Phishing and fraud: the Canadian numbers

On a Tuesday morning, in accounts payable, an email arrives from a known supplier: new banking details, to be used from the next payment on. The sender's address looks right. If the wire goes out, the incident may end up in an official statistic. Which one, and counted how? The answer changes what you teach staff and what you control.

What the official numbers say

Statistics Canada. According to the Canadian Survey of Cyber Security and Cybercrime, released on October 21, 2024, 16% of Canadian businesses were impacted by cyber security incidents in 2023, down from 18% in 2021 and 21% in 2019. Still according to the survey, among businesses impacted in 2023, 50% experienced scams and fraud, the most common method, up 6 percentage points from 2021; 31% identity theft, up 11 points; 13% ransomware. The recovery spending it measures doubled, from approximately $600 million in 2021 to $1.2 billion in 2023.

Canadian Anti-Fraud Centre. In 2025, the Centre received over 112,000 fraud reports involving over $704 million in reported losses, according to its Fraud Prevention Month 2026 page. In its table of the top frauds of 2025, phishing has 2,869 reports and 467 victims, with no dollar loss recorded; spear phishing has 813 reports, 571 victims and $67.9 million, the second-highest loss behind investment fraud. The counter on its home page shows, as of June 30, 2026, 15,107 reports processed, 9,935 victims and $351 million lost since the start of the year.

Canadian Centre for Cyber Security. Its National Cyber Threat Assessment 2025-2026 puts losses from fraud in Canada at $383 million in 2021, $530 million in 2022 and $567 million in 2023.

What each number measures, and what it does not

The survey counts businesses, not attacks. Its target population: enterprises with Canadian operations and 10 or more employees, except public administration. Only incidents that had an impact are reported, and Statistics Canada warns that its figures may not accurately reflect the total number of cyber attacks. The move from 21% in 2019 to 16% in 2023 therefore does not say there are fewer attacks. Finally, the text of the release gives no separate figure for phishing: it speaks of scams and fraud.

The Anti-Fraud Centre counts reports. The March 6, 2026 news release on Fraud Prevention Month, which the Centre runs with the Competition Bureau and the Royal Canadian Mounted Police, says it plainly: only 5% to 10% of frauds are reported. The $704 million for 2025 is a floor, individuals and businesses combined. The Centre also says it received over 112,000 reports in 2025, while its counter shows 40,679 reports processed and 27,693 victims for the same year. Two verbs, two totals: do not compare them.

Phishing in the table is not phishing in everyday speech. In the Anti-Fraud Centre's classification, phishing is after information and, according to the table note, does not involve financial losses. Spear phishing means pretending to be a legitimate source to convince a business or an individual to send money. The Tuesday morning email is its "supplier/contractor swindle" variant. It is reported far less often than phishing, and it is the one that carries the losses.

What we think at Sentrix

These numbers say where the money goes: not in the click, in the payment. In order:

1. Teach the payment scenario, first to the people who pay. A supplier's change of banking details, a change to a payroll direct deposit, an urgent wire requested by an executive, gift cards: these are the variants the Anti-Fraud Centre describes. Training built around the suspicious link leaves out the category where the losses are reported. According to Statistics Canada, 22% of businesses provided formal cyber security training to their non-information technology employees in 2023: start with accounts payable, payroll and purchasing.
2. Verify through another channel. When in doubt, the Anti-Fraud Centre advises looking up the person's number in your organization's directory and asking whether they sent the message. Make it a written rule for any change in payment details: a callback to a number already on file, never the one in the email, and a second approval above a threshold.
3. Report, even without a loss. The March 6, 2026 release asks that the incident be reported even if there was no financial loss; according to Statistics Canada, 13% of impacted businesses reported incidents to police in 2023. Internally, measure the number of reports and how fast they come, not just the click rate.
4. Expect better-written messages. In its 2025-2026 assessment, the Cyber Centre judges that the threat from fraud and scams will continue to grow, with phishing-as-a-service kits and chatbots that craft convincing emails. The spelling mistake is no longer a clue; the verification procedure still holds.

The next step

Ask accounts payable and payroll how the last change of banking details was verified. If there is no record of a callback, write the rule this week. For the technical side, see our article on phishing-resistant MFA.