Clark Builders, an Edmonton construction and contracting company, said it was the company fraudsters posed as in the $11.8-million MacEwan University phishing scam.
“We’re not pleased with the fact that somebody was fraudulently using our logo and our brand and our information,” Clark Builders president and CEO Paul Verhesen said Friday.
On Thursday, MacEwan University revealed it was defrauded of $11.8 million in an online scam. The university said a company posing as Clark Builders – a company the university has worked with for more than a decade – sent a series of fraudulent emails to the university that “convinced university staff to change electronic banking information for one of the university’s major vendors.”
Three separate payments, ranging from $22,000 to $9.9 million, were made to the fraudsters between Aug. 10 and Aug. 19. More than $11.4 million has been traced to accounts in Canada and Hong Kong. The university said the funds have been frozen while it works with lawyers in an attempt to recover the money.
The remaining $400,000 is still unaccounted for.
The Edmonton Police Service said it became involved in the investigation on Aug. 24. Police said the MacEwan incident appears to be part of a “much larger BEC scam.” BEC, or Business Email Compromise, scams are typically conducted in two ways, police said:
- A request to change an account payable for a vendor
- An e-mail is received from an executive requesting a rush wire transfer. In a rush wire transfer request, employees are typically contacted when the executive is away and the messaging implies urgency, suggesting they are unavailable by telephone.
READ MORE: MacEwan University defrauded of nearly $12M in phishing scam
Verhesen said Clark Builders has a very good relationship with MacEwan and contacted the university when it missed a payment.
“They’ve always been very diligent in paying their bills on time so that’s how we became aware of it,” Verhesen said. “Our project team was wondering why we weren’t getting paid, because it was very uncharacteristic of MacEwan to do that.”
Verhesen said the company came forward to make its name known publicly as a way to alert other companies of the dangers of online scams.
“There are people out there who are fraudulently trying to defraud businesses and individuals. So the message is: we should all be way more diligent in how we conduct business and transfer money and information.
“It’s a powerful lesson for all of us to learn.”
Watch below: MacEwan University spokesperson David Beharry said an $11.8-million phishing scam came down to “human error.” He said three relatively low-level staff were involved.
Clark Builders got in contact with all of its clients, suppliers and subtrades to make them aware of the situation.
“There’s other contractors that have been targeted, as well, so it’s an industry-wide awareness piece,” he said.
“It’s to create awareness for our industry and for people in general. It’s unfortunate what happened with MacEwan and the human error that happened, but we’re all human and we’re all capable of making mistakes. So if you create some awareness around it, the chances of making that mistake are less.”
Verhesen said Clark Builders has reiterated its cybersecurity policies with employees. He’s pleased with the way MacEwan University has responded to the situation.
“How they’ve handled this has been very professional, very collaborative; they’ve kept us informed all along. We’ve been working, as they have, with the authorities to try to mitigate the damage,” he said. “It’s a bad situation but it’s been handled very well.”
READ MORE: Top 10 scams of 2016 reveal Canadians lost more than $90M last year
CompuVision, an Edmonton IT company, said online scams are on the rise at a rapid pace and criminals are becoming more successful.
“It’s become so compelling in regards to day-to-day life — it’s your lawyer, it’s your accountant, it’s your construction company,” CEO Ryan Vestby said. “These people are gathering this information and creating aliases that look so, so similar that you wouldn’t know unless you were actually looking for those changes.”
Vestby said it’s not enough to just educate businesses and employees on these types of scams — they need to be tested.
“It’s one thing to educate,” he said. “The challenge is, it just becomes noise if no one is testing it… Where the impact happens is when you actually educate, test, repeat.”
Vestby said his company works with businesses and will actually send out “ethical phishing” scams to see how many employees will click on the links. There is no notice when these emails will come out and they look identical to actual phishing scams.
“It’s not about reprimanding employees, it’s just about educating them, because obviously there was something compelling enough in that email… that was worth it for them to click on.”
Vestby said in this day and age, every business should have cyber insurance.
READ MORE: Surge in demand from companies seeking cyber attack insurance
The Canadian Anti-Fraud Centre categorizes this type of scam as wire fraud. In 2016, Canadians lost nearly $12.9 million to wire fraud.
The advanced education minister has instructed all university board chairs to review their financial controls.