Fake Proof of Payment: Detecting Forged Transfer Confirmations in Canada

A seller hands over the car keys, a landlord passes over a rental deposit receipt, or a distributor releases a pallet of stock, all on the strength of a screenshot. The buyer's phone shows an Interac e-Transfer notification, complete with a reference number and a green checkmark, or — for a larger deal — a wire confirmation carrying SWIFT-style field codes and a bank's logo. The money never arrives, because the notification was never real: it was edited, generated, or produced by a spoof template built to look convincing for the few minutes it takes to close a deal.

This article is for informational purposes only and does not constitute legal, financial, or regulatory advice.

What Fake Proof-of-Payment Fraud Is

Fake proof-of-payment fraud is the presentation of a forged or manipulated document — an Interac e-Transfer notification, a banking screenshot, a PDF receipt, or a fabricated SWIFT MT103 confirmation — to convince a seller that a transfer has already been sent, so they release goods before checking whether funds have actually cleared. It targets the moment of handover rather than the payment instruction: the movement described either never happened, was reversed minutes later, or was sent for a different amount to a different party.

This is distinct from fake bank details fraud, where criminals redirect a genuine payment by supplying forged account details, and from forged bank statements used to fake income or solvency in a loan file. Here the document is not trying to change what happens to real money — it is trying to convince someone that money has already moved when it has not.

Canadians reported $643.7 million in fraud losses to the Canadian Anti-Fraud Centre (CAFC) in 2024, across 108,878 reports and at least 35,587 confirmed victims (CAFC 2024 Annual Statistical Report). Merchandise fraud — covering vehicle sales and marketplace deals, where forged payment proof is a recurring tactic — ranked among the most frequently reported fraud types that year, and the CAFC's estimate that only 5 to 10 percent of victims report suggests the true volume is higher still.

How Fraudsters Build a Convincing Fake Payment Confirmation

Three techniques recur across vehicle sales, equipment leasing, wholesale trade, and marketplace deals in Canada, each aimed at a different moment in the transaction.

Fake Interac e-Transfer notifications and spoof banking screens

Interac e-Transfer is the dominant instant-payment method for consumer transactions in Canada, and it works through an email or text notification rather than a live, seller-side confirmation from the bank — exactly what makes a forged copy easy to mistake for a real one. Fraudsters clone the standard "you have received money" template, down to the sender name and layout, or edit a pending-screen screenshot. Because most institutions cap a single e-Transfer at a few thousand dollars, a claim that one notification covers the full price of a car is itself inconsistent with how e-Transfer works, and is worth treating as a signal on its own. A genuine bank never lets a user generate a "money received" notification for a transfer that was never sent; a forged email skips the bank entirely.

Fabricated wire transfer and SWIFT confirmations

For larger transactions — equipment leases, wholesale invoices, cross-border vehicle purchases — fraudsters sometimes present a forged SWIFT MT103 confirmation or a so-called "conditional" MT103/23 as proof a wire is in transit. No such conditional instrument exists in the SWIFT messaging standard: a payer cannot make an MT103 contingent on the recipient completing paperwork first. The document reproduces genuine-looking field codes and bank letterhead, but is not traceable through the actual SWIFT network because no real message was ever sent.

Fake PDF receipts and doctored remittance advice

Some fraudsters send a PDF "payment confirmation" cloned from a real bank template, complete with a transaction reference and a logo lifted from the institution's branding. A material share of these documents can be distinguished from genuine bank-issued files by structural inconsistencies invisible on screen — metadata, font substitution, and layout artefacts that differ from how the named institution actually generates its confirmations, a pattern CheckFile's pipeline is built to surface through structural checks rather than visual review alone.

Where This Fraud Hits Hardest: Vehicle Sales, Leasing, and B2B Trade

Fake proof-of-payment fraud concentrates wherever a valuable asset changes hands quickly and the seller has an incentive to move fast.

Vehicle sales are a recurring target because the payment is large enough to reward the effort, and the item — a car — is portable and resellable within hours. Canadian marketplace and owner forums consistently flag the "agent collection" variant, where a buyer claims to be out of province or abroad, sends a fake confirmation, and arranges a courier to collect the vehicle and its registration paperwork — a Used Vehicle Information Package in Ontario, a SAAQ certificate in Quebec, and equivalents elsewhere — before the seller has checked their balance.

Real Questions Sellers and Buyers Ask

Canadian marketplace and car-selling forums return to the same handful of questions whenever this scam surfaces, synthesised below rather than quoted directly.

Is an Interac e-Transfer notification ever valid proof of payment

No. A notification email or screenshot is not a live connection to a bank's ledger, and both are trivial to fake. Legitimate notifications do arrive by email, which is precisely why a forged copy is easy to mistake for a real one — the deciding factor is never whether an email arrived, but whether funds show as deposited and cleared in the recipient's own account, checked directly in their own banking app.

Why does the buyer always claim the payment is "pending" or sent via a third party

Forums repeatedly describe buyers who claim to be out of town or out of the country and send a courier or "agent" to collect the item before funds are confirmed. This detaches the collector from the person who supposedly paid, so if the payment never appears, the seller has no buyer to chase.

Can a seller be held liable if they release goods against a fake payment proof

Releasing goods against unverified proof of payment is a business risk the seller absorbs, not a liability that shifts to the bank. Interac e-Transfers do not carry the zero-liability protection that applies to credit card fraud, and there is no reimbursement scheme comparable to a chargeback for a seller tricked into releasing goods with no funds sent at all.

