The Controls Were There. The Money Left Anyway.

Three Canadian losses, three different layers, none of them a technology failure.

The uncomfortable thing about fraud losses is how rarely they involve a business that did nothing.

Over the past five years I’ve helped Canadian businesses recover from fraud losses totalling close to $2 million. I came in afterward with a team each time, going through logs and mailboxes and working out how it happened. In most of those cases the protection existed. Somebody had written the policy, or bought the tool, or been handed the recommendation. The money left regardless.

The Competition Bureau reports that Canadians lost over $704 million to fraud in 2025, and that only 5 to 10 percent of frauds get reported at all. So $704 million is a floor. Nobody knows the real number.

Here are three of those cases. I’ve kept the companies anonymous and everything else as it happened. Each one defeats a different layer, which is why I’ve put them together. I wrote about a fourth in The Half-Million-Dollar Phone Call, a telephone attack with no email in it at all.

Roughly a million dollars, and the policy was already written

Nobody forged anything.

A supplier sent an invoice for a shipment on a large project. A copy went to the outside firm managing the project, as an advance packing list. So the same document sat in two companies’ mailboxes.

One of those companies had been compromised, and it wasn’t my client’s. The attackers were reading the project management company’s email, which meant they knew the amount, the supplier, the project and the payment terms.

They registered a domain that looked almost identical to the supplier’s real one, close enough that nobody reading quickly would catch it. Then they emailed my client and asked them to update the supplier’s banking details.

That was the whole attack. No altered document, no fake invoice, nothing to spot on a piece of paper. Just a routine-sounding request to change a field in the accounting system, from an address that was one character off, about a bill everyone in the chain was already expecting.

This client had done the work. Their policy required two people to approve any change to banking details, and it required someone to confirm the change by calling a known number, explicitly not the one in the email.

Both rules were ignored. Nobody did it deliberately. The request seemed routine, it looked like it came from a supplier they trusted, and the person handling payables that week was busy.

A policy that sits on a shared drive isn’t a control. A control is something that happens whether or not anyone remembers it’s supposed to.

What limited the damage was a quick response. Somebody noticed within days, the police were involved almost immediately, and it turns out that moving a million dollars out of the country is harder than moving it out of a company. The attackers couldn’t get it all offshore before the accounts were frozen, and roughly 60 percent came back.

About $60,000, through a computer nobody was managing

A bookkeeper wanted to work from home. Reasonable request, and a common one.

Rather than buy a laptop or a business desktop for the home office, the company let them use their personal computer.

It sat outside everything we managed. No monitoring, no patching, none of the protective software we ran on company machines.

At some point it picked up a keylogger, which is software that quietly records everything typed on the keyboard. Their banking login had no multi-factor authentication on it, so the captured password was all anyone needed.

Nobody noticed for a month.

The money had been in a savings account set aside for a future project, and nobody had reason to look at it. When somebody finally checked the balance, it had been empty for weeks.

Their bank required them to have the environment investigated before it would go any further, and we were already their IT provider, so we did the work.

Every machine we managed came back clean. That’s an awkward result. We’d checked everything we could see and found nothing, which meant either the bank was wrong or we were looking in the wrong place.

It came out in a follow-up conversation. Asked how the work actually got done day to day, the bookkeeper mentioned sometimes using the home computer. We scanned it and there it was.

That machine was destroyed. The company wrote a rule that banking and company email only happen on machines we managed, with our full set of protections on them, and that was the end of it.

The saving on that original decision was maybe a thousand dollars for a managed computer. Every security investment that company had made was still working perfectly, on the machines we could actually see.

An unmanaged device with access to your banking isn’t a smaller version of a managed one. It’s a hole in the middle of everything else you paid for.

A quarter of a million, after multi-factor authentication was declined

This one is the most instructive, because the attackers defeated the exact control most people believe protects them.

A non-profit declined the multi-factor authentication we recommended. That’s the second step, where a code or a prompt on your phone is needed on top of the password. Too much friction, and the board wasn’t convinced it was necessary.

Some months later the person running the organization fell for a phishing email. With no second step in place, those Microsoft 365 credentials were enough for the attackers to walk into the mailbox.

They didn’t do anything hasty. They read. They found a large bill coming due, and they created mailbox rules so their own messages would be hidden, which meant nothing unusual ever appeared in that inbox for the entire operation.

Then, from the real account, they emailed the finance team requesting a change to the bank account for that payment. A second email followed, also from the real account, approving the change and mentioning that someone would call shortly to confirm everything had been done correctly.

And then they called. The finance team took a call they were expecting, from a caller who knew exactly what the call was about, and confirmed the change.

The verification step ran. It confirmed the fraud.

The finance team hadn’t started that call. They received one, pre-announced by an email from an account they had every reason to trust. That’s the difference between confirming something and being told you’re about to be confirmed. A verification step only works when you start it yourself, on a number you already had.

It came apart twenty days later, when the supplier phoned to ask when the invoice would be paid.

We were called in, found the mailbox rules, corrected them, turned on multi-factor authentication across the organization and reset every password. The client wasn’t offered a choice the second time. Enable everything recommended, or find another IT provider.

None of the money came back.

What the three have in common

One had the policy. One had the tools. One was offered the tools and said no.

In every case the technology performed exactly as designed. Nothing was hacked in the way people picture hacking. The losses happened in the space between what a business owns and what a business actually does on a busy afternoon.

What separated the outcomes was time. The first company got some of it back because somebody noticed within days. The third got nothing, because nobody noticed for three weeks.

One more thing they had in common. Only one of the three carried cyber insurance, and it covered $100,000 against a million-dollar loss. The other two had none at all.

Policy, process and training

Closing that gap takes three things, and they only work in order.

Policy is the written rule, and I mean written. Not a habit or an understanding or “we’re careful about that here.” A document saying that any request involving payment details, banking changes, passwords or access to a computer gets checked independently before anyone acts on it, with no exceptions for urgency and none for seniority. It should also name who may authorize what, above which dollar figure a second person signs off, and that company money is only ever accessed from a company-managed device.

Process is what makes the rule happen on a Tuesday afternoon while someone impatient waits. The million-dollar loss had the policy and nothing to make it run. So the process needs to name where the verified contact list lives and who keeps it current, who signs second when the owner’s on a plane, and what evidence exists afterward that both approvals actually happened.

Outbound calls only. A call that arrives to confirm a change is part of the change.

Training is what keeps the other two alive. People arrive who never saw the memo. The rule gets bent once for a good reason, then twice, and then it isn’t a rule. Simulated phishing is worth asking your IT provider about. It gives you your own staff’s click rate instead of a number from an article, and it tells you which part of the business needs attention rather than making you guess.

One condition on all of it. It only works if asking for help is free, in both senses. If the person who clicks gets embarrassed in front of the team, or if checking with IT turns up on an invoice, you’ve taught everyone to stay quiet.

Frequently Asked Questions

Most businesses have the tools and are missing the other two. If you’d like a straight assessment of whether your policy is real, whether your process would survive a busy Tuesday, and where your unmanaged devices are, call Precision IT at 604-359-5284.