EDMONTON—An Alberta university says it has been defrauded of $11.8 million in a so-called phishing attack, admitting it didn’t have safeguards in place as staffers unwittingly paid out millions of dollars online. “This is an administrative error,” David Beharry, spokesperson for MacEwan University, said Tuesday. 
 
 Alberta's MacEwan University has been defrauded of $11.8 million after workers were fooled by a series of fake emails asking them to change electronic banking information for one of the school’s major vendors. ( Dreamstime ) 
 
 “We have ensured that there will now be a secondary and tertiary level of approval.” Beharry was asked why safeguards were not in place beforehand. “That is something we are seriously looking at,” he said. 
 
 Article Continued Below 
 
 He said the scam occurred when fraudsters created a website that resembled the domain site of one of the university’s major vendors. Using that site, the fraudsters impersonated the vendors, asking the university to transfer accounts payable to a new bank account the fraudsters controlled. Three staffers at MacEwan made three payments to the bogus account over a nine-day period ending Aug. 19. The university paid out $1.9 million, $22,000, and finally $9.9 million. The university did not realize what had happened until days later when the vendor called asking to be paid. Beharry said the three employees involved were not high-level staffers, but wouldn’t say if they had been suspended or reprimanded. 
 
 He said an internal investigation and police investigation are underway, but added: “The university does not believe there has been any sort of collusion. “We really believe this is simply a case of human error.” 
 
 Article Continued Below 
 
 Beharry would not identify the vendor involved, but said a number of construction firms have been impersonated in similar online phishing attacks. He said most of the missing money — $11.4 million — has been traced to a bank account in Montreal and to two accounts in Hong Kong. Beharry said $6.3 million has been seized from the account in Montreal, and actions are underway to freeze the two accounts in Hong Kong. “We are fairly confident that we will be able recover those funds,” he said. “It’s a question of how long.” He said a review found the IT and financial systems safe and secure and said that the university will be able to meet its financial commitments to the vendor and others. Advanced Education Minister Marlin Schmidt said he was “very disappointed” the university fell victim to the crime, adding he has instructed all university board chairs to review their financial controls. “This is unacceptable and I’ve asked the board chair to report back to me by September 15 with details on how this occurred,” Schmidt said in a statement. “While I’m told that MacEwan has put improved internal financial controls to help prevent it from happening again, I expect post-secondary institutions to do better to protect public dollars against fraud.” 
 
 Read more about: ||||| Low-level MacEwan University staffers were tricked into transferring $11.8 million into scammers’ bank accounts in what one expert said is among the largest publicly disclosed phishing scams. 
 
 The majority of the money, $11.4 million, has been traced to bank accounts in Montreal and Hong Kong. 
 
 “We are fairly confident that we will be able to recover those funds, the $11.4 million,” MacEwan spokesman David Beharry said Thursday. “It’s a question of how long will it take for the university to retrieve that money.” 
 
 He said $6.3 million has been seized from the account in Montreal, and actions are underway to freeze the two accounts in Hong Kong. 
 
 The $11.8 million loss represents about one-10th of what MacEwan receives as an annual operating grant from the government of Alberta. In the 2015-16 financial year, the university received $118 million from the province out of its $237.1-million budget. 
 
 “I think it’s safe to say that there was a lot of disappointment and frustration because this came down to human error,” Beharry said. 
 
 The fraud was discovered Aug. 23 after a supplier said it had not been paid. Beharry would not identify the supplier. 
 
 Fraudsters had created a website that resembled the domain site of one of the university’s major supplier. Using that site, the fraudsters impersonated the supplier, asking the university to transfer accounts payable to a new bank account the fraudsters controlled. 
 
 Three MacEwan staffers made three payments to the bogus account over a nine-day period ending Aug. 19. The university paid out $1.9 million, $22,000, and finally $9.9 million. 
 
 Beharry would not say if the staffers have been disciplined or fired. 
 
 “The university does not believe there has been any sort of collusion,” he said. “We really believe this is simply a case of human error.” 
 
 The university is working with lawyers in Montreal, London and Hong Kong on civil action to recover the money. The status of the remaining $400,000 is not known. 
 
 MacEwan conducted an audit of its business processes after discovering the fraud and put controls in place “to prevent further incidents.” An internal audit group will also investigate the incident. 
 
 An early assessment determined that “controls around the process of changing vendor banking information were inadequate, and that a number of opportunities to identify the fraud were missed.” 
 
 David Shipley, CEO of Beauceron Security and former cyber-security lead at the University of New Brunswick, said MacEwan was likely the victim of what’s known as a business email compromise scam. 
 
 “It’s the single largest publicly disclosed amount I’ve seen,” he said. “That’s not to say there aren’t private companies that aren’t required to disclose this stuff that haven’t had (larger) losses.” 
 
 Shipley said Facebook and Google fell victim to similar scams, transferring “in the $100-million range” after being invoiced by fake suppliers. 
 
