How do you spot a fake e-transfer confirmation email? Check the sender's exact address (a real notification only comes from your provider's official domain), hover over the "Deposit money" button without clicking to see the real link destination, be suspicious of any exaggerated deadline ("expires within the hour"), and remember no legitimate message ever asks for your full online banking username and password on a separate page. When in doubt, open your banking app directly — a real transfer will show up there too.
The fake e-transfer confirmation email has become, in 2026, one of the most reported scams to our technicians across Canada. Unlike a generic phishing email disguised as an invoice or a missed package, this scam targets the single most common financial gesture Canadians perform online: sending or receiving money between individuals. Our broader guide, What Is Phishing?, covers the general definition and seven universal red flags of phishing; this article zooms in specifically on the "you've received money" and "complete your transfer" emails, with a real-vs-fake comparison table, a click-before checklist, and Canadian case studies specific to this exact scam.
How the Scam Works: Three Variants
The fake e-transfer email shows up in three main forms, all built around the same principle: perfectly imitate a message you normally receive in a completely plausible context.
"You've Received Money"
An email announces that someone — sometimes a generic name, sometimes a slightly altered name of a real contact pulled from a prior data leak — sent you a plausible but odd amount ($247.50, $183.20) to appear authentic. The "Deposit your money now" button leads to a fake page copying the exact look of the real transfer portal, which then asks you to "authenticate" by entering your full online banking username and password.
"Complete Your Transfer"
This variant targets people who just made a real transfer or discussed one as part of a transaction (selling furniture, paying for a service). The email claims an "additional verification step" is required to finalize the transfer, often paired with a copied logo and reassuring technical language. The link leads to a page requesting banking credentials plus extra personal details ("confirm your identity") such as date of birth or the last digits of your Social Insurance Number.
"Your Transfer Expires Soon"
The most psychologically aggressive variant. The message claims a pending transfer will automatically be returned to the sender within hours unless you click immediately to "claim it." This artificial urgency is designed specifically to short-circuit careful thinking — nobody wants to lose money meant for them, and time pressure pushes people to click before verifying anything.
Three Canadian Case Studies (Illustrative Composites)
The following scenarios are fictional reconstructions inspired by the type of situations our technicians regularly encounter on service calls. Names and details are invented, but the mechanics of the scam are representative of what Canadians actually experience every week.
Case 1 — Nadine, a bookkeeper in Ontario
Nadine manages the books for a small renovation company. On a busy Friday afternoon, she receives an email announcing that a client sent a transfer of $1,840 for an outstanding invoice — a perfectly plausible amount given her day-to-day work. Caught up in the pace of her day, she clicks "Deposit now" without checking the sender's address and enters the company's online banking credentials on the fake page that opens. The next day, she discovers $4,200 was pulled from the company account through internal transfers she never authorized. This case illustrates why employees who handle payments should always verify a deposit directly in the company's banking app — never through an email link, no matter how urgent it looks.
Case 2 — Marc, a Facebook Marketplace seller in British Columbia
Marc is selling a set of patio furniture on Facebook Marketplace for $350. An interested buyer claims to have sent payment by e-transfer and forwards Marc a screenshot, then a "confirmation email" that looks identical to a real transfer notification. Convinced he has been paid, Marc arranges delivery of the furniture. In reality, the "buyer" never sent any transfer at all — the email was entirely fabricated to trick Marc, who ends up losing both his furniture and the money he thought he had received. This variant, very common on classified-ad platforms, underscores the importance of verifying a deposit directly in your own bank account rather than trusting an email forwarded by the buyer.
Case 3 — Eleanor, a retiree in Nova Scotia
Eleanor, 74, receives an email claiming that a $500 transfer from a "nephew" is waiting for her, but that she must "confirm her banking identity" within two hours or the money will be returned. Living alone with no one nearby to validate the message before acting, she clicks the link and provides her full banking information on the fake page, believing she is dealing with a legitimate system. Scammers drain her savings account within hours. This case is a reminder of why seniors — often targeted precisely for their isolation and lower familiarity with recent digital warning signs — benefit greatly from having a trusted family member or service to call before clicking any urgent, money-related message.
Have doubts about an e-transfer email you received?
Our certified technicians check whether your device or accounts were compromised and secure your access after an accidental click. Same-day service, from $119.99. No fix, no fee.
