The town paid the right invoice into the wrong account

The Town of Mississippi Mills, Ontario, owed its sewer contractor C$201,285.86 for construction work. On or about 3 April 2025, a decision of the Ontario Superior Court of Justice records, the town received an email “from an individual impersonating the project manager” at that contractor.

The court’s decision, dated 7 April 2026, gives the request in one sentence: “The email inquired about payment of the outstanding account and directed the municipality to deposit the funds to a new bank account.”

The paperwork followed. The same person sent an “electronic funds transfer form (EFT), blank cheque and account information” for an account at a bank branch in Ottawa. To a finance office, that is what a supplier sends when its bank changes.

The town paid the invoice into that account. The court had no doubt the town owed the money and paid in good faith. The debt was real and the amount was right. Only the account was wrong.

The check that went to the wrong place

The decision records that something looked wrong before the money moved. Its words: “Although some discrepancies in the email addresses had been noted, the municipality then received assurances from what now appear to be other fraudulent email addresses.”

So the doubt was raised and answered. The answer came by email.

A doubt answered by email is answered by whoever controls the email. Here the answers came from addresses the court says now appear to be fraudulent.

The decision does not say what the discrepancies were. It does not say whether the addresses used a domain one letter off the contractor’s own or an account at a free mail service. It does not say how many messages passed. This article does not guess.

What ended it was not the email. On 14 April 2025, the decision says, “discrepancies surrounding the payment were flagged by the plaintiff’s own bank”. The town then contacted the contractor, which said the money had never arrived and that it “had not changed its banking arrangements”.

The contractor still had to be paid. In the court’s words, “the plaintiff had to pay them a second time”. The town went to court, obtained a court order to freeze the deposited funds and won judgment against the account holders, who did not defend the claim.

How the pattern runs

The judge wrote that “this tactic of diverting funds by impersonating individuals or businesses owed money and providing fictitious banking information seems to occur with some frequency”.

The scale is on public record. The FBI’s Internet Crime Complaint Center received 24,768 complaints of business email compromise in 2025, with reported losses of US$3.05 billion. That is one country’s count of the cases people chose to report.

Where the pattern uses a name made from a construction company’s own, it runs in four steps:

1. A look-alike address is registered. Someone registers a domain made from the company's name: one letter changed, a word added or another ending.
2. Mail or a sign-in page is set up on it. Mail is switched on for the name, or it answers with a page that looks like the company's website or a sign-in page.
3. The message or the call reaches a person. An email from it reaches someone at the company or one of its clients.
4. The money or the code moves. A client sends the money for a draw to new bank details.

The Mississippi Mills decision states the last two steps in its own words: an email from someone posing as the contractor’s project manager, then a payment to new bank details. It does not state the first two. It does not say a name was registered. It does not say mail was set up on one.

Who pays decides who is reached. In construction the money moves from the client to the company, so the message goes to the client. The town was the client here. The request went to the town.

What an external reading sees and what it cannot

An external reading looks at what anyone on the internet can look at: public records about a name. It never goes inside a mailbox, a bank or a phone.

Where a fraud like this one uses a registered name, the first two steps are public. A domain registered to look like a company’s own has a registration record from its first day. Mail set up on it is published too, because the name has to tell the world where its mail goes.

Those records belong to the name that was imitated, not to the payer. A reading of the contractor’s own name is where such a domain would appear. A reading of the town would show nothing about it.

Where the fraud uses an account at a free mail service, nothing is registered. There is no new domain to read, so an external reading has nothing to find.

And in every case the last two steps happen out of sight. No external reading sees the email asking for the change, the blank cheque, the assurances that followed or the payment itself. It does not see whether anyone picked up a phone.

What an early find of a name gives is time. The company can tell its clients the exact name to distrust. The name can be blocked in mail. A takedown request can go to the registrar, which decides. None of that answers a forged email for the client. The client’s own check does that.

What stops it

The decision itself shows what worked: a bank that questioned the payment and a word with the real contractor. Each step below moves that word earlier.

1. A call before new bank details are used. Any change of payment details is confirmed by calling a number already on file. Never a number in the message. What changes: one call, a few minutes of a clerk’s time. It can stay on for good. To undo it, the company drops the rule.
2. A doubt is answered by phone. When an address looks wrong, the reply never goes to that thread. The answer to a suspicious email cannot come from the same inbox.
3. One line on every invoice. A company can print that it never changes payment details by email. A client who reads it has a reason to call.
4. The bank the same day. If money went to new details, the first call is to the bank’s fraud line, that day. Here the bank’s flag and a court order held part of the money.
5. A watch on names made from the company’s own. New registrations are public. A company that reads them can learn of a look-alike name and warn its clients by that name.

Two sides of one invoice

The decision describes an email, a form, a blank cheque and a bank account. It describes no break-in to either side’s systems. The fraud borrowed a supplier’s identity and pointed it at the supplier’s client.

Most protection looks inward, at a company’s own accounts and devices. This fraud needed neither. It needed a name and a reason to pay. A name lives in the external layer, where anyone can copy it and anyone can read it.

Attackers read businesses with AI. LeakTrace reads them first.