A Canadian city falls victim to $558K spear phishing scam

Introduction to the case

Fraudsters hack a not-for-profit to solicit funds from a municipal government

The municipal government of a Canadian city was scammed out of more than half a million dollars after a phishing email tricked a staff member into changing banking information to redirect funds into the fraudsters’ account. 

The fraudsters had hacked the email account of a not-for-profit organization (NPO) that received funding from the city. They also forged bank letters and used a fake domain name to mislead city staff. 

Luckily, this phishing scam has a happy ending.

How did the fraudsters commit the crime?

The fraudsters used several tactics to make their outreach appear legitimate: 

• They registered a fake domain that was very similar to the NPO’s official domain.
• The email sent to the city’s funding coordinator copied two other high-ranking executives at the NPO. Both email addresses used the fake domain and looked very “official”.
• The fraudulent email also included an attachment with a fake letterhead made to look like a letter from the NPO’s bank and signed by the head of treasury management services.

After sending several follow-up emails from (purportedly) the NPO’s executive director, the fraudsters convinced the city to change the banking information it had on file for the NPO and electronically wire half a million dollars to the fraudulent bank account. The city executed the transaction believing it was transferring funds to the NPO’s legitimate bank account.

What was the outcome?

The city noticed irregularities in its payments to the NPO on April 11 and took immediate action. It notified the police about the fraud incident and directed its bank to cancel the transfer. The bank quickly placed a hold on the receiving account, but the transaction had already been completed. The city also launched an internal investigation and notified city council of the breach.

To recover the funds, the city filed a court claim naming several Canadian banks as defendants. An emergency motion led to a court order requiring the banks to trace the funds and put a temporary freeze on any accounts where the money was deposited. By April 22, the city had recovered more than 90% of the funds and subsequently recovered the entire amount.

To expedite the recovery process, the city hired outside legal counsel for support.