Company sues after alleged email fraud diverts $203K to Manitoba bank account

A packaging manufacturer is suing to recover more than $200,000 it alleges was stolen after fraudsters intercepted a company email and impersonated an insurance broker. (File)

A packaging manufacturer has filed a lawsuit alleging it was defrauded of more than $200,000 after unknown fraudsters intercepted a company email and impersonated an insurance broker to redirect a wire transfer to a Manitoba bank account.

Pro-Pals Industries Ltd. filed the statement of claim on May 11 in Manitoba’s Court of King’s Bench, naming unknown defendants identified as John Doe and Jane Doe, as well as the Canadian Imperial Bank of Commerce. The company is seeking to recover $203,664.31 it alleges was stolen through an email impersonation scheme.

According to the claim, on Feb. 2, 2026, the company based in Quebec received invoices from its insurance broker totalling $203,664.31. Eight days later, an email appeared to arrive from the same broker — but from a subtly different address, substituting “-ca.com” for the legitimate “.ca” domain — advising that the broker’s banking information had changed and requesting that the outstanding invoices be paid to a new account.

The alleged fraudster, posing as the same brokerage representative, further informed the company that the banking details on file were intended for international transfers only. The lawsuit also claims that email had the same subject line and contained copies of some of the invoices.

Pro-Pals says it wired the full amount on Feb. 13. The alleged fraud went undetected for more than a month until March 18, when the legitimate broker called to follow up on the unpaid invoices, the claim says. It was then that Pro-Pals discovered the email discrepancy and realized it had been defrauded.

The claim alleges the fraudsters opened the CIBC account at a branch in Carman, Man., and infiltrated the email communication between the two companies.

“It is presently unknown how or by what means the fraudsters infiltrated the email,” the filing states.

The statement of claims says the company understands the CIBC account has since been temporarily frozen, pending legal proceedings to trace and recover the funds.

“The plaintiff pleads that John Doe, Jane Doe, and other persons unknown have no legal entitlement to the transferred funds,” reads the filing.

The filing seeks a court order freezing the CIBC account, along with a tracing order, disclosure of account-opening information and related documents, and an order compelling CIBC to return the transferred funds or any recoverable portion.

It also seeks damages from the unknown individuals for fraud and fraudulent misrepresentation, as well as punitive damages.

A CIBC spokesperson declined to comment as the matter is before the courts. CTV News has reached out to the plaintiff’s lawyer for comment and is awaiting a response.

No statement of defence has been filed, and none of the claims have been tested in court.

A growing and sophisticated threat

The Canadian Anti-Fraud Centre calls what is alleged in the lawsuit “payment redirection fraud” — a variation of spear phishing that primarily targets businesses.

“We saw losses surpass $68 million in 2025 and $31 million in the first three months of 2026, so it’s sharply on the rise,” said Jeff Horncastle, client and communications outreach officer at the centre. “It’s definitely one of the most impactful within that spear-phishing category.”

Horncastle said fraudsters prey on the busy, distracted nature of the workplace — and deliberately engineer their attacks to look routine.

“The employee opens the email; it looks like a normal email you get from a supplier asking to send the payment to an alternate bank account — seems believable, especially if you don’t know about spear phishing or payment redirection fraud,” he said.

He said the method of infiltration varies by case, but one common scenario involves a fraudster gaining access through a phishing email clicked on by an employee, then intercepting supplier communications to insert fraudulent payment details.

“If you report within the first few days after it happened, you definitely have more of a chance of recovery than reporting a couple of weeks down the line,” he said.

For businesses looking to protect themselves, Horncastle recommends independently verifying any payment instructions before sending funds — including picking up the phone and calling a supplier using a number already on file, not one provided in the email.

“Train employees to recognize spear phishing, and be on top of knowing what variations are circulating,” he said. “Have that ongoing training, because fraud changes.”

Horncastle said anyone who has been a victim of fraud is urged to contact local police, their financial institution, and the Canadian Anti-Fraud Centre.

Those who have been targeted but have not lost money are also encouraged to report to the centre.