Fraudsters hacked the email of a local Salvation Army executive director to trick the City of Ottawa out of $558,233, according to court documents.
The city disclosed the fraud publicly on the Thursday afternoon before the Easter long-weekend but initially didn’t provide details about how the money was lost, only saying a “partnering agency” was targeted.
Ottawa police wouldn’t confirm or deny the existence of an investigation, though the city said it contacted police.
The city’s court claim answers the mystery of how it was hoodwinked out of the money. It involves an email scam targeting the Salvation Army Ottawa Booth Centre, which receives funding from the City of Ottawa.
According to the claim, on or before March 23 the fraudsters hacked the email account of Marc Provost, the executive director of the Booth Centre. At the same time, the fraudsters registered an internet domain name “saocb.org,” similar to the Salvation Army’s real domain, saobc.org.
The fraudsters, now with access to Provost’s email account, sent a message to a City of Ottawa program coordinator for partnerships and funding advising her of a revision to the agency’s billing and remittance system. The email appeared to be copied to two Booth Centre executives, director of programs Michael White and director of finance Darwin Ewert, but their email addresses had the fake domain, the claim says.
Attached to the email was a bogus letter on TD Bank letterhead that appeared to be signed by the head of treasury management services. The letter had payment instructions for an account located at a TD branch in Thornhill, Ont.
According to the claim, “after several following up emails purportedly from Provost, the City of Ottawa made the requested change to the (Booth Centre’s) banking information.”
Using an electronic fund transfer, the city sent $558,233 to the TD account on April 1, believing it was the legitimate Booth Centre account.
On April 11, the fraudsters registered another fake domain, “saocb.com,” to send an email which looked like it came from Provost’s account, but it did not. The fraudsters emailed the city to thank staff for the payment and asked for the account information to be shared to ensure another payment on April 15. The fraudsters continued to impersonate Provost in correspondence with the city on April 14.
The city discovered the fraud on April 12 and contacted its own bank, RBC, the claim says.
Staff learned that Provost’s credentials were used to lot into the Booth Centre’s network from Lagos, Nigeria on April 7, the claim says.
By April 13, RBC told the city that a hold had been placed on the TD account, but the money had been already transferred out.
On April 14, city chief financial officer Wendy Stephanson notified council about the fraudulent transaction. She told the mayor and councillors that staff reported it to the auditor general and Ottawa police. She also said there would be an internal investigation.
The city filed the claim in Toronto Superior Court on Tuesday.
The city named TD Bank, Bank of Nova Scotia, CIBC, Bank of Montreal and RBC as defendants in attempt to freeze the stolen money and have them disclose information to the City of Ottawa. The claim also named a generic ABC Bank to stand in for any other financial institution that received the funds.
On Friday afternoon, Stephanson told council in a memo that an emergency motion led to a court order allowing the funds to be traced. According to Stephanson, the city’s bank said $355,000 was in the process of being returned to the city “and staff anticipate further recovery in the near future.”
The Salvation Army is probing the email hack.
“The Salvation Army Ottawa Booth Centre is aware of the incident and is currently working on an active investigation with the help of third-party experts,” Salvation Army spokesman Glenn van Gulik said in an e-mail on Friday. “The City of Ottawa and Ottawa Police Services have also been made aware. As more information becomes available, our team will act accordingly.”
It’s at least the second time the city has been victimized in an email scam resulting in a six-figure loss.
A former city treasurer fell victim to a “whaling” scam by a man posing as the city manager. A U.S. court heard the Florida man convinced Marian Simulik to send $128,000 to a fake firm in July 2018. The man was convicted and sentenced to twelve and one-half years in prison.