AI-Faked E-Transfer Receipts: Holiday Checklist

It's Saturday, December 19th. Your Burnaby shop is packed, the line is out the door, and a customer holds up their phone: "Sent the e-Transfer, here's the receipt." The screen shows a green checkmark, your business name, the right amount, a reference number. They grab the gift basket and leave.

On Monday you check the bank. Nothing arrived.

Fake payment confirmations aren't new. What's changed is how cheap a convincing one has become. Image tools powered by AI can produce a clean, believable banking screen in seconds, and a screenshot of a real app can be edited just as fast. This post is a practical checklist for the holiday rush, plus an honest look at what technology can and can't do about it.

What the official sources actually say

The Canadian Anti-Fraud Centre's merchandise fraud page (modified January 16, 2026) lists several tactics aimed at sellers. Fraudsters send "a fake 'etransfer' email or text message asking you to accept a transfer as payment." Others send "a message or email money transfer notification that claims the payment is pending." There's also the classic overpayment trick, where you receive "a payment for more than the asking price" and get asked to wire back the difference.

In its October 2025 feature, Check twice, pay once, the CAFC puts it plainly: "Criminals may send fake payment notifications via email or text message to convince sellers that funds were sent when no money was actually transferred."

Interac's own e-Transfer FAQ says to "be suspicious if you receive a notification you weren't expecting," contact the sender to confirm, and forward anything you can't confirm to [email protected]. The same FAQ notes Interac "does not hold funds and is unable to trace funds," so disputes go through your own financial institution.

One honest caveat up front. None of these sources publish a count of how many fake receipts were made with AI specifically. We couldn't find a reliable Canadian figure, so we won't invent one. The advice below works whether a fake was made with AI, a photo editor, or a template copied off a forum.

Why you can't "spot the fake" by looking

Older advice focused on visual tells. Interac's email fraud guide (updated October 21, 2025) points out that "a common error in phishing emails is the '$' sign appearing after the amount, instead of before it," and that fraudsters copy company logos, sometimes including Interac's. Those tips still catch sloppy fakes.

But a careful forger, or a decent image model, won't make that mistake. And a receipt on a customer's phone is just pixels. It tells you what someone wants you to see, not what your bank has received.

You might hope software can flag AI images automatically. It can't do that reliably today. OpenAI's content provenance documentation explains that its generated images carry C2PA Content Credentials ("signed metadata with issuer and AI-use details") and a SynthID watermark. But it also warns that "editing, converting, or sharing a file can remove its metadata," and that a not detected result is "an absence of detected evidence, not proof that the content is human-created." A screenshot of a screenshot will usually pass clean.

NIST reaches the same conclusion more broadly. Its report NIST AI 100-4, Reducing Risks Posed by Synthetic Content (November 2024) notes that metadata "can similarly be stripped altogether, as it often is when files are shared," and that "covert and overt watermarks can often be removed from digital content." Bad actors can also use open models that never added a watermark in the first place.

So the fix isn't a better eye. It's a better process.

The holiday checklist for Burnaby shops

Print this and tape it beside the till. It's written for a small retail or service counter in Burnaby, New Westminster, or anywhere else in Metro Vancouver, but it applies to any shop that takes e-Transfers.

• The bank is the only receipt. A payment counts when it shows in your business account or banking app, not on the customer's screen, not in a forwarded email, not in a text.
• Turn on Autodeposit for the business email. Interac describes Autodeposit as having incoming funds "deposited directly into their bank account." That means real transfers land without a security question, so if your account shows nothing, nothing came.
• Assign one "payment checker" per shift. Give one trusted person a phone or tablet logged into the business bank feed. Staff call out the name and amount; the checker confirms. No confirmation, no handover.
• Never click links in payment emails. Interac's guidance is clear: don't click unless you're certain the sender is real. Open your banking app directly instead. The CAFC also warns about QR codes that claim to "release" a payment.
• Watch for "pending" and "on hold" stories. A notification saying funds are pending until you ship, send a tracking number, or pay a fee matches the pattern the CAFC describes. Real Autodeposit transfers just arrive.
• Know a request from a payment. A Money Request asks you to pay. If you're the seller, you should never be approving anything that sends money out.
• Refuse overpayments. If someone "accidentally" sends too much and asks for a refund of the difference, stop. Confirm the original funds have cleared with your bank first, and refund only to the original sender.
• Set a hold rule for big tickets. Above a threshold you choose (say, illustratively, $300), goods stay on the shelf until the funds show in your account. Offer tap or card as the fast alternative.
• Report and forward. Send fake Interac notifications to [email protected] and report fraud to the Canadian Anti-Fraud Centre and your local police.

