OPP warns of scam affecting businesses after Ottawa Valley business defrauded

An Ontario Provincial Police crest is pictured on an officer's uniform. (Supplied)

Ontario Provincial Police are warning businesses in the Ottawa Valley about phishing scams after a local business reported being defrauded $3,000.

Police did not name the business in a news release on Wednesday but said the company’s emails became compromised through a “business email compromise” or “spear phishing” fraud on March 31.

“Business Email Compromise (BEC) is a targeted phishing fraud where cybercriminals impersonate employees, or trusted vendors via email to trick victims into wiring or e-transferring funds or sharing sensitive data,” the OPP said.

Police said the scam resulted in a customer sending payment to the fraudster instead of the local business.

At this time, police do not know if any other customers were affected. An investigation remains ongoing.

Police are warning businesses to be on the lookout for attempts to gain access to their servers.

“Attackers often pose as high-level executives (CEO/CFO), employees, or trusted suppliers to request urgent wire transfers or fraudulent invoice payments,” police said. “Criminals use email spoofing, lookalike domains, or compromised legitimate email accounts to gain trust.”

Common red flags include demands to act urgently and secretly and unusual changes to vendor payment details or requests for sensitive data that deviate from normal procedures. Look at sender email addresses carefully, too. Sometimes the display name will appear correct, but the actual email address is slightly different.

Police shared these tips for protecting your business from email compromise scams:

• Verify Requests: Always verify changes in payment procedures or urgent financial requests via a different communication method, such as a phone call to a known number.
• Multi-Factor Authentication (MFA): Require MFA for all email accounts to prevent unauthorized access.
• Employee Training: Educate staff to recognize phishing scams and suspicious email patterns.
• Technical Controls: Implement email security solutions to detect spoofing and malicious links.