11 ms·

A fraudster got $12M out of a Canadian university

130 points by endorphone 8y ago

cknoxrun 8y ago
This seems like a technology problem, not a personnel problem. There should be more checks in a system when you are changing bank accounts where so much money is going to be deposited.
- swoorup 8y ago
  Really? It is pretty obvious that it is social engineering. Can't you check the email domain?
  - sjroot 8y ago
    From the article: the email was spoofed to appear to be from the building company.
    - bt3 8y ago
      You can see in the screenshot (scan of the email) it was a low-tech spoof. They simply bought the same domain with a different TLD (.com vs .us) There were many red flags that weren't caught, this being one of them.
      - sjroot 8y ago
        Yeah, there is a lot of UX work that could be done to address this. For example, a "HTTPS green lock" equivalent for ongoing email conversations.
- thieving_magpie 8y ago
  It's a multifaceted problem. Certainly a social engineering problem here. I think anyone that's ever seen how an ACH file works would agree there's room to improve on the technology side.
  - paulie_a 8y ago
    I think anyone that has ever seen an ACH file and how it is transferred and processed should be amazed capitalism even exists.
- danso 8y ago
  Seems like it should be more of a process and personnel problem, and one that should account for the problem of social engineering. > As a result, one particular email, sent June 27, didn’t set off any alarms. Sent by a James Ellis of Clark Builders, a construction company working on the project, the email opened with the affable “Hiya” before asking the school’s accounts receivable department to reroute payments to a new National Bank of Canada account. The order to change bank accounts should not have been trusted without another factor of authorization, such as a phone call (from the CFO's office) or an in-person confirmation. Yes, a software solution could be implemented to enforce this process, but that doesn't seem worth the time or effort and provides yet another vector of attack. The university, being a public institution, likely already has a legacy system of paperwork and manual processes. It should be less work to enforce existing rules or add an old-fashioned verification step than to build a new software system. Especially for something as rare as changing bank account numbers. edit: at the end of the article, it seems that the university's solution has indeed been to go for old-fashioned verification: > Employees are now required to verify all changes to vendor files by phone and a followup email, and all financial changes must first be reviewed by a supervisor, manager or director. A supplied audit report system was also implemented, tracking every change made to vendor files. The university has made employee training in social engineering attacks, phishing and other online scams mandatory. I think the social engineering training is key, though. An employee could still follow the above rules and still be fooled, based on the letter used in the phishing attack: https://www.thestar.com/content/dam/thestar/edmonton/2018/10/09/how-a-fraudster-got-12-million-out-of-a-canadian-university-they-just-asked-for-it/_20181001141124982_1_.jpg https://www.thestar.com/content/dam/thestar/edmonton/2018/10... I'm assuming a supervisor or manager don't have a special ability to know the vendor's actual financial details, and thus a "review" may be little more than a rubber stamp. What's key is that the office person fielding the request not only use a second form of authentication -- such as a phone call -- but that they call the number as recorded on university file and not the phone number listed in the spoofed email.
  - rahimnathwani 8y ago
    "such as a phone call (from the CFO's office)" Caller ID is trivial to spoof. What you want is a phone call to the CFO's office, not from.
- aaroninsf 8y ago
  The "so much" part doesn't matter to the person doing the paperwork change. It's just numbers to them and what they do between lunch and leaving. One small part of why the social hack worked well.
- rwmj 8y ago
  This scam has been going on in the UK for a few years. It's called "authorised push payment (APP) fraud". Typically you're having some building work done (or any other large project or purchase), and an email will arrive from the builder saying they've changed their account details, could the purchaser please send future bank transfers to the new account. Of course the email is fraudulent and usually happens because the builder has a virus on their computer (or even the customer). The problems are: * since cheques are no longer in widespread use, the only good way to send money is by a bank transfer to another account; in the UK these are free and nearly instantaneous * but every account is identified only by a 6 digit sort code and 8 digit account number[edit 1]; the numbers don't even have parity checking, forget about any sort of way to verify the destination account * complete insecurity of email and computers in general Finally, after years of foot dragging, the banks are promising they will introduce an "amazing" new feature, where before you do a bank transfer the name (I think surname only) of the account holder will be displayed. This should, when it finally arrives next year, prevent most of these frauds, although I guess the scammers will quickly adapt. The fraud: https://www.theguardian.com/money/2018/sep/25/uk-bank-customers-lost-500m-to-scams-in-first-half-of-2018 https://www.theguardian.com/money/2018/sep/25/uk-bank-custom... How the banks propose to solve it: https://www.psr.org.uk/psr-publications/consultations/APP-scams-report-and-consultation-Nov-2017 https://www.psr.org.uk/psr-publications/consultations/APP-sc... [edit 1] True story to illustrate what a shitshow this is: When I started working for my current company they asked for my 6 digit sort code and 8 digit account number to pay my salary in. However the first payment was bounced by the bank. When my employer checked with me, it turned out they had only entered the first 7 digits of my account number into the payments system. Surprisingly this was not an error. For example say my a/c number is 12345678, they entered 1234567, and the system assumed that meant 01234567 (this is a feature of all UK banks, not something to do with the payroll, because bank accounts are really just natural numbers, the first customer is given bank account number 1, etc.) Luckily the 01234567 account was dormant or closed so the payment was returned, otherwise several people would have had a bad day (and one person a good day).
