A request for money that looks real: how to check it before you pay

Most fraud that reaches a small office does not look like fraud. It looks like a supplier with a new bank account, a partner who needs a transfer sent today, a recruiter with a good offer, or a relative in trouble.

What has changed is how convincing the request can be. The Canadian Centre for Cyber Security warns that generative AI can be used to produce highly realistic content, including text, images, video and audio. It also says that voices generated by artificial intelligence can sound like family members or friends.

So the old advice, look for the spelling mistakes, no longer carries you. A habit does: before money moves, confirm the request through a channel you already trust. Here is what that habit looks like in the three places it matters most.

"Our bank details have changed"

The Canadian Anti-Fraud Centre describes a scam aimed at businesses with existing suppliers, in which the fraudster sends a spoofed email informing the business of a change in payment details. The reason it works is the relationship: these frauds leverage existing relationships between the person receiving the email and the person sending it.

For a law firm, the same shape turns up as changed wire instructions just before a closing or a settlement, when money is about to leave trust. For a small business, it is a familiar supplier's invoice with a new account number on it.

What to do:

• Treat any change of payment details as unconfirmed until you have spoken to someone you know.
• Call them on a number you already hold. The Centre's advice is to look up the person's email or phone number in your work's directory and verify with them if they sent the message.
• Write down who confirmed it, when, and on which number. If anyone later asks how the payment was approved, that note is the answer.

"I need this sent today"

The second shape is urgency from someone senior: a partner, an owner, a client. In one variation the Centre describes, the email directs the employee to send an urgent, large wire transfer to a foreign account.

The Cyber Centre names the warning sign plainly: the sender makes an urgent request with a deadline. Its advice is to stay calm, because phishing depends on creating a sense of urgency. And a familiar voice is no longer proof: in vishing attacks a threat actor might use an AI-generated voice of a known person to deliver the fraudulent message.

What to do:

• Agree in advance, as an office rule, that no transfer goes out on the strength of one message or one call, however senior the sender sounds.
• Check on a second channel. The Cyber Centre's guidance is to verify the sender's legitimacy by contacting the sender through a separate channel.
• Be wary of anyone who gives you the number to call them back on. The Anti-Fraud Centre's advice for emergency calls works at the office too: contact the person directly using a phone number you already have.

"The job is yours, there is just a small fee"

Job seekers see the same pattern pointed the other way. The Anti-Fraud Centre's guidance on job scams is short: never send deposits or pay fees for a job. Another version arrives as a cheque: the fraudster sends a counterfeit cheque with a story about why they need help to cash it.

The Centre also warns never to agree to receive funds into your personal bank account to forward elsewhere, because there is a good chance you are being used as a money mule.

What to do:

• Verify the company's official website and call their official phone number, as the Centre advises.
• Take your time. A real employer can wait a day while you check.

A short rule for the whole office

Put it on paper, so nobody has to decide it under pressure:

• New or changed payment details are confirmed by phone, on a number already on file.
• No urgent transfer goes out on one message or one call.
• Every confirmation is written down: who, when, which number.
• Nobody is blamed for slowing a payment down to check it.

The last line matters more than it looks. People skip the check when checking feels like doubting the boss. A written rule takes that weight off them.

One more, for the AI tools many offices now use: the Cyber Centre's generative AI guidance advises against sharing private information with AI tools unless you understand what they are doing with your data.

If it already happened

Report it. The Anti-Fraud Centre asks anyone who has been a victim of fraud or cybercrime to contact their local police as soon as possible. You can also report fraud or cybercrime online at reportcyberandfraud.canada.ca, and the Centre's toll-free line is 1-888-495-8501.

---

We build software for small law firms, small businesses and job seekers, and the people who use it are the people this kind of fraud goes after. If this was useful, pass it to the person in your office who approves payments.

Kwata Team