.png)
A wave of SMS phishing attacks targeting Canadians with lures regarding unpaid road toll fees have been rolling out since the beginning of the year. 407 ETR has been warning customers to beware of fraudulent texts impersonating the company. The message is designed to deceive people into clicking on a malicious link, which would leave people vulnerable to personal data theft.
407 ETR will use specific communication methods to interact with customers that use the express toll route. If you are a customer that uses the 407, take note of these legitimate communication channels:
Request a private consultation to find out whether Richter Guardian is a good fit for you.
%20(1).png)
Richter Guardian gives you enterprise-level cybersecurity tailored for individuals, families, and executives.
The cyber insurance market is softening just as the threats driving demand for it accelerate.
Premiums are falling, yet more than 40% of cyber claims are now denied — most often because controls attested to on the application were never actually in place.
For family offices, with their informal governance and concentrated wealth, a cheaper policy is increasingly a policy that will not pay.
The defensible position for family offices is verifiable security controls, not a lower premium.
Reporting from the Family Office Cybersecurity Forum in New York describes a market where competition is outpacing risk. New entrants including major carriers have pushed prices down, and average premiums were projected to fall a further 11% in 2026.
Buyers are being advised to shop around — but price is now the least important variable.
The frequency and severity of losses continue to climb even as rates drop, and the early signs suggest the rate of decline is starting to slow.
- ~50% of US family offices were hit by a cyberattack in 2025.
- 40%+ of cyber insurance claims are currently being denied — driven by missing controls, late notification and absent policy provisions, not exclusions.
- ~75% of carriers now run external attack surface scans during underwriting, replacing self-attestation.
- $713K average global ransomware claim in 2025 — nearly double the $374K recorded in 2024.
- 60% of family offices are confident their staff can detect and prevent AI-powered attacks.
- 2,137% rise in deepfake-driven fraud attacks since 2022; now 6.5% of all fraud.
Forum specialists characterized family offices as structurally vulnerable in ways that standard commercial cyber exposure does not capture.
The same traits that make a family office efficient make it exploitable:
- Cultures of informal approval and trust-based authorization.
- Heavy reliance on personal assistants and a small circle of staff.
- A bias toward speed over documented process.
- Multi-generational structures that widen the attack surface and blur accountability.
Layered on top is an AI-driven threat surface: deepfake voice impersonation of principals, AI-generated phishing, and business email compromise.
The FBI logged a 37% rise in AI-assisted BEC incidents using cloned executive voices, and attackers can now sit undetected inside a compromised environment for 100 days or more.
Family offices and their advisers face a tightening regulatory environment that mirrors what insurers already demand.
Amendments to the SEC's Regulation S-P took effect for smaller registered investment advisers on June 3, 2026, introducing a written incident response program, a 30-day customer breach notification obligation, and expanded vendor oversight.
The SEC's examiners have named S-P compliance a 2026 priority.
The critical point for prospects: the controls the regulator now mandates are, in most cases, the same controls cyber insurers require for a claim to be honored. One program satisfies both.
- Controls verification and attestation readiness — ensuring what you tell underwriters is true and evidenced.
- External attack surface assessment aligned to carrier underwriting scans.
- Regulation S-P alignment: written incident response program, breach notification readiness, vendor risk oversight.
- Human-layer defence against deepfake and AI-enabled social engineering, including principal and staff awareness.
- Ongoing managed monitoring so that controls stay in place between renewals.
Request a private consultation to find out whether Richter Guardian is a good fit for you.
Business Email Compromise, or BEC, is a targeted scam in which a criminal impersonates someone you trust. They may pose as an executive, lawyer, vendor, advisor, employee, or family member and ask you to send money, change banking details, or share sensitive information.
The message may come from a lookalike email address or a real account that has been compromised. This can make the request appear normal and include details that only a trusted person would seem to know.
Executives, high-net-worth individuals and their families, and anyone able to move money or release sensitive information are valuable criminal targets. AI-written emails and voice cloning can make these scams even more convincing.
An attacker sends a message that appears to come from someone you know. It is designed to seem routine or urgent so that you act before confirming the request another way.
If a real email account has been compromised, the attacker may review conversations, invoices, contacts, and travel details. They can use this information to create a convincing request at the right time.
The risk works both ways. You may receive a fraudulent message, or your own account may be taken over and used to contact others in your name.
According to the FBI Internet Crime Complaint Center’s 2025 Annual Report, BEC led to 24,768 reported complaints and more than $3 billion in reported losses in 2025. Only investment fraud caused greater reported losses that year.
BEC is also becoming harder to identify. AI can create professional messages without the spelling mistakes or awkward wording often linked to scams. Voice cloning may also make a call or voice message sound like someone you know.
Watch for:
A message from a compromised account may not show any of these signs. Verifying the request is more reliable than deciding whether the email looks suspicious.
Confirm every new payment instruction, banking change, or urgent transfer by calling the person directly. Use a number saved in your contacts, shown on a previous statement, or obtained from another trusted source.
Never use a number provided in the same email as the request.
During the call, confirm the payment amount, recipient, bank, account details, and reason for the transaction. Be especially careful if any information has changed.