  - tacostakohashi 8y ago
    As much as people make fun of the widespread use of checks in the US, it actually seems much better for this use case, for at least two reasons: 1) the check will be handed over in person to someone you've met before, or at least mailed to a known postal address which is harder to spoof than email. 2) If you present a check for $12m to a bank, it will get the scrutiny it deserves, and won't clear immediately.
sjroot 8y ago
Apologies if it was mentioned in the article, but I am curious as to how the original attacker acquired the information needed for spear phishing. I suppose business dealings between the university and contractors is public to some extent, but it seems plausible that this attack came from within the university or the contractor.
- crescentfresh 8y ago
  This was the real breach. Bank account numbers, company letterhead, the CFO's signature, these were all gathered before any attack took place!
  - bt3 8y ago
    Bank account numbers weren't leaked - the scammers simply requested the payments be rerouted to a different account. The letterhead could likely be easily reverse engineered, and I doubt the University rep knew what to look for, and the CFO's signature also doesn't carry any weight - any decent signature font could duplicate that signature (especially a digital one). I agree with the original comment - how did these scammers gain the knowledge that these transactions were ongoing, and know exactly who to target?
    - scott_s 8y ago
      If you know that a university is doing construction, then you know they're paying someone. It's not hard to know a university is doing construction because it will be reported on, they will have had to gain permission to do so, and you can just drive by and see the construction. Once you know that, then you just need to figure out the name of the companies involved. That should be simple: often construction companies will put up a sign, or you can just ask some people on site. That's assuming no prior knowledge, in which case it would be even easier.
- danso 8y ago
  The university in question in a public institution. All of that info -- including copies of signed paperwork, names of officials, and ongoing contracts -- is likely available as public records.
neom 8y ago
As a side note, this is really great journalism.
walrus01 8y ago
This is why all staff, whether at a corporation, nonprofit or government that handle money should be put through a two hour anti-phishing training course. There's lots of good free training material out there. There are also services which you can hire. You give them a list of staff emails, and they send test phishes to everyone. Those who respond or click on links (there's a GUID in each phish) can be sent for further remedial training. As a person that's been seeing and analyzing spurious SMTP traffic since 1993, this stuff seems obvious, but there's a lot of blithely ignorant people out there in administrative roles.
- scott_s 8y ago
  While I think everyone should be aware of phishing, I don't think any amount of education can reliably prevent this sort of fraud. I see this fundamentally as a process problem, as I assume email was a common way of changing payment information. Email needs to be taken out of the loop.
  - r00fus 8y ago
    > I don't think any amount of education can reliably prevent this sort of fraud. The (possibly remedial) education isn't to prevent the fraud, it's to make your population more resistant to it. At some point in the far future if it's part of basic education courses, then we may create herd inoculation effect where phishing fraud may become unprofitable enough to further depress likelihood (like highway banditry of days yore). Email will never go away - it will always be some part of the payment process even if it's just remittance. It's too ubiquitous.
  - badrequest 8y ago
    I wonder if GPG could have ensured this didn't happen.
    - HarryHirsch 8y ago
      When you use Microsoft Safelinks URL rewriter you preclude cryptographic signing. The Safelinks crap is just crap, it obfuscates URLs and you can't sign your messages any longer.
ig1 8y ago
I'd love to fund a startup fixing this problem. It's a clear space where technology has the edge over humans and there's huge network advantages (e.g. you see a new account # for a known entity, especially at a different bank it's a big red flag).
- charlietango92 8y ago
  there has to be offerings already out there that address that kind of thing, but maybe not. Either way, I agree, tech has the clear edge on this, so long as the rulesets (or whatever parameters are defined) are correct.
  - deepGem 8y ago
