Spear phishing cost Canadians $57.7 million in six months, often by impersonating someone you already pay. The controls that stop it cost minutes, not software.
- Canadians reported $57.7 million lost to spear phishing in the first half of 2026, closing in on 2025’s full-year total of more than $68 million.
- Spear phishing often targets businesses by impersonating executives, suppliers or contractors to redirect payments or change banking details.
- The 2025 average was about $83,500 per reported case, on our arithmetic.
- A call-back to a known number is the cheapest control, and it should come before any software purchase.
Spear phishing is the fraud that sends your money to the wrong account on purpose. Canadians reported about $57.7 million in losses to it in the first six months of 2026, according to the Canadian Anti-Fraud Centre, against more than $68 million in all of 2025. The CAFC describes the common version as impersonating executives, suppliers or contractors to redirect payments or change banking details. AI makes the impersonation cheaper. Payment fraud controls are what make it fail, and the best ones are close to free.
Who pays when a payment is redirected?
Usually the business that sent it. Once money leaves on real-time rails, the CAFC notes it is often moved quickly and hard to recover. That same February update reported more than $704 million in total fraud losses for 2025 across over 112,000 reports, and says fraudsters now use deepfakes and stolen identities to make content that looks and sounds real. We covered the voice side of that in our piece on deepfake voice fraud and Canadian business, and why your bank agreement may not cover an AI-assisted loss in what Canadian bank terms say about AI agents.
What do the five payment fraud controls cost?
Ranked from cheapest to most expensive. Most firms need the first two before anything else.
1. Call back on a number you already have. Before changing any supplier’s or employee’s banking details, call them on a number from your own records, never one in the request. Cost: a few minutes per change. It blocks the most common redirect outright.
2. Two people approve every new payee or changed account. One person keys the change, a second confirms it. Cost: a second person’s time, measured in minutes a week for most small firms.
3. Hold the first payment to a new or changed account. Pay a small amount first or wait a set period before the full amount goes. Cost: a short cash-flow delay for the supplier, which is cheaper than a lost invoice.
4. A quarterly 30-minute drill. Walk the people who pay bills through the fraud types the CAFC names, including spear phishing and bank investigator fraud, using a fake request. Cost: about two staff hours a year per person.
5. Ask your bank what payee checks it offers. Many business accounts come with dual approval or payee controls; some cost extra. Cost: varies, so ask before you buy a separate tool. Our AI agent security checklist covers the access side.
Is the bear case worth hearing?
Yes. Every control here adds friction, and suppliers dislike payment delays. The counter is arithmetic: at about $83,500 per reported 2025 case, one stopped redirect pays for years of call-backs. The police chiefs’ 2026 fraud toolkit lists 813 spear phishing reports for 2025, so this is not a rare event spread thinly. Online stores face a related AI-driven risk, which we covered in AI agent attacks on Canadian online stores.
What should a business do first?
Write the call-back rule into your accounts payable process this week and name the person who owns it. Then add the second approver. Leave the software decision until both are habits. More on the operations side is in our AI for business in Canada guide.
FAQ
How much did spear phishing cost Canadians in 2026?
Canadians reported about $57.7 million in spear phishing losses to the Canadian Anti-Fraud Centre in the first six months of 2026, against more than $68 million in all of 2025.
What is the cheapest payment fraud control for a small business?
A call-back to a phone number already on file before changing any supplier’s banking details. It costs minutes and blocks the most common redirect.
Does AI make payment fraud worse?
The Canadian Anti-Fraud Centre says fraudsters use deepfakes and AI-generated content to impersonate trusted people, which makes fake payment requests more convincing.