Real vs Fake E-Transfer Email: The Comparison Table
Side by side, the two types of emails share a very similar appearance — which is exactly what makes this scam dangerous. Here are the concrete details that tell them apart.
| Element | Real Transfer Email | Fake Email (Scam) |
|---|---|---|
| Sender's address | Official domain of your transfer provider or financial institution | Similar-looking but different domain (e.g., a hyphenated variant, a "-notification" or "-secure" subdomain, or a free generic address) |
| Displayed sender name | Name of the person sending you money, formatted consistently | Often identical in appearance, but the real address reveals the trick once fully displayed |
| Security question | Mentioned without ever revealing the answer in the email | Missing, or sometimes displayed directly in the message (a classic fraud signal) |
| "Deposit money" link | Leads to your provider's official domain or directly to your own financial institution | Leads to an unknown or very slightly altered domain, visible by hovering over the link without clicking |
| Information requested | Answer to the security question chosen by the sender, inside your own already-authenticated banking portal | Full online banking username and password, sometimes card number or Social Insurance Number |
| Expiry deadline | Generally several days before funds are returned to the sender | Exaggerated urgency ("expires in 1 hour," "today only") |
| Amount shown | Matches exactly what you were expecting or a known context | Plausible but unexpected amount, or tied to a transaction you don't clearly recognize |
| Appears in banking app | The transfer also appears directly in your own account or banking app | Nothing appears in your real account, because no transfer was ever actually initiated |
The Verification Checklist — Before You Click
Here is the exact procedure our technicians recommend following systematically before accepting an e-transfer received by email.
Verify before clicking "Deposit money"
- The sender's full address ends in your provider's genuine domain, checked letter by letter.
- I clearly recognize the person or context behind this transfer (a purchase, a repayment, a known transaction).
- Hovering over the "Deposit money" button without clicking shows a link that leads to the genuine provider domain or my own financial institution's site.
- The email mentions a security question without revealing the answer directly in the text.
- No request for my full online banking username and password on a page separate from the link.
- No exaggerated expiry deadline ("within the hour," "today only") is pushing me to act in a panic.
- I checked directly in my regular banking app, without going through the email link, that the transfer actually appears there.
If you cannot check off every item with confidence, do not click any link in the email. Instead, open your regular banking app directly, or contact the person who supposedly sent the money through a channel you already know (phone call, text to a saved number) to confirm.
What to Do If You Clicked or Entered Your Information
Speed matters. The faster you act, the more damage you can limit.
If you clicked the link but entered nothing
Close the tab immediately without interacting further with the page. Do not download or open any file the page offers. Run a full antivirus scan of your device in case the page load alone triggered an invisible download, and watch your bank account closely over the following days.
If you entered your banking credentials on the fake page
Contact your financial institution immediately through the number on the back of your card. Ask them to freeze or change your online banking access right away, and monitor your accounts closely over the following hours and days.
Change your password and enable 2FA
Change your banking password from a device you know is clean, and enable two-factor authentication if it is not already active. Do the same for any other account that shared the same password.
Report the incident
Report to the Canadian Anti-Fraud Centre at antifraudcentre-centreantifraude.ca or 1-888-495-8501. Forward the email to your email provider as phishing (Gmail: report phishing; Outlook: Junk > Phishing).
If you're a seller and believe you received a fake transfer (Marketplace scam)
Verify directly in your banking app — never through an email forwarded by the buyer — that the amount was actually deposited. Never hand over an item or service before the transfer is confirmed in your own account, no matter how much pressure the buyer applies. If you already handed over the item, document the conversation and file a report with your local police service.
If your computer shows unusual behaviour after clicking a suspicious link — slowdowns, pop-ups, unexpected programs — our guide Is My Computer Hacked? Warning Signs to Watch For details the signs to monitor closely over the following days.
What This Scam Costs — And What Protection Costs (CAD Budget)
Losses from this type of scam vary enormously depending on the context, but a rough order of magnitude helps put the stakes into perspective.
| Scenario | Typical Loss Observed |
|---|---|
| Marketplace / Kijiji scam (seller defrauded) | $100 – $800 |
| Stolen banking credentials, account drained quickly | $500 – $5,000+ |
| Compromised business account (SMB) | $1,500 – $15,000+ |
| Security audit and account lockdown with IT Cares | From $119.99, no fix no fee |
This last line is worth highlighting: the cost of a preventive check or a fast response after an accidental click stays far below the average loss when a scam fully succeeds. A 15-minute call to your financial institution, or a consultation with a technician to secure your accounts after a suspicious click, costs a fraction of what a completed bank fraud can represent — not counting the time and stress needed to recover everything afterward.
Not sure if your accounts were compromised?