    Every major fraud vendor has an AML offering. Be it SAS or FICO or startups such as Feedzai. I am building a startup as well but it is hard to determine how effective these products are. Till date I haven't found data that shows how many money laundering cases were caught by these products and how many of those cases were prosecuted. It's not a very transparent industry, so it's super hard to take on the incumbents. This is just based on a few weeks of conversations I've had with some AML and strategy team members, so by no means this is a generalization.
- eswat 8y ago
  In particular, this kind of low-tech spoofing could have been mitigated if the email client had highlighted the fact that the sender’s “name” was nearly identical to the sending address, and therefore likely a phishing email.
  - deepGem 8y ago
    This seems quite simple to accomplish - compare the name and email address in the email header and flag based on even regex matches/mismatches. Perhaps a Chrome plugin for gmail to test out ?
- grecy 8y ago
  > I'd love to fund a startup fixing this problem I know a great way you can get the funding you need....
Scoundreller 8y ago
> Yangjiang City Jixie Zhulu Engineering made four payments to the Mas totalling ¥6.7 million, which would have been worth approximately $1.2 million. In August, Hoi Fu Enterprises received three wire transfers totalling $1 million. Interesting to see that a dollar in Canada is worth 16.7% more than the same dollar in China. And that was for a deal that was too good to be true. I wonder what the real going rate is for getting large amounts of funds out of China.
- walrus01 8y ago
  China has really strict controls on the amount of money that a Chinese citizen can legally wire transfer out of the country, to a foreign domestic bank account, per year. People have come up with all sorts of "creative" grey and black market things involving Vancouver real estate and BC casinos. Google "china money laundering BC" for news about it.
  - deepGem 8y ago
    https://globalnews.ca/news/4149818/vancouver-cautionary-tale-money-laundering-drugs/ https://globalnews.ca/news/4149818/vancouver-cautionary-tale... This is really disturbing.
  - grawprog 8y ago
    Ya....a coworker of mine recently had to return to China to bring his retirement money back to canada. I'm not sure of the details of how he went about doing that. Does the limit apply to physically bringing currency back also? I'd ask my coworker but he doesn't speak English and I don't speak Cantonese.
    - Scoundreller 8y ago
      I understand that there’s a yearly limit on how much you can bring over per person. Lots of evasion tactics: hiring mules to use their limits. finding someone that needs to send money to China, then you can make 2 domestic payments and everything is settled. Buying goods in a China for export, then accepting payment into your western accounts.
Myrmornis 8y ago
> They quickly discovered that while the email appeared to have been sent by “accounts.recievable@clarkbuilders.com” the email address had been “spoofed.” The display name of the email was different than the actual originating account. Um, and it was mis-spelled apparently.
- LocalH 8y ago
  According to this link posted in another thread: https://www.thestar.com/content/dam/thestar/edmonton/2018/10/09/how-a-fraudster-got-12-million-out-of-a-canadian-university-they-just-asked-for-it/_20181001141124982_1_.jpg https://www.thestar.com/content/dam/thestar/edmonton/2018/10... The email was sent containing the email address "accounts.receivable@clarkbuilders.us" and the name field "accounts.receivable@clarkbuilders.com"
drewg123 8y ago
MacEwan was in the midst of constructing the $180-million Allard Hall: a state-of-the-art building boasting music studios and dance halls with room for 1,800 students Why does a college need a building that costs a large fraction of a billion dollars? Early this week we had an article about college education costs being one corner of the "Bermuda triangle" of personal finance. Out of control spending on new, shiny things is part of the problem, I think.
- minikites 8y ago
  >Why does a college need a building that costs a large fraction of a billion dollars? It's the end result of applying capitalism to all human activities. Schools have to compete for students and they do so with activities that prospective students and parents will respond to. It's also why health care costs are higher when privatized, they're similar "markets".
  - rthomas6 8y ago
    That's part of the reason. But why do costs go down for some things and up for other things when capitalism is applied? Because some markets' demand, like education and the current healthcare market, is not sensitive to price.
  - wongarsu 8y ago
    >It's the end result of applying capitalism to all human activities. I would argue both extremes work: free education works (see Europe), completely capitalistic education should also work. But America doesn't apply captitalism to education. Schools have all the pressure of competition you describe, but normally the lifetime profitability of gaining a degree as would put a reasonable ceiling on education costs (outside of elite institutions for the rich and gifted). But in the US, student loans with their subsidies and special legal status remove monetary restrictions from the market, allowing most people to pay whatever the schools ask for. And for the supply side of any capitalist market it is only rational to raise prices to what the market is willing and able to pay. In a free, unsubsidized, unpriviledged market for student loans we wouldn't see massivley rising education costs. Social mobility might be even worse though, so free education is likely still superiour.
PaulHoule 8y ago
I get incomprehensible bills from the hospital whenever I get a test or see a physical therapist, etc. Sometimes I get bills about a service that happened 2 years ago, don't remember what the service was, and it seems they can't tell me because that would violate my privacy or something. I've always wondered if I sent an invoice to the hospital for unspecified services if they'd pay it.
