AI-Powered Phishing and Deepfake Payment Fraud in Canada

Generative AI has made payment fraud harder to spot by removing the clues people relied on: phishing emails are now fluent and personalized, a cloned voice can sound like your CEO, and live video calls can be faked. The fraud itself has not changed. It still ends with a request to send money or change banking details, so the defence that works is a verification process that never trusts the channel the request arrived on.

This guide explains what changed, what Canadian reporting shows as of November 14, 2026, and the specific controls a finance team should have in writing.

What Generative AI Changed About Payment Fraud

The Canadian Centre for Cyber Security assesses that AI is almost certainly lowering the barriers to entry and improving the quality, scale and precision of malicious cyber activity (Canadian Centre for Cyber Security, 2024). Three changes matter most for finance teams.

Phishing and BEC Emails Without the Usual Tells

For years, awareness training taught staff to look for poor grammar and odd phrasing. The Cyber Centre reports that threat actors use AI to write personalized phishing emails at scale in convincing, grammatically correct language that mimics human writing styles, making them harder to identify and filter (Canadian Centre for Cyber Security, 2024). Its generative AI guidance adds that attackers can now run targeted spear phishing more frequently, more automatically and with more sophistication (Canadian Centre for Cyber Security, 2025).

In business email compromise (BEC), the FBI notes that chat generators can quickly produce official-sounding emails that mimic a company's CEO, and that voice cloning can be used to request wire payments (FBI IC3, 2026). The FBI also points out that not every BEC tactic uses AI (FBI IC3, 2026). The old methods, such as lookalike domains and hijacked mailboxes, still work and are often combined with the new ones.

Voice Cloning and the Urgent Phone Call

Voice cloning turns a short sample of someone's voice into speech they never said. In June 2025, the Cyber Centre and the Canadian Anti-Fraud Centre (CAFC) jointly warned of a campaign targeting business executives and senior public officials with urgent financial requests, in some cases using AI to mimic the voices of senior officials (Canadian Centre for Cyber Security and CAFC, 2025). The same advisory notes that phone numbers in calls and texts can be spoofed and messaging display names can be forged (Canadian Centre for Cyber Security and CAFC, 2025). Caller ID is not proof of identity.

The FBI has also warned that criminals use AI-generated audio of individuals to gain access to bank accounts (FBI IC3, 2024), which matters for any process that uses voice recognition to authorize changes.

Live Deepfake Video Calls

The FBI warns that criminals generate video for real-time video chats with supposed company executives, law enforcement or other authority figures (FBI IC3, 2024). The best-documented business case is Arup. The engineering firm confirmed in May 2024 that a Hong Kong finance employee joined a video call with people he believed were the chief financial officer and colleagues, all of them deepfake re-creations, and then sent HK$200 million (about US$25.6 million) across 15 transactions (CNN Business, 2024). According to police, the employee had first suspected the email that started the request was phishing; the video call removed his doubts (CNN Business, 2024).

That detail is the lesson. The employee's instinct was correct, and a convincing second channel controlled by the fraudster overrode it. See deepfake fraud and how deepfakes target businesses for more background.

What Canadian Reporting Shows

Canadian fraud statistics do not separate AI-enabled fraud from other fraud, so the trend has to be read from the categories that AI makes more effective. As of November 14, 2026, the most recent figures are:

• Spear phishing losses are rising fastThe CAFC reports about $57.7 million in spear phishing losses in the first six months of 2026, compared with more than $68 million for all of 2025 (Canadian Anti-Fraud Centre, 2026). The CAFC describes these frauds as impersonating executives, suppliers, contractors or other trusted contacts to redirect payments or change banking information (Canadian Anti-Fraud Centre, 2026). All CAFC figures are reported losses in Canadian dollars.
• Spear phishing is a high-value fraudIn 2025 it ranked second by reported dollar loss, at $67.9 million from 813 reports, behind only investment fraud (Canadian Anti-Fraud Centre, 2026).
• Most fraud is never reportedThe CAFC received over 112,000 fraud reports with more than $704 million in losses in 2025 (Canadian Anti-Fraud Centre, 2026), and estimates that only 5% to 10% of frauds are reported (Canadian Anti-Fraud Centre, 2026).
• Scams are the most common way businesses are hitStatistics Canada found that 16% of Canadian businesses were affected by cyber security incidents in 2025, and scams and fraud were a method of attack for 55% of those businesses, up from 50% in 2023 (Statistics Canada, 2026). Only 11% of affected businesses reported incidents to police (Statistics Canada, 2026).

United States data give a sense of AI's share. In its 2025 report, the FBI's Internet Crime Complaint Center received 22,364 complaints with an AI-related element and US$893 million in losses, including more than US$30 million in BEC losses involving AI, out of about US$3.05 billion in total BEC losses (FBI IC3, 2026). Those are complaints where AI was identified; the real share is unknown in both countries.

Why Spotting Deepfakes Is Not a Control

Government guidance does list warning signs. The joint Canadian advisory suggests looking for unnatural movements, mismatched audio or inconsistent lighting in video, and a flat tone, unexpected background noise or choppy sentences in audio (Canadian Centre for Cyber Security and CAFC, 2025). Teach these signs, but do not build your defence on them.

