For years, staff were taught to spot fake paperwork by its mistakes, like a blurry logo or odd spelling. That advice is ageing fast. The Government of Canada’s Get Cyber Safe campaign notes that with AI tools available, scam messages may no longer contain the spelling errors people used to rely on as a warning sign.
The same is true for invoices, receipts, bank letters and certificates. A convincing fake can now be produced in minutes. So the question for an Ontario business is no longer “does this look real?” It is “can we prove this is real?” Here is how a fraud investigator approaches it.
Why polish is no longer proof
The Canadian Centre for Cyber Security warns that generative AI lets threat actors produce more sophisticated, targeted phishing and scam content at higher volume. In its AI security guidance, the Centre goes further and recommends that organizations treat identity signals such as voice and video as untrusted until verified, with out of band checks for sensitive actions like payments.
A document is a claim, not evidence. What matters is whether the facts behind it can be independently confirmed.
Where fake documents tend to appear
The risk points are fairly predictable:
- supplier invoices, especially ones that arrive with “updated” banking details
- payment instructions that appear to come from a senior executive
- employee expense receipts and mileage claims
- pay stubs, reference letters and diplomas submitted during hiring
- bank statements, financial summaries or ownership papers shared during a deal or a loan
The Canadian Anti-Fraud Centre describes a common pattern it calls the supplier or contractor swindle, where a fraudster uses a spoofed or compromised email account to tell a business that a supplier’s payment details have changed.
What a fraud investigator actually checks
How the document arrived
Before looking at the file, an investigator looks at the route it took. Which address sent it, and does it match previous correspondence exactly? The RCMP’s guidance on business email compromise points out that spoofed addresses are often altered by a single character, such as an underscore in place of a hyphen. Email headers, reply to addresses and timing can all be revealing.
Whether the business is real
A polished invoice from a company that doesn’t exist is still worthless. Public records help here. Ontario corporations can be searched through the Ontario Business Registry, and the Canada Revenue Agency lets you confirm a GST/HST account number against a business name and transaction date. An investigator also looks at whether the address is a real operating location, whether the phone number connects to the actual business, and whether the website and domain are newly created.
The file itself
Document metadata, embedded fonts, image layers, editing history and file creation dates can show inconsistencies, like a “2023 statement” created last week. These clues have limits, since metadata can be stripped or altered, so file analysis is one strand of evidence, never the whole answer.
The numbers and the story
Fakes often fall apart on substance. Does the invoice match a purchase order? Were the goods received, and by whom? Do the rates, quantities and tax calculations make sense? Does the invoice numbering fit the supplier’s earlier invoices? Does the bank account belong to the same entity named on the invoice?
The people around it
Documents don’t move on their own. An investigator maps who requested the payment, who approved it, who changed the vendor record and when. This is where outside fraud and inside fraud start to separate, because a fake supplier sometimes has a helper inside the company. That kind of question belongs in a broader corporate fraud investigation.
The digital trail
Where a fake document came through email, a messaging app or a cloud share, a digital investigation can trace accounts, domains and online footprints using lawful methods, and preserve what is found in a way that supports later legal or insurance steps.
Red flags your team can catch early
You don’t need forensic tools to slow a fraud down. Train staff to pause when they see:
- a change of banking details by email, however routine it looks
- urgency, secrecy or a request to skip normal approvals
- a new contact person at a long standing supplier
- an invoice for goods or services nobody remembers ordering
- a payment request timed for when the sender is “unreachable”
The Canadian Anti-Fraud Centre’s advice on frauds targeting businesses includes clear payment procedures with verbal confirmation for urgent requests or changes to payment details. In plain terms, call back on a number you already have on file, never the one printed on the document in front of you.
Check before you trust, not after
For new suppliers, partners or acquisitions, investigative due diligence confirms that the people and companies you are dealing with are who they say they are before money moves. That includes checking corporate records, addresses, directors and public litigation history.
If you think you have already paid a fake invoice
Move quickly, but stay calm:
- Call your bank right away and ask about stopping or recalling the payment.
- Preserve the original emails, attachments and logs. Don’t forward them around or delete anything.
- Avoid tipping off anyone who may be involved, inside or outside the business.
- Report to your local police and to the Canadian Anti-Fraud Centre, as the RCMP recommends.
- Get professional help to establish what happened and whether other payments were affected.
Lawful limits on a fraud investigation
Private investigators in Ontario are licensed under the Private Security and Investigative Services Act, 2005 and have no police powers. A proper investigation does not hack into accounts, impersonate people to obtain bank records, or access private information without legal authority. Personal information gathered during the work is handled in line with privacy law, including federal PIPEDA requirements for commercial activity. Where evidence must come from a bank or platform, that usually happens through legal counsel and court processes, and an investigator can help prepare the groundwork.
Get a second set of eyes
If a document or payment request is bothering you, trust that instinct and check before you act. Investigation Hotline is a licensed private investigation firm in Toronto, serving Ontario businesses since 2015. Reach out for a confidential consultation and we will help you work out what can be verified and what to do next.
Frequently asked questions
Can software reliably detect an AI-generated invoice?
Not on its own. Detection tools can flag problems but miss things. Independent verification of the supplier, bank account and transaction is far more reliable.
How can I check whether an Ontario supplier is a real company?
Search the Ontario Business Registry for corporate records, confirm their GST/HST number through the CRA’s online tool, and call them on a number you found independently. For larger relationships, formal due diligence goes deeper.
What should I do if a supplier emails new banking details?
Treat it as unverified. Call your known contact at the supplier on a number already in your records, confirm the change verbally, and require a second approver before updating the vendor file.
Can a private investigator get the fraudster’s bank records?
Not directly. Bank records are usually obtained through police or court orders. An investigator can trace public and open source information, document the evidence and support your lawyer in seeking the right orders.
Is a fake receipt from an employee a police matter?
It can be, but many businesses first confirm the facts quietly, then decide between HR action, civil recovery or a police report.
Summarize with AI
