What do I do in the first hour after my business sends money to a fraudster in Canada?

What do I do, in order?

1. Call the financial institution that sent the money, on the number on your statement or its website.Report the payment as fraud and ask what it can do to stop or recover it.
2. Gather what you have: the emails, the payment instruction, the receipt or confirmation.
3. Report it to your local police and write down the file number.
4. Report it to the Canadian Anti-Fraud Centre online at reportcyberandfraud.canada.ca, or by phone at 1-888-495-8501.
5. Make no further change to payment details without calling the real recipient on a number you already had.

What does the Canadian Anti-Fraud Centre say?

The phone line keeps those hours. The online report is the other way to reach the Centre.

Report the incident to the financial institution that transferred the money.

Report the incident to your local police and get a file number for future reference.

Stay calm. Gather all information about the fraud, including:

We answer calls Monday to Friday, from 10 am to 4:45 pm (Eastern time) and closed on holidays.

What does a Canadian bank say about timing?

That is one bank's advice to its own business clients. Your bank's own fraud line is the one to call.

Contact Scotiabank immediately: Don't wait until the next business day.

What can an outside reading tell you after a payment fraud?

An outside reading cannot see your mailboxes, so it cannot tell you whether someone signed in to one.

It can show three things that bear on how a fraud like this reaches a firm: whether your DMARC record tells mail servers to refuse mail forged in your name, which look-alike domains of yours are registered, and which addresses at your domain are listed in breach data from other services.

Where do I go next?

• Reporting to the Canadian Anti-Fraud Centre
• Scotiabank
• A supplier's new bank details were fake