Impersonation Fraud Targeting Organizations

Impersonation fraud has become one of the most common forms of fraud reported in Canada, and while much of the public attention focuses on individuals, organizations are targeted in much the same way. On Oct 28, 2026, Det. David COFFEY of the Toronto Police Service told CityNews that impersonation is now the force's most common fraud type, making up about one in six of the roughly 17,000 fraud reports it has received this year. This week's MMR looks at how these schemes are adapted to target businesses, and at how much of what makes them convincing comes from information the organization has made public itself.

Who Is Being Impersonated

When the target is an organization, the person being impersonated is usually someone staff already expect to hear from, such as a supplier or a senior manager. A common version involves a request to update a vendor's banking details before the next invoice is paid. In 2019, the City of Saskatoon paid $1.04 million to someone posing as a construction company it worked with, and the City of Burlington sent $503,000 to a fraudulent account after an email asked staff to change the banking details of an existing vendor.

Losses from this kind of fraud have continued to grow in the years since. The Canadian Anti-Fraud Centre (CAFC) reported more than $68 million in spear phishing losses in 2025 and nearly $31 million in the first three months of 2026. In April 2026, a Quebec business involved in a high-value commercial transaction authorized two wire transfers after criminals altered email messages to send fraudulent payment instructions, and the CAFC has since helped recover about $3.5 million.

Where the Details Come From

These approaches tend to work because the person on the other end of the call or email already appears to know how the organization operates. Fraudsters now combine information from social media and past data breaches, often using AI tools to assemble it quickly, so that the first contact can already include accurate names and account details.

For organizations, much of that material is public by design. Regulatory filings and project announcements often name the contractors involved, and procurement notices show which suppliers are bidding on upcoming work. Staff profiles on professional networking sites add another layer, since they tend to show who handles payments or approves access to a site. Taken together, this is usually enough for someone to pose as a known contractor asking accounts payable to update banking details, or as head office calling a field location with an urgent request.

What This Means for Organizations

Organizations in sectors that operate under public scrutiny, including energy and infrastructure, generally have a larger public footprint than most, because regulatory processes require them to disclose who they work with. Since much of that disclosure cannot be withdrawn, the most practical way to combat fraud is to limit how requests are verified. Changes to vendor banking details should be confirmed by calling a number already on file rather than one provided in the request, and a request framed as urgent or confidential should be treated as a reason to stop and confirm before acting. Staff who process payments or take calls from outside the organization are the most likely first point of contact, and they benefit from knowing what a convincing approach looks like.

The Role of Digital Investigative Intelligence

Digital investigative intelligence can show an organization what an outsider would be able to learn about it before attempting an approach. Reviewing the organization's public footprint from that perspective identifies which vendor relationships and staff roles are visible, and which of those details would be most useful to someone building a convincing story. Ongoing monitoring can also flag lookalike domains or social media accounts using the organization's name, along with staff email addresses that appear in breach data. That gives security and finance teams a factual picture of their exposure and allows them to focus verification controls where an approach is most likely to come from.

Conclusion

Impersonation fraud generally succeeds because the request looks routine and appears to come from someone the recipient expects to hear from. For most organizations, the details that make it convincing are already public, and some of them cannot be withdrawn. Understanding what that footprint reveals, and building verification steps around the requests most likely to be imitated, tends to reduce the risk considerably without requiring a large investment in new technology.

About 3Si Risk Strategies

3Si provides security and emergency management consulting, threat risk assessments, security planning, and public safety advisory services.

Learn more about our services or contact our team.