The Email That Started It All
It arrived on a Wednesday afternoon — an email that appeared to come from the firm’s long-time bank. The subject line read: ‘Urgent: Verify Your Business Account Details to Avoid Suspension.’ The email was well-designed, with the bank’s logo, standard formatting, and a tone that communicated both authority and urgency.
The firm’s operations director — a competent, experienced professional who had worked with the company for nine years — clicked the link, entered the company’s banking credentials on what appeared to be the bank’s login portal, and thought nothing more of it.
By the following morning, $180,000 had been transferred out of the company’s operating account in three transactions. The money went through a series of intermediary accounts and was ultimately unrecoverable.
This is a composite account based on a pattern of incidents that cybersecurity professionals in Canada see regularly. The firm in this story is not named — but it could be yours.
Why This Attack Worked
Business Email Compromise (BEC) and phishing attacks succeed not because the victims are careless or unintelligent, but because the attacks are specifically engineered to defeat normal human skepticism. Understanding the mechanics of how this happened makes the lesson far more transferable than simply saying ‘be careful.’
The email succeeded for several converging reasons:
- Urgency: The threat of account suspension created immediate emotional pressure that bypassed careful evaluation. When something feels urgent, people act — not analyze.
- Authority: The bank’s visual identity was convincingly replicated. The email came from a domain that was one letter different from the bank’s real domain — visible only on careful inspection.
- Context: The operations director had been dealing with account administration that week and was expecting communication from the bank. The timing made the email seem plausible.
- No verification culture: The firm had no policy requiring phone verification before executing financial actions or credential entry. There was no protocol to question.
The Canadian Anti-Fraud Centre reported that business email compromise was responsible for over $47 million in losses to Canadian businesses in 2023 — and that figure represents only reported cases.
The Anatomy of a Phishing Attack
Phishing attacks against businesses today are not the crude, typo-ridden emails that were common a decade ago. Modern phishing — especially business email compromise and spear-phishing — involves reconnaissance, personalization, and professional execution.
Before sending the email, attackers may spend weeks researching the target. They look at the company’s LinkedIn profile to identify key employees and their roles. They examine the website for leadership names, client references, and operational details. They may monitor social media or public records to understand banking relationships and recent business activities.
With this information, they construct an attack that is specific, believable, and timed to land when defenses are likely to be lower. The result is an email that does not feel like an attack at all — it feels like a routine piece of business correspondence.
The First 48 Hours After Discovery
The firm’s owner discovered the fraudulent transfers at 7:30 a.m. the following morning when he reviewed overnight banking activity. The next 48 hours were among the most stressful of his professional life.
The bank was notified immediately, but wire transfers move quickly. Two of the three transactions had already cleared into accounts in a foreign jurisdiction. The third was still in process, and the bank was able to recall $22,000. The remaining $158,000 was gone.
Law enforcement was engaged, but financial cybercrime involving international transfers is notoriously difficult to investigate and prosecute. The realistic expectation from police was that a report would be filed and an investigation would proceed — but recovery was unlikely.
The firm’s cyber insurance policy — which they had purchased but never fully reviewed — had a sub-limit for social engineering losses that capped coverage at $50,000. The remaining $108,000 was an uninsured loss that the firm had to absorb.
Many cyber insurance policies include sub-limits or exclusions for social engineering losses that are significantly lower than the overall policy limit. Reviewing your policy before an incident is essential.
The Operational Aftermath
Beyond the direct financial loss, the attack generated weeks of operational disruption. The firm’s banking credentials were changed immediately, but the investigation required a full review of all business accounts, payment processes, and vendor relationships. Staff were anxious and productivity dropped. The firm’s accountant spent three full days reconstructing transaction records and preparing documentation for the insurance claim.
The reputational concern — would clients find out? — hung over leadership for weeks. Fortunately, client data was not compromised in this particular attack, but the anxiety of not knowing this with certainty until the investigation concluded was its own tax on the leadership team’s time and energy.
In total, the firm estimates that the combination of direct loss, uninsured liability, and management time diverted from revenue-generating activities cost them over $250,000 when fully accounted for. For a 12-person firm, this was existential in scope.
What Would Have Stopped This Attack
The most sobering aspect of this story is that every element that made the attack successful was preventable. None of the required countermeasures were expensive or technically complex.
- Multi-factor authentication (MFA) on the banking portal: Even with stolen credentials, MFA would have prevented the attacker from accessing the account.
- Email security filtering: A well-configured email security platform would have flagged the slight domain variation in the sender address and quarantined the email for review.
- Security awareness training: Employees who receive regular, realistic phishing simulation training develop the instinct to pause before entering credentials — especially in response to urgency-based prompts.
- A financial verification policy: A simple organizational rule requiring a phone call to a verified number before executing any financial action based on an email request would have broken the attack chain entirely.
- Cyber insurance review: Reviewing the policy’s actual coverage — including sub-limits for social engineering — would not have prevented the attack, but would have ensured appropriate coverage was in place.
The Human Element Is Not the Problem – It Is the Target
It is tempting to conclude that the lesson here is ’employees need to be more careful.’ But that framing is both unfair and strategically unhelpful. Human judgment under pressure is fallible. It always will be. The answer is not to demand better human judgment — it is to build systems that do not rely on perfect human judgment to prevent catastrophic outcomes.
This is the philosophy behind a defense-in-depth security strategy: no single layer of protection is assumed to be perfect, so multiple layers are stacked such that the failure of any one layer does not result in a catastrophic outcome. MFA, email filtering, training, policy controls, and insurance together create a system where a single moment of human error does not cost $180,000.
What TeckPath Recommends
Every SMB should have, at minimum, the following human risk controls in place: MFA on all financial and cloud accounts, email security filtering that evaluates sender domains and link destinations, an annual security awareness training program with phishing simulations, a documented financial verification policy that requires out-of-band confirmation for wire transfers or credential actions, and a cyber insurance policy that has been reviewed in detail for social engineering coverage.
At TeckPath, our Cyber Awareness Training program is built specifically for SMBs — practical, engaging, and designed to build security instincts without overwhelming staff with technical complexity. We pair it with email security tooling and policy consultation to close the gaps that attackers most commonly exploit.
Final Thought
The operations director who clicked that link was not negligent. She was doing her job under normal conditions when a carefully engineered attack exploited normal human psychology. She was not the problem. The absence of systems designed to protect her was the problem.
Your business deserves a security environment that accounts for human fallibility. One that does not depend on every employee being perfect every time. The cost of building that environment is a fraction of what a single successful phishing attack costs — and the peace of mind it provides is incalculable.
