If you suspect fraud inside a Toronto business, your first job is not to prove the entire case. It is to stop further loss, preserve the records and avoid alerting the wrong people too early.

Business fraud investigations often begin with something small: an unfamiliar vendor, duplicate payment, changed banking instruction, missing inventory or complaint from an employee. The response during the first day can determine whether reliable evidence survives.

This guide explains what to do first, where to report business fraud in Toronto and when a private investigation or forensic review may help. It is general information and not legal advice.

What to do when you first suspect business fraud

1. Stop any active loss

If a payment is still pending, contact the financial institution through a verified number. If credentials may be compromised, have an authorized administrator secure the account, revoke exposed sessions and preserve the associated logs.

Do not make broad changes that destroy evidence. Reimaging a computer, deleting an account or wiping a phone may remove the very records needed to understand what happened.

2. Create a small response team

Choose one decision-maker and involve only the people needed at the start. Depending on the allegation, that may include external counsel, finance, IT security, HR and an investigator.

Check for conflicts. The person who normally supervises the employee, vendor or system may be involved in the events or may later become a witness. They should not control the investigation.

3. Record what triggered the concern

Write down who noticed the issue, when it was noticed, what record raised the concern and what immediate action was taken. Separate what is known from what is suspected.

A useful opening note might say: “On July 10, Accounts Payable identified two payments with the same invoice number but different destination accounts.” It should not say: “The controller stole the money” unless that conclusion has been established.

Which records should be preserved?

The answer depends on the allegation, but common sources include:

• general ledger entries, invoices, purchase orders and payment approvals;
• banking instructions and change-request records;
• vendor master data and account-change logs;
• email, chat and collaboration-platform records;
• authentication, access-control and file-audit logs;
• expense reports, corporate-card statements and receipts;
• inventory, shipping and access records;
• employment agreements, policies and prior complaints;
• relevant laptops, phones or removable media owned by the business.

Preserve originals where possible and work from copies. Record who collected each item, when it was collected, where it came from and how it was stored. For digital evidence, a qualified specialist may need to create a forensic image rather than simply copying visible files.

Do not confront the suspected person too early

An immediate confrontation can feel decisive, but it may prompt deletion, coordination with others or a resignation before records are secured. It may also turn a misunderstanding into an employment dispute.

There are situations where a prompt interview is necessary. The decision should follow a short risk assessment that considers ongoing access, safety, evidence preservation and legal obligations. Counsel and HR should guide any suspension or employment action.

Where to report business fraud in Toronto

Toronto Police Service

Call 9-1-1 if there is an emergency, immediate danger or crime in progress. For non-emergency fraud, Toronto Police provides an online reporting system and a non-emergency line at 416-808-2222. The online process will tell you if officer attendance or another reporting method is required.

Keep the event or occurrence number and provide a concise chronology, loss estimate and list of preserved records. Police decide whether and how a criminal investigation will proceed.

Canadian Anti-Fraud Centre

You can also report fraud through the federal Report Cybercrime and Fraud portal or call 1-888-495-8501. The central report may help connect related complaints across jurisdictions. It does not replace the local police report.

Ontario Serious Fraud Office

The Ontario Serious Fraud Office investigates serious fraud and complex financial crime, but it does not accept direct referrals from individuals or businesses. Cases are referred by the OPP or another Ontario police service. Report the matter to local police first.

Police investigation vs. private business fraud investigation

A police investigation and a private corporate investigation serve different purposes.

Police	Private corporate investigation
Assesses possible criminal offences	Answers the organization’s defined factual questions
Uses public law-enforcement powers	Uses consent, company authority and lawful private sources
Controls its own priorities and timelines	Works to an agreed scope, subject to law and evidence access
May support charges and prosecution	May support employment, civil, insurance or governance decisions

A private investigator cannot exercise police powers or guarantee that police will act. A business can often preserve records and conduct a fair internal investigation while a police report is under review, but the work should be coordinated to avoid interference.

When to involve a forensic accountant or digital specialist

A corporate investigator organizes the fact-finding, sources and interviews. A forensic accountant is useful when the central question involves financial reconstruction, loss calculation, related-party transactions or the interpretation of accounting records.

A digital-forensics specialist may be needed for deleted files, compromised accounts, device imaging, access logs or malware. Ask each professional to stay within their discipline and explain their method.

How a business fraud investigation should proceed

Scope and authority

Define the allegations, relevant period, decision-maker, legal authority to access company systems and the questions the report must answer. Avoid a mandate to “find all wrongdoing.”

Evidence plan

List the likely records and custodians, issue any necessary preservation instruction and collect the most volatile evidence first. Document exclusions and access limits.

Document review and analysis

Build a chronology and transaction map. Test alternative explanations instead of treating the first theory as fact. Identify gaps that require an interview or additional record.

Interviews

Interview order depends on the matter. Start with the people and records most likely to clarify the facts without compromising the process. Give a person whose conduct may be criticized a fair opportunity to respond to the substance of the allegation.

Reporting

The final report should state the mandate, sources, method, evidence, findings and unresolved questions. It should distinguish observed facts from inference and avoid conclusions outside the investigator’s expertise.

Privacy and employment issues in Ontario

Privacy obligations depend on the organization, sector, information and activity involved. PIPEDA applies to federally regulated employers and to many commercial activities, while other Ontario workplaces may be governed by different statutes, contracts, policies and common-law duties.

Even where information can be collected without consent for an investigation, the collection must still be lawful and proportionate. In one published PIPEDA investigation, the Privacy Commissioner emphasized the need for substantial grounds, less intrusive alternatives and collection limited to the defined purpose. See the Commissioner’s findings on employer surveillance.

Before reviewing personal devices, monitoring communications or conducting surveillance, get legal advice on authority, notice, proportionality and the intended use of the information.

What to do in the first 48 hours

1. Stop active payments or access without destroying records.
2. Create a small, conflict-free response team.
3. Document the initial concern in neutral language.
4. Preserve financial, communication and access records.
5. Contact external counsel if litigation, privilege or employment action is likely.
6. Report suspected crime to Toronto Police and the national reporting portal.
7. Decide whether corporate investigation, forensic accounting or digital forensics is needed.

Frequently asked questions

How do I report business fraud in Toronto?

Call 9-1-1 for an emergency or crime in progress. Non-emergency fraud can be reported through the Toronto Police online reporting system or at 416-808-2222. Also file a national report through reportcyberandfraud.canada.ca.

Should I confront an employee suspected of fraud?

Usually not before key records and access logs are preserved. Get advice on evidence, safety and employment obligations before an interview, suspension or accusation.

Can the Ontario Serious Fraud Office take my report directly?

No. The office accepts case referrals from the OPP and other Ontario police services, not directly from businesses or individuals. Report to local police first.

What evidence should a business preserve?

Preserve relevant financial records, messages, email, approvals, access logs, vendor changes, receipts and company-owned devices. Keep originals and document who collected each item.

Can a private investigator work alongside police?

Often, but the roles and evidence handling should be coordinated. A private investigator has no police powers and should not interfere with a criminal investigation.