The FBI notes that AI-generated synthetic content is becoming harder to detect and easier to make (FBI IC3, 2026). A clerk on a short call with someone who sounds like the CFO is under pressure. A control that depends on that person noticing a glitch will fail sooner or later. A control that depends on a procedure, followed every time, does not care how good the fake is.

Verification Controls for Finance Teams

Every control below works for a forged email, a cloned voice and a deepfake video alike, because none of them relies on judging whether the request looks genuine. The CAFC recommends detailed payment procedures, including verbal authentication for urgent requests or changes to payment details (Canadian Anti-Fraud Centre, 2026), and dual authorization for wire transfers (Canadian Anti-Fraud Centre, 2025). Here is how to put that into practice.

Call Back on a Number You Already Hold

Verify any payment request or banking change by calling the person or supplier on a number taken from your own records, not from the email, text, voicemail or calendar invitation. The CAFC advises contacting the sender using a trusted phone number, not the one in the email (Canadian Anti-Fraud Centre, 2025), and the joint advisory says to verify through alternate, previously confirmed channels (Canadian Centre for Cyber Security and CAFC, 2025). Do not accept an incoming call as verification, even from a familiar number.

Require Two People for Payments and Changes

Set a dollar threshold above which two authorized people must approve a payment, in the banking platform itself, not just by policy. Apply the same two-person rule to any change in supplier or payroll banking details, whatever the amount. The person who received the request should not be the one who verifies it.

Write a Supplier Banking Change Procedure

For example, a written procedure might require:

1. A change request received in writing, never acted on the same day.
2. A call-back to the supplier contact on file, confirming the old and new account details.
3. Approval by a second person who did not handle the request.
4. A small test payment or confirmation from the supplier before the next large payment.
5. A note to the supplier that you will never accept banking changes by email alone.

Payroll is targeted the same way. The CAFC describes fraudsters posing as employees to change direct deposit details (Canadian Anti-Fraud Centre, 2026).

Set Rules for Executive Requests

Executives should tell finance, in advance and in writing, that they will never ask for an urgent, confidential payment outside the normal process, and that staff who pause to verify will be supported. Watch for requests to move to a different messaging app, which the joint advisory lists as a warning sign (Canadian Centre for Cyber Security and CAFC, 2025). A pre-agreed code phrase for genuine emergencies can also help; the FBI recommends that families use a secret word or phrase to verify identity (FBI IC3, 2024), and the same idea works for a leadership team. Keep it offline and change it if it is ever used.

Protect the Email Channel

Many of these frauds start in a real mailbox that has been taken over. The CAFC notes that fraudsters may infiltrate email accounts, create forwarding rules and register lookalike domains (Canadian Anti-Fraud Centre, 2026). Strong sign-in controls on Microsoft 365, alerts on new forwarding rules and a DMARC policy that stops others sending as your domain reduce the openings. Our business email compromise guide covers these controls in more depth.

Train for the Scenario, Not the Typo

Run short, scenario-based exercises: a voicemail from the "CEO", a supplier banking change, a video call request that moves to a personal app. The CAFC recommends including fraud awareness in onboarding and training employees regularly (Canadian Anti-Fraud Centre, 2026). The point of the exercise is to rehearse the call-back, not to test whether someone can spot a fake.

If a Payment Has Already Gone Out

Time matters more than anything else. The FBI's advice is to contact your financial institution immediately and request a recall of the funds (FBI IC3, 2026). Then:

1. Call your bank's fraud line and ask for a recall and a freeze at the receiving bank.
2. Report to local police and to the CAFC, online at reportcyberandfraud.canada.ca or by phone at 1-888-495-8501 (Canadian Anti-Fraud Centre, 2025).
3. If a mailbox or system was compromised, report the incident to the Canadian Centre for Cyber Security and secure the account.
4. Preserve the emails, call logs, recordings and payment records, and notify your cyber insurer.

Fast reporting does recover money. In April 2026, a Quebec business hit by a payment redirection fraud reported it quickly, and the CAFC and a Canadian financial institution helped recover about $3.5 million (Canadian Anti-Fraud Centre, 2026). In January 2026, the CAFC and the US Secret Service helped disrupt a $1.7 million fraudulent transfer linked to spear phishing after a Canadian business reported it promptly (Canadian Anti-Fraud Centre, 2026). In 2025, the CAFC and Hong Kong police helped return $2.3 million to a Vancouver-area law firm after a BEC fraud (Canadian Anti-Fraud Centre, 2025). For a full contact list, see who to call after a cyber attack in Canada, or our emergency page if it is happening now.

What to Do Now

• Write down your payment verification rule in one sentence and have the CEO sign it: "No payment or banking change without a call-back to a number on file and a second approver."
• Set dual approval thresholds in your banking platform.
• Build a supplier banking change procedure and send suppliers a note explaining it.
• Tell finance staff, in writing, that pausing to verify an executive request will never be penalized.
• Review how much executive audio and video is public, and assume it can be cloned.
• Turn on alerts for new mailbox forwarding rules and enforce strong MFA on Microsoft 365.
• Run one tabletop exercise this quarter built around a deepfake voice or video request.
• Print the reporting contacts (bank fraud line, police, CAFC) and keep them with the finance team.

How Cyberphore Can Help

Cyberphore provides role-based security awareness training, with payment fraud and impersonation content for finance and executive teams, realistic phishing simulations and progress reporting for leadership. Learn more about our security awareness training.