- tialaramex 8y ago
  Possibly. I worked for university accounting many, many years ago. We paid late. Ninety day terms and then maybe we'd forget to pay your invoice for a whole month, oops. And for little one man engineering outfits supplying the science department I was working in this was life-or-death stuff, because you know they've bought those materials on credit, they've done all the work, and then you haven't even the decency to pay on time. They'd phone up, so desperate for their money and I felt really bad for them saying I can't make it happen, some guy I've never met controls actually paying them. But for a huge chain store, they don't put up with any of that nonsense. Our department as well as all this sophisticated hand-made one-off stuff had bought a dish washer for some project, ordinary dish washer from a famous high street store. The university didn't pay them on time. So they immediately sent a bill for the cost of sending an overdue letter, plus interest. We paid that. So that's the lesson to all those little engineering firms, if you have the balls to do it. Just send "Payment overdue" notices with a new additional invoice and that'll go in the same "Paid eventually but not on time" pile and it'll get paid. You won't get paid faster, but maybe the extra money helps take the sting off a bit.
- JumpCrisscross 8y ago
  > they can't tell me because that would violate my privacy or something If someone can't tell you why you owe a bill, don't pay it. If they can't tell you, they can't tell a court.
  - Wingman4l7 8y ago
    The thing is, they probably could tell the court, if it came to that (nevermind that most people couldn't afford the time or money to take it that far). Just because someone isn't being candid about why you owe them money, doesn't mean you don't still technically owe them money in a way that can be proven. I don't know if a judge would have the discretion to waive a debt that wasn't fairly "divulged".
nerdponx 8y ago
They quickly discovered that while the email appeared to have been sent by “accounts.recievable@clarkbuilders.com” the email address had been “spoofed.” The display name of the email was different than the actual originating account. Isn't this glaring security issue trivially fixable from the perspective of an email client developer?
- wmf 8y ago
  No, because SMTP "accounts" are trivially spoofable as well. (Edit: Although you wouldn't want to spoof that if you need to get replies, so maybe there is something the client can do here.) Maybe you could try to do some kind of trust-on-first-use on the chain of Received headers but that's going to generate false positives.
  - endorphone 8y ago
    We do have several solutions in place for that, though. SPF, DKIM, among others. If this University were running on gmail I suspect this email would have been flagged for phishing (the builder did publish an SPF record), or outright rejected. However they run their own email servers[1]. [1] - They could of course do the same checks and even more, but among self-hosted installs it is common to disregard those additional securities.
    - nerdponx 8y ago
      What about PGP? No signature, immediate red flag.
mduncs 8y ago
Is there a reason the submission titles are altered away from the articles?
kevmo 8y ago
"Fake it til you make it" is real.
browsercoin 8y ago
steal money from Canadian university and buy real estate in Vancouver...only in BC folks
pythonaut_16 8y ago
This seems like a place where physical security keys could've be useful. Any invoice would be expected to be signed using a physical security key. The University or a trusted third party would have a list of vendor keys, signed by the university's master key. Any request to change account details or for payments would require a new signed invoice. Then any user receiving such an email could easily see if the invoice had been signed by a person who can cryptographically prove they have a key that is trusted to be in the vendor's possession.
- nerdponx 8y ago
  What about PGP?
olalonde 8y ago
Did they ever find out who the masterminds were and were they charged criminally? I couldn't tell from the article.
- 3p0ch 8y ago
  I believe one unnamed person in China was caught with $5 million or so; but $960,000 CAD was still missing; so maybe not? Even if they only walked away with 8% of the total originally 'stolen', that's still pretty damn good. Plus, it would probably bring the heat off of you. The investigators and the university get to say 'we successfully recovered 92% of it!' because that makes a great headline where 'justice was served' and have the case take a lower priority.
JumpCrisscross 8y ago
> while the email appeared to have been sent by “accounts.recievable@clarkbuilders.com” the email address had been “spoofed.” That's not how you spell "receivable."
forkLding 8y ago
This is more common than you expect, a friend's company recently suffered a Business Email Compromise where their clientele were emailed and sent invoices to the hackers' bank accounts instead of the actual company's bank account. Email is definitely a unsafe way to send messages.
axilmar 8y ago
The technical solution is easy and it is the same solution as when we make bank transactions online: one time pin codes. If another company wants you to send payments to another bank account, then you mail back the received pin code to that other company via another known email account. If the known email account responds that the pin is legit, then go ahead and change the payment details. Also, before changing the payment details, do send a small amount first, have it confirmed with the other company and then proceed with the test of the payment.