Where AI helps on your side

AI isn't only the forger's tool. Used carefully, it can take the lookup work off a busy counter.

A simple setup we see as sensible: your bank's deposit notifications go to a dedicated inbox, and an AI assistant reads them and posts a short "received: name, amount, time" line to a staff screen or group chat. The cashier waits for that line before handing over goods. The assistant never approves anything; it just reports what the bank already confirmed.

The same assistant can answer customer questions after hours ("Do you take e-Transfer? What's the email?") with a consistent, correct business address, which makes look-alike addresses easier for your team to notice. It can also draft a polite script staff use when they need to say "we'll release this once it shows in our account."

What it shouldn't do is "judge" screenshots. As the OpenAI and NIST material shows, detection of synthetic images isn't dependable enough to be a gatekeeper. If a vendor promises that, ask for their false positive and false negative rates in writing.

Where this doesn't apply

Be realistic about the limits.

• Low volume shops may not need automation. If you take three e-Transfers a week, a staff member opening the banking app is free and works fine. Don't buy software to solve a two-minute task.
• Bank notifications vary. Not every institution sends deposit alerts in a format that's easy to parse, and some business accounts can't forward them at all. Check with your bank before planning anything.
• Autodeposit has setup friction. It's tied to an email or phone number registered with your institution, and some business account types handle it differently. Confirm with your branch.
• Nothing here stops social engineering. A rushed, guilt-tripping customer can still talk a new hire into skipping the check. Training and a firm "bank is the receipt" policy matter more than any tool.
• Card payments are often simpler for the rush. If e-Transfers keep causing stress at the counter, steering in-person holiday sales to tap may be the better call, even with processing fees.
• Privacy still applies. Routing deposit emails through an AI service means sending customer names and amounts to a third party. Make sure you know where that data is stored and who can see it.

The short version

A receipt on someone else's phone is a picture, not a payment. AI makes those pictures easier to fake, and current watermark and detection tools can't reliably catch them. Confirm every e-Transfer in your own banking feed, turn on Autodeposit, refuse overpayments, and give one person per shift the job of saying "it's in."

Sources

• Canadian Anti-Fraud Centre. "Merchandise." Government of Canada, modified 2026. antifraudcentre-centreantifraude.ca/scams-fraudes/merchandise-marchandises-eng.htm
• Canadian Anti-Fraud Centre. "Check twice, pay once: starting new habits to avoid merchandise fraud." 2025. antifraudcentre-centreantifraude.ca/features-vedette/2025/10/avoid-merchandise-evitez-eng.htm
• Interac Corp. "Interac e-Transfer" (Personal FAQ). Accessed October 2026. interac.ca/en/resources/personal-resources/personal-faq/interac-e-transfer/
• Interac Corp. "Email fraud: How to recognize it, and how to protect yourself from phishing scams and identity theft." Updated 2025. interac.ca/en/content/life/email-fraud-how-to-recognize-it-and-how-to-protect-yourself/
• OpenAI. "Content provenance" (API documentation). Accessed October 2026. developers.openai.com/api/docs/guides/content-provenance
• Chandra, B., Dunietz, J., Roberts, K., Lee, Y., Fontana, P., Awad, G. "Reducing Risks Posed by Synthetic Content: An Overview of Technical Approaches to Digital Content Transparency." NIST AI 100-4, National Institute of Standards and Technology, 2024. nist.gov/publications/reducing-risks-posed-synthetic-content-overview-technical-approaches-digital-content

Want a second set of eyes on your holiday payment process, or a simple AI assistant that tells your counter staff the moment a real e-Transfer lands? Book a free call with Autana Solutions. We're local to Burnaby and New Westminster, and we'll tell you honestly if a checklist is all you need.