Seems like it should be more of a process and personnel problem, and one that should account for the problem of social engineering. > As a result, one particul

Seems like it should be more of a process and personnel problem, and one that should account for the problem of social engineering. > As a result, one particular email, sent June 27, didn’t set off any alarms. Sent by a James Ellis of Clark Builders, a construction company working on the project, the email opened with the affable “Hiya” before asking the school’s accounts receivable department to reroute payments to a new National Bank of Canada account. The order to change bank accounts should not have been trusted without another factor of authorization, such as a phone call (from the CFO's office) or an in-person confirmation. Yes, a software solution could be implemented to enforce this process, but that doesn't seem worth the time or effort and provides yet another vector of attack. The university, being a public institution, likely already has a legacy system of paperwork and manual processes. It should be less work to enforce existing rules or add an old-fashioned verification step than to build a new software system. Especially for something as rare as changing bank account numbers. edit: at the end of the article, it seems that the university's solution has indeed been to go for old-fashioned verification: > Employees are now required to verify all changes to vendor files by phone and a followup email, and all financial changes must first be reviewed by a supervisor, manager or director. A supplied audit report system was also implemented, tracking every change made to vendor files. The university has made employee training in social engineering attacks, phishing and other online scams mandatory. I think the social engineering training is key, though. An employee could still follow the above rules and still be fooled, based on the letter used in the phishing attack: https://www.thestar.com/content/dam/thestar/edmonton/2018/10/09/how-a-fraudster-got-12-million-out-of-a-canadian-university-they-just-asked-for-it/_20181001141124982_1_.jpg https://www.thestar.com/content/dam/thestar/edmonton/2018/10... I'm assuming a supervisor or manager don't have a special ability to know the vendor's actual financial details, and thus a "review" may be little more than a rubber stamp. What's key is that the office person fielding the request not only use a second form of authentication -- such as a phone call -- but that they call the number as recorded on university file and not the phone number listed in the spoofed email.