Stop the threats your inbox quietly lets through.

Business email compromise (BEC) is the highest-dollar cybercrime category in Canada, consistently accounting for more financial loss than ransomware according to the Canadian Anti-Fraud Centre (CAFC). In its 2023 annual report, the CAFC recorded over CAD $90 million in reported BEC losses — a figure that significantly understates actual losses because only an estimated 5–10% of fraud incidents are ever reported. BEC is not a technical attack in the traditional sense: it exploits trust, process, and urgency rather than software vulnerabilities. This makes it largely invisible to perimeter firewalls and standard antivirus tools, and disproportionately damaging to organizations without dedicated security staff.

The primary BEC attack patterns targeting Canadian SMBs fall into four categories. CEO fraud involves an attacker impersonating a senior executive via a spoofed or lookalike domain to instruct an accounts-payable employee to initiate a wire transfer or change vendor banking details. Invoice fraud involves compromising or spoofing a supplier's email account to redirect a legitimate payment to an attacker-controlled account — often discovered only when the real supplier follows up on an overdue invoice. Payroll diversion involves impersonating an employee to redirect a direct deposit to an attacker's account. And credential phishing involves directing employees to fake M365 or Google Workspace login pages, harvesting credentials that then enable all three previous attack types from inside the organization's actual domain. Canadian businesses are specifically targeted because of high adoption of wire transfer payment practices in real estate, construction, and professional services — sectors that represent a large portion of Canadian SMBs.

Standard email security tools — Microsoft's Exchange Online Protection (EOP), Google's built-in spam filtering — rely heavily on known-bad sender reputation, attachment scanning, and URL filtering. These controls work reasonably well against commodity phishing at volume. They fail against BEC for a structural reason: BEC messages are typically short, contain no malicious links or attachments, originate from newly registered domains with no negative reputation, and are carefully written to mimic the authentic communication style of the impersonated sender. The defining characteristic of a BEC message — an unusual financial request that deviates from normal process — is a business logic signal, not a technical indicator. Detecting it requires understanding communication patterns, sender relationship graphs, and behavioral baselines, which is exactly what AI-powered email security tools are built to analyze.

AI-based email security platforms analyze every message against a behavioral model built from the organization's own communication history: who emails whom, what subjects are normal between specific senders and recipients, what domains are expected from specific vendors, and what request types are typical in a given thread context. A message from a CEO's lookalike domain (quantmtec.com instead of quantmtech.com) requesting an urgent wire transfer on a Friday afternoon triggers anomaly signals on multiple dimensions simultaneously — sender domain mismatch, unusual urgency language, financial request from an executive who has never made this type of request by email. These signals are invisible to rule-based filters but are highly discriminative in a machine-learned behavioral model. The result is detection of BEC attempts that would otherwise reach the recipient's inbox and result in a business decision — not a click on a link.

PIPEDA's mandatory breach reporting regulations (SOR/2018-64) require organizations to report to the OPC and notify affected individuals whenever a security incident involving personal information creates a real risk of significant harm. Email incidents — whether a phishing attack that resulted in credential compromise, a BEC attack that exposed customer financial details, or an email thread containing personal health information that was forwarded to an unauthorized recipient — are among the most common triggers for mandatory PIPEDA breach notification. The OPC's own statistics consistently show that email is the leading initial access vector in reported privacy breaches involving Canadian organizations.

The OPC does not set a statutory 72-hour notification window the way GDPR does, but the organization has published guidance indicating that notification should be made "as soon as feasible" and that unreasonable delay in notifying affected individuals will be a negative factor in any subsequent investigation. In practice, the 72-hour benchmark used by most Canadian privacy counsel is derived from the GDPR standard, which has become the de facto Canadian expectation through regulatory convergence and the influence of Quebec's Law 25, which does set explicit timelines. For organizations subject to both PIPEDA and Law 25 — any company doing business with Quebec residents — the 72-hour window to notify the Commission d'accès à l'information is statutory.

When a BEC attack or email-based credential compromise triggers PIPEDA reporting obligations, the notification to the OPC must include specific content: a description of the circumstances of the breach, the date or period of the breach, a description of the personal information involved, the number of individuals affected, a description of the steps taken to reduce the risk of harm, and contact information for a person who can answer questions on behalf of the organization. Organizations that have no email security logging — no record of what messages were received, which accounts were accessed following a phishing event, and what data those accounts contained — cannot produce this notification with the specificity the OPC requires. AI-powered email security platforms that log every threat detection event, every quarantine action, and every account anomaly serve as the primary evidence base for PIPEDA breach notifications following email-based incidents.