IT Cares performs remote security audits and account recovery across Canada. We assess the damage, secure your accounts, and prevent the next attack.
Government Resources and Where to Report an Attempt
Several Canadian organizations can help you report a fraud attempt or get assistance if you have been victimized.
- Canadian Anti-Fraud Centre — antifraudcentre-centreantifraude.ca or 1-888-495-8501, to report any fraud attempt, even without financial loss.
- Your e-transfer provider's fraud reporting page — most providers maintain an official channel to report an email or site fraudulently impersonating their brand.
- Local police service — to file an official report if you suffered a financial loss, especially useful for any follow-up with your financial institution or an insurance claim.
- Royal Canadian Mounted Police (RCMP) — for cases involving a larger fraud network or significant amounts.
- Your provincial consumer protection office — for questions related to financial fraud affecting consumers in your province.
How This Scam Differs From Phishing in General
The fake e-transfer email is a specific form of phishing, but it deserves separate treatment because it exploits an immediate financial context rather than a generic brand impersonation. Our broader guide, What Is Phishing? How to Spot and Avoid Phishing Attacks in 2026, covers the full landscape — CRA scams, Microsoft account theft, Amazon order cancellations, smishing, vishing, and more — useful if you want to understand phishing tactics beyond this specific e-transfer scam.
As mentioned above, fake e-transfer campaigns also directly benefit from generative AI advances to produce visually flawless messages. Our article AI-Generated Phishing Emails: How to Spot Them in 2026 goes deeper into this specific technological dimension — how AI tools are used to polish this kind of fraud, and which signals still hold up even against a perfectly written email.
Does your business handle payments and transfers daily?
IT Cares audits your security practices, trains your staff to spot fake payment emails, and secures your accounts against banking compromise. Starting from $119.99.
Frequently Asked Questions
Check the sender's exact address first — a real notification only comes from the provider's official domain. Hover over the "Deposit money" button without clicking to see the true link destination, be suspicious of any exaggerated urgency (expires within the hour), and remember that no legitimate message ever asks for your full online banking username and password on a separate page. When in doubt, open your banking app directly instead of the email link.
Yes. When someone sends you a transfer, a legitimate notification email is genuinely sent, inviting you to answer a security question to deposit the funds into your account. It is precisely because this practice is normal that scammers imitate it so easily — the real challenge is telling the genuine email apart from the fake one, not rejecting every transfer notification on principle.
Close the tab immediately without interacting further with the page. Do not download or open any file the page offers. Run a full antivirus scan of your device in case the page load alone triggered an invisible download, and watch your bank account closely over the following days. The risk is usually limited if no information was entered, but staying alert matters.
Contact your financial institution immediately using the number on the back of your card, never through a search engine or the suspicious email. Ask them to freeze or change your online banking access right away, and monitor your accounts closely over the following hours and days. Change your banking password from a device you know is clean, enable two-factor authentication if you have not already, and report the incident to the Canadian Anti-Fraud Centre.
A supposed buyer claims to have sent an e-transfer for the item you are selling, then forwards you a fake confirmation email copying the exact look of a real transfer notification. The message asks you to click a link to "accept" or "unlock" the funds, which actually leads to a fake banking page designed to steal your credentials. The seller believes they were paid and hands over the item, while no money has ever actually changed hands.
A genuinely completed and deposited e-transfer is generally irreversible, much like a cash withdrawal. That is why prevention through verification beats recovery after the fact. If you provided banking credentials (rather than the transfer itself) on a fake site, your institution can sometimes intervene if alerted very quickly, but nothing is guaranteed.
Yes. Report the email as phishing directly in Gmail or Outlook, forward it to the Canadian Anti-Fraud Centre, and if you suffered a financial loss, also file a report with your local police service. Your e-transfer provider and financial institution typically maintain an official channel for reporting brand impersonation as well.
Scammers often target seniors because they are statistically more likely to hold substantial savings, less familiar with recent digital warning signs, and sometimes live alone without someone nearby to validate a suspicious request before acting. The calm, professional tone of fake transfer emails, combined with well-calibrated urgency, works particularly well against a population less accustomed to this type of message.
Comments
I almost fell for a "you've received $275" email last week. The domain in the link wasn't right — I caught it just in time by hovering over the button before clicking. This article confirms exactly what I noticed. Sharing the checklist with my whole team at work.
My mother received one of these fake emails last week and called me before clicking anything, thankfully. The Eleanor story in this article is scarily close to what could have happened to her. Going to walk her through the checklist this weekend.
Leave a Comment