130 points by endorphone 8y ago

This seems like a technology problem, not a personnel problem. There should be more checks in a system when you are changing bank accounts where so much money is going to be deposited.

swoorup 8y ago
Really? It is pretty obvious that it is social engineering. Can't you check the email domain?
- sjroot 8y ago
  From the article: the email was spoofed to appear to be from the building company.
  - bt3 8y ago
    You can see in the screenshot (scan of the email) it was a low-tech spoof. They simply bought the same domain with a different TLD (.com vs .us) There were many red flags that weren't caught, this being one of them.
    - sjroot 8y ago
      Yeah, there is a lot of UX work that could be done to address this. For example, a "HTTPS green lock" equivalent for ongoing email conversations.
thieving_magpie 8y ago
It's a multifaceted problem. Certainly a social engineering problem here. I think anyone that's ever seen how an ACH file works would agree there's room to improve on the technology side.
- paulie_a 8y ago
  I think anyone that has ever seen an ACH file and how it is transferred and processed should be amazed capitalism even exists.
danso 8y ago
Seems like it should be more of a process and personnel problem, and one that should account for the problem of social engineering. > As a result, one particular email, sent June 27, didn’t set off any alarms. Sent by a James Ellis of Clark Builders, a construction company working on the project, the email opened with the affable “Hiya” before asking the school’s accounts receivable department to reroute payments to a new National Bank of Canada account. The order to change bank accounts should not have been trusted without another factor of authorization, such as a phone call (from the CFO's office) or an in-person confirmation. Yes, a software solution could be implemented to enforce this process, but that doesn't seem worth the time or effort and provides yet another vector of attack. The university, being a public institution, likely already has a legacy system of paperwork and manual processes. It should be less work to enforce existing rules or add an old-fashioned verification step than to build a new software system. Especially for something as rare as changing bank account numbers. edit: at the end of the article, it seems that the university's solution has indeed been to go for old-fashioned verification: > Employees are now required to verify all changes to vendor files by phone and a followup email, and all financial changes must first be reviewed by a supervisor, manager or director. A supplied audit report system was also implemented, tracking every change made to vendor files. The university has made employee training in social engineering attacks, phishing and other online scams mandatory. I think the social engineering training is key, though. An employee could still follow the above rules and still be fooled, based on the letter used in the phishing attack: https://www.thestar.com/content/dam/thestar/edmonton/2018/10/09/how-a-fraudster-got-12-million-out-of-a-canadian-university-they-just-asked-for-it/_20181001141124982_1_.jpg https://www.thestar.com/content/dam/thestar/edmonton/2018/10... I'm assuming a supervisor or manager don't have a special ability to know the vendor's actual financial details, and thus a "review" may be little more than a rubber stamp. What's key is that the office person fielding the request not only use a second form of authentication -- such as a phone call -- but that they call the number as recorded on university file and not the phone number listed in the spoofed email.
- rahimnathwani 8y ago
  "such as a phone call (from the CFO's office)" Caller ID is trivial to spoof. What you want is a phone call to the CFO's office, not from.
aaroninsf 8y ago
The "so much" part doesn't matter to the person doing the paperwork change. It's just numbers to them and what they do between lunch and leaving. One small part of why the social hack worked well.
rwmj 8y ago
This scam has been going on in the UK for a few years. It's called "authorised push payment (APP) fraud". Typically you're having some building work done (or any other large project or purchase), and an email will arrive from the builder saying they've changed their account details, could the purchaser please send future bank transfers to the new account. Of course the email is fraudulent and usually happens because the builder has a virus on their computer (or even the customer). The problems are: * since cheques are no longer in widespread use, the only good way to send money is by a bank transfer to another account; in the UK these are free and nearly instantaneous * but every account is identified only by a 6 digit sort code and 8 digit account number[edit 1]; the numbers don't even have parity checking, forget about any sort of way to verify the destination account * complete insecurity of email and computers in general Finally, after years of foot dragging, the banks are promising they will introduce an "amazing" new feature, where before you do a bank transfer the name (I think surname only) of the account holder will be displayed. This should, when it finally arrives next year, prevent most of these frauds, although I guess the scammers will quickly adapt. The fraud: https://www.theguardian.com/money/2018/sep/25/uk-bank-customers-lost-500m-to-scams-in-first-half-of-2018 https://www.theguardian.com/money/2018/sep/25/uk-bank-custom... How the banks propose to solve it: https://www.psr.org.uk/psr-publications/consultations/APP-scams-report-and-consultation-Nov-2017 https://www.psr.org.uk/psr-publications/consultations/APP-sc... [edit 1] True story to illustrate what a shitshow this is: When I started working for my current company they asked for my 6 digit sort code and 8 digit account number to pay my salary in. However the first payment was bounced by the bank. When my employer checked with me, it turned out they had only entered the first 7 digits of my account number into the payments system. Surprisingly this was not an error. For example say my a/c number is 12345678, they entered 1234567, and the system assumed that meant 01234567 (this is a feature of all UK banks, not something to do with the payroll, because bank accounts are really just natural numbers, the first customer is given bank account number 1, etc.) Luckily the 01234567 account was dormant or closed so the payment was returned, otherwise several people would have had a bad day (and one person a good day).
- tacostakohashi 8y ago
  As much as people make fun of the widespread use of checks in the US, it actually seems much better for this use case, for at least two reasons: 1) the check will be handed over in person to someone you've met before, or at least mailed to a known postal address which is harder to spoof than email. 2) If you present a check for $12m to a bank, it will get the scrutiny it deserves, and won't clear immediately.