Why Common-Sense Checks Still Fail

Manual review catches obvious fakes — misspelt bank names, mismatched fonts — but the underlying weakness is structural: staff and private sellers judge a document's appearance under time pressure created deliberately by the fraudster. Manual fraud detection across document types generally identifies around 37% of cases, with an average detection delay of 87 days, according to the ACFE 2024 Report to the Nations — figures describing organisational fraud broadly, but illustrating the same problem: appearance-based review misses forgeries engineered to look right at a glance, and the pressure to close a sale quickly compounds it.

The same document-level techniques used in equipment leasing compliance checks — validating that a file's structure matches what the claimed issuer would actually produce — apply just as directly to a payment confirmation.

A Verification Sequence Before Releasing Goods or Access

A short, enforced sequence closes most of the exposure this fraud exploits, whether the transaction is a private car sale or a business-to-business dispatch.

Step 1 – Treat any screenshot, PDF, or forwarded email as unverified by default. No document, however detailed, substitutes for funds appearing in your own account.

Step 2 – Check your own banking app directly, never a link the buyer provides. Navigate to your bank's app independently and confirm the balance has moved and cleared, not merely shown as pending.

Step 3 – Treat the sender name on the notification as a weak signal, not proof. It displays the name the sender entered, not one independently verified against the account holder — Canada has no widely available confirmation-of-payee service. A mismatch is worth pausing on, but the only conclusive check remains cleared funds in your own account.

Step 4 – Refuse third-party collection until funds have cleared. Any request to release goods to a courier or "agent" before you have personally verified cleared funds is a standalone red flag, regardless of how convincing the payment proof looks.

Refusing to release goods or access until payment shows as cleared funds in your own account, checked independently of anything the buyer supplies, is the control cited most consistently across Canadian guidance on marketplace and vehicle-sale scams (Canadian Anti-Fraud Centre). No document-level check replaces that step; it reduces how often a forged confirmation gets that far.

Reporting and Recovery Options in Canada

If goods have already been released against a fake payment proof, recovery options are limited and time-sensitive. Report the incident to the Canadian Anti-Fraud Centre, and to local police — or the RCMP where they hold jurisdiction — for a file number often required for insurance claims and any courier dispute. Canada has no statutory scheme requiring a bank to reimburse someone who released goods without receiving payment, and e-Transfers do not carry the zero-liability protection that applies to credit card fraud. Recovery instead depends on the account agreement, any available payment recall, and, where the loss is significant, provincial civil remedies — Quebec's civil law framework differs procedurally from the common law used elsewhere.

Businesses accepting payment confirmations as part of a regulated process carry additional obligations. OSFI, the Office of the Superintendent of Financial Institutions, expects federally regulated banks and insurers to maintain proportionate fraud controls, though its mandate is prudential soundness, not reimbursing individual losses. Separately, entities reporting under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) carry an independent duty to FINTRAC: a transaction connected to suspected fraud can trigger a Suspicious Transaction Report regardless of dollar value (FINTRAC guidance), consistent with the CheckFile banking KYC solution approach.

How CheckFile Complements Direct Bank Verification

Checking your own account balance directly remains the single most reliable control against this fraud, and no document analysis tool replaces it. Where a business handles proof-of-payment documents at scale — a leasing company processing deposit confirmations, a distributor accepting remittance advice before dispatch — CheckFile applies cross-document validation across multiple fields per document to assess whether a submitted payment confirmation is structurally consistent with what the claimed issuing bank would actually produce. CheckFile offers AI-generated content detection as an optional forensic layer, available according to the sector's risk level, as a complement to existing structural controls. Processing these documents also falls under PIPEDA and, in Quebec, Loi 25.

The CheckFile financing and leasing solution applies this pipeline to deposit and payment confirmations collected during equipment and vehicle finance onboarding, and the CheckFile security infrastructure provides the audit trail needed if a disputed transaction is escalated. Teams evaluating deployment can review the pricing page or explore the platform directly.

For a broader view of document verification obligations across sectors, see our industry verification guide, and for the related payment redirection risk, our guide to fake bank details fraud detection.

To place fake payment confirmation detection within a dedicated approach, see AI-generated and forged document detection. CheckFile analyses submitted documents and surfaces AI-generation signals as a complement to your existing controls — it does not replace checking your own bank account before releasing goods.

Frequently Asked Questions

What is the difference between fake proof of payment and fake bank details fraud?

Fake proof of payment fraud forges a document claiming a transfer has already happened. Fake bank details fraud forges account information to redirect a genuine, intended payment. The two can overlap, but the document forged and the moment it is used differ.

Can a fake SWIFT MT103 confirmation be verified as genuine?

A payer's bank or an independent SWIFT tracing request can confirm whether a message was transmitted; a recipient cannot verify it from the document alone. There is no "conditional" MT103 that releases funds once paperwork is completed — any confirmation claiming this is fabricated.

How quickly do Interac e-Transfers and wire transfers actually clear in Canada?

An Interac e-Transfer between participating institutions is typically available within minutes once deposited, though some are held for security review. A wire or EFT between Canadian banks generally takes one to a few business days, and a cross-border SWIFT wire can take longer still. A buyer claiming an e-Transfer has been "pending" for days is describing behaviour inconsistent with how these payment rails work, and it warrants direct verification with your own bank before proceeding.

Should a seller ever accept a payment confirmation instead of checking their own account?

No single document should substitute for confirming that funds have cleared in the seller's own account, checked through their own banking app rather than a link or screenshot the buyer supplies. Confirmations can support a decision once funds are independently verified, but on their own carry no guarantee money has moved.

Who should be notified if goods were released against a fake payment proof?

Report the incident to the Canadian Anti-Fraud Centre, and file with local police, or the RCMP where they hold jurisdiction, for a file number often needed for insurance claims. If a courier collected the goods, notify that firm directly, since they may hold identifying information about the collector, and contact your bank in case the same fraudster targets a linked account.