The Half-Million-Dollar Phone Call

The first call didn’t ask for anything.

Over the past five years I’ve helped BC businesses recover from fraud losses totalling close to $2 million.

I wasn’t in the room for any of it. I came in afterward with a team, rebuilding mailboxes and pulling logs and working out how someone got in, and then sitting across from an owner who wanted to know how this was possible when they’d bought everything we told them to buy.

None of those losses was a technology failure. In the worst one, no email was involved at all.

That one cost more than half a million dollars in an afternoon. I want to go through it properly, because the short version makes the person it happened to sound careless, and they weren’t.

The first call

Someone phoned the office claiming to be from the bank’s fraud department. The caller was calm and professional, and knew enough about the company to sound like they belonged there.

The caller told the accountant that some suspicious transactions had been flagged on the account, and asked them to confirm the current balance was correct.

The accountant confirmed it.

No password was requested. Nobody was asked to move money or sign into anything. There was nothing in that call a reasonable person would have refused.

The caller was finding out whether the account held enough money to be worth the trouble. It did, so they called back.

The second call

The next call was from the bank’s security department, or so the caller said. They were following up on the flagged activity and needed to walk the accountant through a virus scan.

The instructions didn’t work. A step would come down the line, the accountant would try it, something would be slightly off, and the caller would patiently offer another.

This went on for about twenty minutes. The accountant got flustered, and somewhere in there started to feel like the problem was at their end.

Then the caller suggested it would all be much easier if they just connected and did it directly.

By that point it didn’t sound like a request. It sounded like someone offering to end an ordeal.

The connection was granted. The caller checked that the online banking session was still open and still logged in, then mentioned the screen would go dark for a moment while the scan ran.

It went dark. The money moved while the accountant watched a blank screen and waited for the scan to finish.

What we found afterward

We spent a while afterward working out what should have caught it.

Nothing technical was ever going to. Everything they’d bought worked correctly that day, and none of it was built to notice a persuasive stranger on the telephone.

There were two controls that would have worked, though, and neither one costs anything.

The first is policy and procedure. A written rule that nobody confirms account details to an inbound caller, and nobody lets anyone connect to a computer for any reason. That client didn’t have one.

The second is a phone call to IT support.

Call us before you let anyone connect to your computer.

Sixty seconds with someone who does this for a living and the whole thing falls apart. We’d have asked which department the caller was with and what number they were phoning from, and said to hang up and call the bank directly.

So why wasn’t that call made?

That client paid for every support call. The amounts were small, but every question had a price on it, and over several years that had quietly taught the staff to sort things out themselves rather than bother IT with something minor.

Their billing arrangement had trained them out of making the one phone call that would have saved them half a million dollars.

They signed an unlimited support agreement a few days later and told everyone to call about anything at all. Right decision, four days late.

Why this is going to get worse

What strikes me about those two calls is how much skill they took. Whoever made them had to improvise for twenty minutes, keep a stranger calm while nothing worked, and know exactly when to stop asking questions and start offering to help.

There aren’t many people who can do that well, which is the only reason it isn’t happening to everyone you know.

AI is in the process of removing that constraint.

The Canadian Centre for Cyber Security, part of the Communications Security Establishment, is urging Canadian organizations to act on cyber risks tied to frontier AI, and notes that threat actors are already using it to produce more convincing phishing, voice scams and deepfake impersonation, faster and at greater scale.

Voice scams is the part I’d pay attention to. Cloning a voice takes a short audio clip, and most businesses have put one online without thinking twice about it: a conference talk, a voicemail greeting, the video on the About page.

Which means the patient stranger on the phone doesn’t have to be a stranger. The voice can be your controller’s. It can be yours.

Canadians reported close to $31 million in spear phishing losses in the first three months of 2026, and only 5 to 10 percent of frauds get reported at all.

The one rule worth more than the rest

If you take one thing from this, take this.

When someone asks for money, banking details, a password, or access to a computer, hang up and check it yourself on a number you already had.

Not the number the caller gives you. Not a reply to the email. And not by pressing 1 to be transferred, because you’re still on their call. Use the number on the back of the bank card, or on last month’s statement, or in your own accounting records.

Both calls in this story fail against that rule.

When in doubt, call IT

That rule assumes your staff already suspect something is wrong. The harder moment is the one before that, when they are simply confused.

The accountant in my story was twenty minutes into a problem they’d been told was urgent, and the only person offering to help was the one doing the robbing.

So give your team a simpler rule. If something involving a computer doesn’t make sense and you don’t know what to do, call IT. Nothing is too small.

If you are on managed services, that call is free. If you pay for each one, weigh what the call costs against what not making it can cost you.

Frequently Asked Questions

Would your team know what to do at three on a Tuesday afternoon? If you’d like a straight assessment of who at your company could move money today without a second person knowing, and whether your staff feel free to pick up the phone, call Precision IT at 604-359-5284.