sjroot 8y ago

Apologies if it was mentioned in the article, but I am curious as to how the original attacker acquired the information needed for spear phishing. I suppose business dealings between the university and contractors is public to some extent, but it seems plausible that this attack came from within the university or the contractor.

crescentfresh 8y ago
This was the real breach. Bank account numbers, company letterhead, the CFO's signature, these were all gathered before any attack took place!
- bt3 8y ago
  Bank account numbers weren't leaked - the scammers simply requested the payments be rerouted to a different account. The letterhead could likely be easily reverse engineered, and I doubt the University rep knew what to look for, and the CFO's signature also doesn't carry any weight - any decent signature font could duplicate that signature (especially a digital one). I agree with the original comment - how did these scammers gain the knowledge that these transactions were ongoing, and know exactly who to target?
  - scott_s 8y ago
    If you know that a university is doing construction, then you know they're paying someone. It's not hard to know a university is doing construction because it will be reported on, they will have had to gain permission to do so, and you can just drive by and see the construction. Once you know that, then you just need to figure out the name of the companies involved. That should be simple: often construction companies will put up a sign, or you can just ask some people on site. That's assuming no prior knowledge, in which case it would be even easier.
danso 8y ago
The university in question in a public institution. All of that info -- including copies of signed paperwork, names of officials, and ongoing contracts -- is likely available as public records.

neom 8y ago

As a side note, this is really great journalism.

walrus01 8y ago

This is why all staff, whether at a corporation, nonprofit or government that handle money should be put through a two hour anti-phishing training course. There's lots of good free training material out there. There are also services which you can hire. You give them a list of staff emails, and they send test phishes to everyone. Those who respond or click on links (there's a GUID in each phish) can be sent for further remedial training. As a person that's been seeing and analyzing spurious SMTP traffic since 1993, this stuff seems obvious, but there's a lot of blithely ignorant people out there in administrative roles.

scott_s 8y ago
While I think everyone should be aware of phishing, I don't think any amount of education can reliably prevent this sort of fraud. I see this fundamentally as a process problem, as I assume email was a common way of changing payment information. Email needs to be taken out of the loop.
- r00fus 8y ago
  > I don't think any amount of education can reliably prevent this sort of fraud. The (possibly remedial) education isn't to prevent the fraud, it's to make your population more resistant to it. At some point in the far future if it's part of basic education courses, then we may create herd inoculation effect where phishing fraud may become unprofitable enough to further depress likelihood (like highway banditry of days yore). Email will never go away - it will always be some part of the payment process even if it's just remittance. It's too ubiquitous.
- badrequest 8y ago
  I wonder if GPG could have ensured this didn't happen.
  - HarryHirsch 8y ago
    When you use Microsoft Safelinks URL rewriter you preclude cryptographic signing. The Safelinks crap is just crap, it obfuscates URLs and you can't sign your messages any longer.

ig1 8y ago

I'd love to fund a startup fixing this problem. It's a clear space where technology has the edge over humans and there's huge network advantages (e.g. you see a new account # for a known entity, especially at a different bank it's a big red flag).

charlietango92 8y ago
there has to be offerings already out there that address that kind of thing, but maybe not. Either way, I agree, tech has the clear edge on this, so long as the rulesets (or whatever parameters are defined) are correct.
- deepGem 8y ago
  Every major fraud vendor has an AML offering. Be it SAS or FICO or startups such as Feedzai. I am building a startup as well but it is hard to determine how effective these products are. Till date I haven't found data that shows how many money laundering cases were caught by these products and how many of those cases were prosecuted. It's not a very transparent industry, so it's super hard to take on the incumbents. This is just based on a few weeks of conversations I've had with some AML and strategy team members, so by no means this is a generalization.
eswat 8y ago
In particular, this kind of low-tech spoofing could have been mitigated if the email client had highlighted the fact that the sender’s “name” was nearly identical to the sending address, and therefore likely a phishing email.
- deepGem 8y ago
  This seems quite simple to accomplish - compare the name and email address in the email header and flag based on even regex matches/mismatches. Perhaps a Chrome plugin for gmail to test out ?
grecy 8y ago
> I'd love to fund a startup fixing this problem I know a great way you can get the funding you need....

