When it comes to the topic of fraud in universities, most people think of astronomical tuition rates. But, for one university, it wasn't a case of the school fleecing someone, it was actually the other way around. As a result, MacEwan University in Edmonton lost a whopping $12 million all because of one pesky email.
It all started in summer 2017 when MacEwan was in the middle of construction for a new $180 million art building. The Allard Hall was set to include music studios and dance halls that would accommodate 1,800 students. Naturally, with such a big project, a lot of emails were sent regarding the building's payment transactions.
Since there were tons of emails about large amounts of money being owed for different parts of the project, an email that was received on June 27th didn't raise any red flags. The email claimed to be sent by a man named James Ellis who worked for the construction company in charge of the whole project, Clark Builders.
The email started off with an innocent "Hiya" then included a request for the payments for the company to be rerouted to a different National Bank of Canada account. Attached to the email was a letter supporting the claims for the reroute, and even appeared to be signed by Clark Builder's Chief Financial Officer, Marc Timberman.
Since the email seemed legitimate, one of the accounting technicians at MacEwan, Udeni Jayasinghe, made sure to reroute the funds to the new account and a month later, $1.9 million was sent. But, to their surprise, the payment bounced back because the account apparently "didn't exist."
As a result, Jayasinghe sent an email back to 'James Ellis' asking for the proper banking information so he could successfully send the payment. Ellis responded 4 days later with a different bank account through TD Bank. Once again, the email came with an attached letter approving everything said in the email that was signed by Marc Timberman.
Once that payment went through, the university proceeded to put through three payments into the account with TD Bank over the course of a week that, when all was said and done, came to a grand total of $11.8 million.
It wouldn't be until nearly two months after the transactions went through that the university would be contacted by Clark Builder's senior project manager, Serge L'Abbe, asking about the missing money.
From there, MacEwan would find out that Clark Builders never received their payments, that Marc Timberman never authorized the change in accounts or signed any of those letters, and that nobody named James Ellis had worked for Clark Builders in at least eight years. It was a fraudulent email scam - and a big one, at that.
This type of fraud scheme isn't new, unfortunately. It's known as a "spear phishing scheme," says RCMP Constable William Lewadniuk. This is where the attacker is targetting a specific person, group or company. From there, the scammers will attempt to "spoof the email address and try to get them to send you money, so you would pretend to be a contractor or a person's boss."
Immediately after the school found out, they launched an investigation to find all the funds. It took several months to recover part of the money, considering the scammers had a two-month head start to begin laundering the funds.
Money was found in Montreal, East Asia, Edmonton and Vancouver - revealing an incredibly complex web that the scammers had created in efforts to successfully hide the millions of the dollars they stole.
In the end by April of 2018, MacEwan University was able to recover $10.9 million of the $11.8 million that had been lost in the initial scam. While they definitely got a lot of their money back, the $960,000 that is still missing hasn't been forgotten and still stings the campus to this day.
If the situation proves anything, it's that scam emails have definitely gotten a lot more sophisticated and complex. To the point where you may want to start confirming all of your business transactions over the phone with the people you are sending it to. It's better to be safe than sorry and be out a million dollars.
Source: Toronto Star Edmonton