Don’t get caught: Fraud is everyone’s business | CFIB

Half of small businesses have experienced attempted or successful fraud. A CFIB survey in August 2024 revealed that 36% of business that were the victims of fraud had lost on average $7,800 – and that’s not counting the impact on morale and the time spent dealing with the issue. 

Fraud against businesses occurs when an individual or group manipulates or deceives a business often through a 'scam' ─ a deceptive scheme designed to steal money, goods, services, or valuable information such as personal or banking data. Common examples include email phishing, spyware, fraudulent advertising, office supply scams, and credit card fraud.

Note: direct theft, where no deceit is involved, is not considered fraud.

Directory fraud, false invoicing and office supply scams 

A directory scam can appear to be as innocent as an invitation to update your information for records;  you may receive a phone call asking you to verify company information such as the address and telephone number. The scammer will then send an invoice for a directory listing or renewal. 

Another scam occurs when companies send boxes of office supplies (for example: toner, receipt paper) that were never ordered with a big price tag attached. Often, small print on the invoice will claim that the opening of the box constitutes consent to buy, and you may be stuck with supplies you never ordered.

Protect your business: 

• Carefully inspect the name of companies on invoices: they might seem familiar but often will have a slight variation.
• Check for addresses that don’t make sense, like international listings.
• Check for invoice references or numbers. If it doesn’t have one, it could be a scam.
• Do not call the number on the invoice you have received; instead, do a separate search for the actual company’s phone number before contacting them.
• Ensure there are no demands for payment in the fine print.
• Be vigilant in training staff to be aware of these types of scams.
• Don’t give out information about your business unless you know how it will be used.
• Never agree to anything over the phone – always get it in writing.
• Do not open parcels you aren’t expecting or from companies you don’t recognize.

If someone is trying to collect on an invoice you suspect is fraudulent, request a copy of the contract or agreement the company is referencing. If they cannot produce a contract with your written signature on it, their claims are invalid. 

Inside job: occupational fraud

Internal fraud, also known as occupational fraud, workplace fraud, and employee fraud, encompasses a range of activities from outright theft, to falsifying accounts, even abusing flexible working hours. Internal fraud can lead to financial losses, damage to a business’ reputation, and create legal implications, not to mention the impact it can have on morale in the workplace.

HR Fraud

• An employee is on sick leave but working elsewhere
• Abusing a flexible working hours arrangement
• Misuse of official time (computer usage)
• Providing false reference or qualifications
• Remote-work employees not working at capacity 

Payment/Receipt Fraud

• Creating fake customer records/accounts to generate false payments
• Changing payee details on cheques and trying to cash them
• Processing false claims on behalf of accomplices
• Self-authorizing payments to oneself

Allowance Fraud

• Expense claims for trips not taken
• Expense claims for amounts higher than actually spent
• Forging signatures
• Making unauthorized changes to timesheets

Three ways to protect your business

• Use pre-employment checks: Set yourself off on the right foot from the beginning. Upon hire, background checks are not always necessary, but make sure to always verify references. You may also wish to see certificates/diplomas of courses completed to verify that the potential employee has the qualifications they claim to have.
• Monitor your employees’ performance: Use communication to be aware of workload, stress levels and goal reaching. Set internal management policies that help employees understand what is expected of them  and ensure you have an awareness of daily ins and outs of the business.
• Identify the most valuable assets of your company and think how to protect them: This could be sales information, internal processes and procedures, intellectual property, proprietary software, customer information, etc. A privacy and/or confidentiality policy can help prevent information leaks. Fraud is not always intentional – a lack of awareness amongst employees of things like information security and privacy regulations can allow others to commit fraud against your business and your customers.

Health and safety fraud

One of the most important aspects of a thriving small business is to ensure that Occupational Health and Safety (OHS) requirements are being followed. OHS regulations have several layers, vary from province to province, and occasionally change with little notice. It is no wonder that Occupational Health and Safety is the subject of common scams aimed at small businesses.

First-Aid kits
We know you care about your business and the well-being of your employees and customers. Not surprisingly, when a call comes in insisting you must purchase an expensive “government-approved” first-aid kit with automatic refills that can be billed directly to your credit card, it might seem like a prudent thing to do; however, these costly kits are often over and above what is actually required by provincial regulations.

Did you know?

• Most jurisdictions require first aid kits to, at a minimum, meet CSA Z1220-17; however, they may be other requirements based on the location of the workplace and number of employees.
• Kits can be purchased at various retailers as well as first-aid supply companies.
• Sometimes the kits suggested for purchase are based on requirements from other provinces. It’s important to understand what your business requires – our Business Advisors can help with this. 

Health and Safety training
Members frequently advise they have been solicited to purchase training in occupational health and safety. These courses might be for Workplace Hazardous Materials Information Systems (WHMIS), workplace violence and harassment training, or to provide the business with updates on “new” or “changed” regulations.

Why it’s a problem:

• The calls can leave you believing it is someone from the government demanding mandatory training, but the call is actually coming from a company that sells health and safety training.
• Often these calls reference regulation changes that happened in another province.
• Courses offered are often suggested best practices rather than required training.
• The courses offered can be at a premium cost to a small business when they are not a required expense.

What you need to know:

• The government will not call your business to solicit you to buy specific training.
• You always have options. There are several sources of training available online and in person at various price points from reputable providers.
• Our Advisors will help you navigate your training requirements based on provincial and federal regulations.
• CFIB Members have access to free health and safety training through our partner VuBiz.

For information on your Occupational Health and Safety requirements, visit our OHS Hub, or you can find the federal and your provincial contact information on the Canadian Centre for Occupational Health and Safety website.

Double deposit of cheques

In the past, the only way to deposit or cash a cheque was to provide the actual physical copy to a bank teller. Today, many banks offer an online banking tool called “Remote Deposit Capture”, allowing a person to deposit a cheque by sending a photo of it taken by a smartphone. After the cheque has been deposited, the individual still has the original cheque, which means they could deposit it a second time. The banking industry calls this a “double presentment”. 

Two scenarios have come to our attention:

1. An employee receives their pay by cheque. They take a photograph of the cheque, depositing it digitally, and then physically deposit the cheque at a financial institution. Whilst the banks have security processes in place to prevent an employee from being paid twice, the best way to safeguard against this type of fraud is to use direct deposit to pay employees.
2. A customer uses a government cheque to pay for their merchandise, which is a common practice in many rural communities across Canada. The merchant accepts the cheque as payment but later discovers that the cheque was digitally deposited before the purchase was made. 

Unfortunately, the news for merchants who accept an already-deposited cheque is not so good. From the banks’ perspective, the customer has stolen the merchandise, and the onus is on the business owner to prove this to police. 

To help guard against this type of theft, it is advisable to take down information about a customer who is using a government cheque to make their purchase – name, address, telephone number etc. Note that in some provinces it is illegal to even ask to see a drivers' license to verify identity, while in others, you can look at a drivers’ licence to verify identity, but it is against the law to write down any of the information on it or to photocopy it.