report from the Canadian company, there could have been devastating losses to both the company and to people's lives. I hope this story encourages both individuals and businesses to report scams and fraud when they come across them and to educate themselves further on the variations so they know what to look for.
On a daily basis, the Secret Service offices throughout Canada work closely with the Canadian Anti-Fraud Centre in an effort to coordinate criminal investigations that transcends our common borders. As transnational criminal organizations target U.S. and Canadian interests through sophisticated cyber-enabled fraud schemes, our collaborative efforts are paramount to our continued success. This incident is one of numerous examples of the shared successes between our agencies, resulting in millions of dollars returned to U.S. and Canadian citizens. The United States Secret Service Ottawa Field Office values the exemplary relationship shared with the Canadian Anti-Fraud Centre, and the various public/private sector partners for the swift response to matters of mutual interest.
Quick facts
- As a National Police Service, the CAFC is Canada's central repository for data, intelligence and resource material as it relates to fraud and is jointly operated by the Royal Canadian Mounted Police, the Competition Bureau and the Ontario Provincial Police. The CAFC does not conduct investigations but provides valuable assistance to law enforcement agencies all over the world by identifying connections among seemingly unrelated cases.
- BEC scams fall under the category of "spear phishing", which is known for being one of the most common and most dangerous attack methods currently used to conduct fraud, usually on businesses and organizations.
- Over the past two years, spear phishing has been in the top 2 for reported financial losses to the CAFC.
- In 2020, the CAFC received 1,680 reports of spear phishing where 779 victims reported losses of $29.9 million.
- In 2019, the CAFC received 1,044 reports of spear phishing with 560 victims reporting losses of $38.5 million.
- In Canada, it is estimated that about only 5% of all scams and fraud are reported.