Scam alert · October 22, 2026
The Email Thread Was Real. The New Bank Account Wasn't.
Payment-redirection scams hide inside familiar email conversations. Learn the separate-channel rule to use before wiring closing funds or paying a changed invoice.
Read this in five minutes. Then talk about it with someone you care about.
The invoice is expected. The project is real. The people named in the email are people you know.
Then a message arrives inside the conversation: the bank account has changed. Please use the new wiring instructions. The payment is due today.
That small change can redirect a home down payment, business invoice, legal settlement, or contractor payment into a criminal's account.
This is called payment-redirection fraud, often carried out through business email compromise or spear phishing. The criminal may imitate an email address with a one-letter difference. In more sophisticated cases, they gain access to a real account, study legitimate messages, and wait until a payment is expected. Their fraudulent instruction then arrives at exactly the right time and in exactly the right context.
The Canadian Anti-Fraud Centre says Canadians reported approximately CAD $57.7 million in spear-phishing losses during the first six months of 2026. That was already close to the approximately $68 million reported during all of 2025. The FBI recorded 24,768 business-email-compromise complaints in the United States during 2025.
These are reported incidents. The larger lesson is personal: an email can contain accurate details and still carry fraudulent payment instructions.
Why this works
Most scam warnings teach us to question unexpected messages. Payment-redirection fraud is dangerous because the payment itself is often expected.
A homebuyer really is preparing to send closing funds. A business really does owe a supplier. A family really is paying a contractor. The criminal does not need to invent the transaction; they only need to change its destination.
The message may include familiar names, an existing signature block, the correct invoice amount, and previous messages from the conversation. That context lowers suspicion. Urgency does the rest: the closing is tomorrow, the invoice is overdue, or the supplier needs confirmation before shipping.
Professional writing is not proof. A familiar email thread is not proof. Even the correct amount is not proof.
Warning signs
Pause before payment when:
- Banking or wiring instructions change by email.
- A known contact suddenly uses a slightly different email address or domain.
- You are told to send money to a new account, unfamiliar company, or individual.
- The sender asks you to bypass normal approval procedures.
- The request is urgent, confidential, or limited to email communication.
- An invoice you already paid is described as overdue.
- A message discourages a phone call or says the contact is unavailable.
- The payment memo is supposed to describe something unrelated to the real transaction.
Do not limit the check to obvious misspellings. A criminal using a compromised account may send from the correct address. The protection must focus on the requested action, not only the appearance of the message.
The separate-channel rule
Use one family and business rule:
Any new or changed payment instruction must be verified through a communication channel that did not come from the message.
If the request arrived by email, call a number already stored in your records or printed on an earlier trusted document. Do not call the number in the new email, attachment, signature block, or search advertisement.
For a large transfer, ask the recipient to read the complete account information back to you. Businesses should require a second person to approve new payees and changes to bank details. Families buying a home should confirm the title company, closing agent, and verification procedure before wiring day arrives.
The purpose of the rule is not to decide whether the email looks suspicious. It is to make email alone insufficient to move money.
If money was already sent
Act immediately. The Canadian Anti-Fraud Centre recently described a Quebec business case in which rapid reporting and coordination helped recover approximately CAD $3.5 million connected to fraudulent payment instructions. Recovery is never guaranteed, but delay can reduce the options available.
Contact your financial institution and request an urgent recall or fraud response. Ask it to contact the receiving institution. Notify the legitimate person or business whose identity or email may have been compromised. Preserve the entire email thread, headers, invoices, banking instructions, phone numbers, and transaction records.
In Canada, report to local police and the Canadian Anti-Fraud Centre. In the United States, file promptly with the FBI Internet Crime Complaint Center at IC3.gov and report the incident to local law enforcement when appropriate.
Change passwords and review the security of any email account involved. Check for unfamiliar forwarding rules, recovery addresses, connected devices, or login activity. Enable multi-factor authentication, but remember that account security and payment verification are two separate protections.
Talk about it tonight
Ask your family: “If wiring instructions changed during a home purchase, repair, or large payment, which trusted number would we call before sending money?”
Save that number before the transaction begins. A verification plan is much easier to follow when nobody is rushing toward a deadline.
If an invoice or payment-change message feels unusual, use The Scam Hotline Scam Detector to examine its pressure tactics. Remove names, addresses, invoice numbers, banking details, email addresses, and other sensitive information before using any online tool.