Scoundreller 8y ago

> Yangjiang City Jixie Zhulu Engineering made four payments to the Mas totalling ¥6.7 million, which would have been worth approximately $1.2 million. In August, Hoi Fu Enterprises received three wire transfers totalling $1 million. Interesting to see that a dollar in Canada is worth 16.7% more than the same dollar in China. And that was for a deal that was too good to be true. I wonder what the real going rate is for getting large amounts of funds out of China.

walrus01 8y ago
China has really strict controls on the amount of money that a Chinese citizen can legally wire transfer out of the country, to a foreign domestic bank account, per year. People have come up with all sorts of "creative" grey and black market things involving Vancouver real estate and BC casinos. Google "china money laundering BC" for news about it.
- deepGem 8y ago
  https://globalnews.ca/news/4149818/vancouver-cautionary-tale-money-laundering-drugs/ https://globalnews.ca/news/4149818/vancouver-cautionary-tale... This is really disturbing.
- grawprog 8y ago
  Ya....a coworker of mine recently had to return to China to bring his retirement money back to canada. I'm not sure of the details of how he went about doing that. Does the limit apply to physically bringing currency back also? I'd ask my coworker but he doesn't speak English and I don't speak Cantonese.
  - Scoundreller 8y ago
    I understand that there’s a yearly limit on how much you can bring over per person. Lots of evasion tactics: hiring mules to use their limits. finding someone that needs to send money to China, then you can make 2 domestic payments and everything is settled. Buying goods in a China for export, then accepting payment into your western accounts.

Myrmornis 8y ago

> They quickly discovered that while the email appeared to have been sent by “accounts.recievable@clarkbuilders.com” the email address had been “spoofed.” The display name of the email was different than the actual originating account. Um, and it was mis-spelled apparently.

LocalH 8y ago
According to this link posted in another thread: https://www.thestar.com/content/dam/thestar/edmonton/2018/10/09/how-a-fraudster-got-12-million-out-of-a-canadian-university-they-just-asked-for-it/_20181001141124982_1_.jpg https://www.thestar.com/content/dam/thestar/edmonton/2018/10... The email was sent containing the email address "accounts.receivable@clarkbuilders.us" and the name field "accounts.receivable@clarkbuilders.com"

drewg123 8y ago

MacEwan was in the midst of constructing the $180-million Allard Hall: a state-of-the-art building boasting music studios and dance halls with room for 1,800 students Why does a college need a building that costs a large fraction of a billion dollars? Early this week we had an article about college education costs being one corner of the "Bermuda triangle" of personal finance. Out of control spending on new, shiny things is part of the problem, I think.

minikites 8y ago
>Why does a college need a building that costs a large fraction of a billion dollars? It's the end result of applying capitalism to all human activities. Schools have to compete for students and they do so with activities that prospective students and parents will respond to. It's also why health care costs are higher when privatized, they're similar "markets".
- rthomas6 8y ago
  That's part of the reason. But why do costs go down for some things and up for other things when capitalism is applied? Because some markets' demand, like education and the current healthcare market, is not sensitive to price.
- wongarsu 8y ago
  >It's the end result of applying capitalism to all human activities. I would argue both extremes work: free education works (see Europe), completely capitalistic education should also work. But America doesn't apply captitalism to education. Schools have all the pressure of competition you describe, but normally the lifetime profitability of gaining a degree as would put a reasonable ceiling on education costs (outside of elite institutions for the rich and gifted). But in the US, student loans with their subsidies and special legal status remove monetary restrictions from the market, allowing most people to pay whatever the schools ask for. And for the supply side of any capitalist market it is only rational to raise prices to what the market is willing and able to pay. In a free, unsubsidized, unpriviledged market for student loans we wouldn't see massivley rising education costs. Social mobility might be even worse though, so free education is likely still superiour.