 “This is the intersection of people, process and technology,” he said. “People in that they got tricked, process in that being able to transfer that amount of money should have required additional financial controls. Technology played the smallest role — as in why didn’t their email filter it or alert them that (the sender) wasn’t who it said it was.” 
 
 Beharry said the university has funds to pay the supplier. The loss would not impact students, he said. 
 
 In a statement, Advanced Education Minister Marlin Schmidt said he is “disappointed” the university fell victim to the scam and has instructed all post-secondary institutions to review their financial controls. 
 
 “I expect post-secondary institutions to do better to protect public dollars against fraud,” Schmidt said. 
 
 With files from Juris Graney and CP 
 
 jwakefield@postmedia.com ||||| An Edmonton university was defrauded of $11.8 million after staff failed to call one of its vendors to verify whether emails requesting a change in banking information were legitimate. 
 
 MacEwan University discovered the fraud on Aug. 23 after the legitimate vendor, a construction company, called to ask why it hadn't been paid. 
 
 Three payments were made to the fraudulent account: one on Aug. 10 for $1.9 million; another on Aug. 17 for $22,000 and a third on Aug. 19 for $9.9 million. 
 
 Most of the money — more than $11.4 million — has been traced to accounts in Montreal and Hong Kong, the university said in a news release Thursday. 
 
 Those funds have now been frozen, the university said, adding it is working with legal counsel in Montreal, London and Hong Kong to pursue civil action to recover the money. The status of the rest of the missing money isn't known. 
 
 University spokesperson David Beharry said the scammers sent emails that looked legitimate. 
 
 "A domain site with the authentic logo was sent," Beharry told reporters. "The individual asked us to change banking information from the vendor. That information was changed." 
 
 Advanced Education Minister Marlin Schmidt said in a statement he found it unacceptable that the university fell victim to this scam. 
 
 He's asked the chair of MacEwan's board of directors to report by Sept. 15 about how this could have happened. 
 
 "While I'm told that MacEwan has put improved internal financial controls to help prevent it from happening again, I expect post-secondary institutions to do better to protect public dollars against fraud," Schmidt said in a statement. 
 
 "That's why I've instructed all board chairs to review their current financial controls." 
 
 The president of MacEwan University, Deborah Saucier, was not available to comment. 
 
 Authorities notified 
 
 The university described the fraud as a "phishing attack." 
 
 The Canadian Anti-Fraud Centre says "phishing" refers to internet scammers who use email "lures" to fish for financial data. The scammers create fake emails that look legitimate. The emails are used to trick users into submitting personal, financial or password data. 
 
 Beharry said the fraudsters produced fake emails for 14 construction firms in the Edmonton area. 
 
 When the MacEwan fraud was discovered, the university notified authorities, including the Edmonton Police Service, law-enforcement agencies in Montreal and Hong Kong, and the corporate-security units of banks involved with the electronic transfer of funds. 
 
 The university said it has conducted an interim audit of business processes and has put in controls to prevent further incidents. 
 
 An investigation will determine what permanent business-process controls will be put in place, the university said. 
 
 Its internal audit group has asked outside experts to help in an "extensive multifaceted investigation" that has already started. 
 
 Students reassured 
 
 Final results of the review are expected within a few weeks. 
 
 MacEwan said is has notified "key stakeholders" including the advanced education minister and the auditor general's office. 
 
 Beharry said in the news release that the university wants to assure students that its information technology systems were not compromised. 
 
 "Personal and financial information, and all transactions made with the university are secure. We also want to emphasize that we are working to ensure that this incident will not impact our academic or business operations in any way."
– A university in Canada is the victim of what is being described as one of the biggest known phishing scams ever. MacEwan University in Edmonton discovered the fraud on Aug. 23, when a construction company it works with asked why it had yet to be paid. But the school had made payments to what it thought was the company: $1.9 million on Aug. 10, $22,000 on Aug. 17, and $9.9 million on Aug. 19—a total of $11.8 million to a fraudulent account, with the money eventually being traced to Canada and Hong Kong, reports the CBC. The school has launched a full investigation, but has preliminarily pegged the scam to a series of emails and a website that used the vendor's authentic logo and claimed the vendor had a new bank account. For now, the school says it is down to "human error," where lower-level staffers failed to verify the bank account change was legitimate, so the transfers went to the phony vendor. Canada's advanced education minister issued a statement expressing his disappointment. "This is unacceptable," he says. "I expect post-secondary institutions to do better to protect public dollars against fraud." The loss is 10% of the university's entire annual operating grant from the Alberta government, reports the Edmonton Journal, with a $118 million grant provided in 2015 for the school's $237.1 million budget. One expert calls it the "single largest publicly disclosed amount I've seen" lost to a phishing scam, while noting that private companies may have fallen victim to similar scams but have not been required to disclose the amount lost. MacEwan says its computer systems have not been compromised, per the Toronto Star, and that it expects to recoup the $11.4 million it's managed to trace, though $400,000 remains missing. (Even bank CEOs have been fooled by phishing scams.)