Require approval from a second trusted person for payments above a set amount. Everyone involved should be expected to pause and verify a request, even if this causes a short delay.
Protect every email account including personal accounts, with a strong, unique password and multi-factor authentication. Keep recovery information current and check for unfamiliar forwarding rules, filters, connected applications, or signed-in devices. Do not reuse your email password on other services.
If you sent money or shared banking information, contact your financial institution immediately. Ask whether the payment can be stopped, recalled, or frozen. Keep the original emails, messages, and payment records.
If you believe your email account was compromised:
Richter Guardian can help reduce BEC risk by monitoring for exposed credentials and identifying impersonation attempts, including lookalike domains, websites, or accounts created in your name.
We can also help secure your accounts, review suspicious requests, and provide guidance if you believe an account has been compromised.
If you receive a suspicious email, payment request, banking change, or request for sensitive information, contact us before taking action.
Request a private consultation to find out whether Richter Guardian is a good fit for you.
On August 4, 2026, the claims process opened for a $8.7 million settlement of a class action against the Government of Canada.
This covered people whose personal or financial information in a Government of Canada online account, including the Canada Revenue Agency portal, was accessed without authorization in 2020.
KPMG is the court appointed administrator, and eligible class members can submit claims online or by mail until February 3, 2027.
The settlement is legitimate, but the publicity around it is exactly the conditions fraudsters look for:
That combination gives criminals a credible pretext to build convincing fake eligibility checkers and claim portals, and to harvest identity data and account credentials at scale.
A wave of phishing email, SMS, social media advertising, sponsored search results, and voice calls impersonating KPMG, the CRA, the Federal Court, and class counsel, beginning within days of the news coverage and continuing through the February 2027 claim deadline.
https://www.breachsettlementcanada.kpmg.ca (English and French). This is the court appointed administrator's website.
breachsettlementcanada@kpmg.ca
Anything arriving by unsolicited text, direct message, or phone call that pushes you toward a different address, a shortened link, or an app download should be treated as fraudulent until proven otherwise.
The following mock ups were produced by Richter Guardian for training purposes.
These are not real messages and the addresses and links shown are illustrative only.
Share them with your household, your office staff, and anyone who manages correspondence on your behalf.
Legitimate class action notice arrives by mail or from the administrator's own address.
Criminals also buy sponsored search advertisements so these pages appear above the real one.
Reach the administrator by typing the address directly - https://www.breachsettlementcanada.kpmg.ca - rather than by clicking any advertisement or search result.
The administrator contacts class members by mail or from its own domain. It will not cold call, text, or direct message you.
Real compensation is up to $80 or up to $200 for time spent, plus up to $5,000 in documented out of pocket costs, and amounts may be reduced depending on how many claims are approved. Nobody can promise you $5,000.
The real deadline is February 3, 2027. Any message giving you 24 hours, 48 hours, or "this week" is manufacturing pressure.
The genuine eligibility check asks for a last name, the last three digits of your SIN, and an email address. A request for the full SIN, date of birth, ID scans, or CRA credentials is a data harvest.
Filing a claim is free. A processing, verification, or expedite fee means fraud.
A one time passcode read aloud, forwarded, or typed into a third party site hands over your account.
Check the address carefully. The genuine site is https://www.breachsettlementcanada.kpmg.ca.
Anything ending in .info, .net, .co, .ca-claims, or a hyphenated variant of the KPMG name is not it.
Requests to move funds, buy gift cards, or receive a payout through e-transfer to a new recipient are not part of any settlement.
Reach the eligibility check only by typing https://www.breachsettlementcanada.kpmg.ca into the web browser. Do not use links from email, text, social media, or search advertisements.
If someone claims to be the administrator, hang up and contact breachsettlementcanada@kpmg.ca from the details on the official site.
Never provide a full Social Insurance Number to an inbound contact.
Sign in to CRA My Account by typing the address, confirm your direct deposit details and mailing address have not been changed, and enable multi factor authentication if it is not already on.
If you believe your information was exposed, place a fraud alert with Equifax Canada and TransUnion Canada.
Forward or print this email to anyone who handles correspondence, banking, or tax filings on a principal's behalf.
Any instruction arising from a settlement, refund, or government notice must be verified by an out of band call to a known number before any data or funds move.
Ask your IT provider to monitor for newly registered domains that combine your family or firm name with settlement, claim, refund, or CRA terms.
Quarantine newly registered sender domains and flag external mail referencing CRA settlements or class action payouts.
Report suspected scams to the Canadian Anti-Fraud Centre at 1-888-495-8501 and preserve the original message headers rather than deleting them.
Change the password on any account whose credentials were entered, starting with CRA My Account and your email, and revoke active sessions.
If CRA credentials were disclosed, contact the CRA immediately and ask that the account be locked and reviewed for changes to direct deposit or address.
Report the exposure and ask for enhanced verification on outbound payments.
Contact Equifax Canada and TransUnion Canada.
Speak to your Richter Guardian team. We can help contain the incident, assess what was exposed, and coordinate monitoring.
Request a private consultation to find out whether Richter Guardian is a good fit for you.