PaulHoule 8y ago

I get incomprehensible bills from the hospital whenever I get a test or see a physical therapist, etc. Sometimes I get bills about a service that happened 2 years ago, don't remember what the service was, and it seems they can't tell me because that would violate my privacy or something. I've always wondered if I sent an invoice to the hospital for unspecified services if they'd pay it.

tialaramex 8y ago
Possibly. I worked for university accounting many, many years ago. We paid late. Ninety day terms and then maybe we'd forget to pay your invoice for a whole month, oops. And for little one man engineering outfits supplying the science department I was working in this was life-or-death stuff, because you know they've bought those materials on credit, they've done all the work, and then you haven't even the decency to pay on time. They'd phone up, so desperate for their money and I felt really bad for them saying I can't make it happen, some guy I've never met controls actually paying them. But for a huge chain store, they don't put up with any of that nonsense. Our department as well as all this sophisticated hand-made one-off stuff had bought a dish washer for some project, ordinary dish washer from a famous high street store. The university didn't pay them on time. So they immediately sent a bill for the cost of sending an overdue letter, plus interest. We paid that. So that's the lesson to all those little engineering firms, if you have the balls to do it. Just send "Payment overdue" notices with a new additional invoice and that'll go in the same "Paid eventually but not on time" pile and it'll get paid. You won't get paid faster, but maybe the extra money helps take the sting off a bit.
JumpCrisscross 8y ago
> they can't tell me because that would violate my privacy or something If someone can't tell you why you owe a bill, don't pay it. If they can't tell you, they can't tell a court.
- Wingman4l7 8y ago
  The thing is, they probably could tell the court, if it came to that (nevermind that most people couldn't afford the time or money to take it that far). Just because someone isn't being candid about why you owe them money, doesn't mean you don't still technically owe them money in a way that can be proven. I don't know if a judge would have the discretion to waive a debt that wasn't fairly "divulged".

nerdponx 8y ago

They quickly discovered that while the email appeared to have been sent by “accounts.recievable@clarkbuilders.com” the email address had been “spoofed.” The display name of the email was different than the actual originating account. Isn't this glaring security issue trivially fixable from the perspective of an email client developer?

wmf 8y ago
No, because SMTP "accounts" are trivially spoofable as well. (Edit: Although you wouldn't want to spoof that if you need to get replies, so maybe there is something the client can do here.) Maybe you could try to do some kind of trust-on-first-use on the chain of Received headers but that's going to generate false positives.
- endorphone 8y ago
  We do have several solutions in place for that, though. SPF, DKIM, among others. If this University were running on gmail I suspect this email would have been flagged for phishing (the builder did publish an SPF record), or outright rejected. However they run their own email servers[1]. [1] - They could of course do the same checks and even more, but among self-hosted installs it is common to disregard those additional securities.
  - nerdponx 8y ago
    What about PGP? No signature, immediate red flag.

mduncs 8y ago

Is there a reason the submission titles are altered away from the articles?

kevmo 8y ago

"Fake it til you make it" is real.

browsercoin 8y ago

steal money from Canadian university and buy real estate in Vancouver...only in BC folks

pythonaut_16 8y ago

This seems like a place where physical security keys could've be useful. Any invoice would be expected to be signed using a physical security key. The University or a trusted third party would have a list of vendor keys, signed by the university's master key. Any request to change account details or for payments would require a new signed invoice. Then any user receiving such an email could easily see if the invoice had been signed by a person who can cryptographically prove they have a key that is trusted to be in the vendor's possession.

nerdponx 8y ago
What about PGP?

olalonde 8y ago

Did they ever find out who the masterminds were and were they charged criminally? I couldn't tell from the article.

3p0ch 8y ago
I believe one unnamed person in China was caught with $5 million or so; but $960,000 CAD was still missing; so maybe not? Even if they only walked away with 8% of the total originally 'stolen', that's still pretty damn good. Plus, it would probably bring the heat off of you. The investigators and the university get to say 'we successfully recovered 92% of it!' because that makes a great headline where 'justice was served' and have the case take a lower priority.

JumpCrisscross 8y ago

> while the email appeared to have been sent by “accounts.recievable@clarkbuilders.com” the email address had been “spoofed.” That's not how you spell "receivable."

forkLding 8y ago

This is more common than you expect, a friend's company recently suffered a Business Email Compromise where their clientele were emailed and sent invoices to the hackers' bank accounts instead of the actual company's bank account. Email is definitely a unsafe way to send messages.

axilmar 8y ago

The technical solution is easy and it is the same solution as when we make bank transactions online: one time pin codes. If another company wants you to send payments to another bank account, then you mail back the received pin code to that other company via another known email account. If the known email account responds that the pin is legit, then go ahead and change the payment details. Also, before changing the payment details, do send a small amount first, have it confirmed with the other company and then proceed with the test of the payment.