Saskatoon city hall loses over $1 million in phishing scam

Saskatoon city manager Jeff Jorgensen has admitted that the city has lost $1.04 million to a fraudster posing as a construction company’s chief financial officer for weeks. An expert now believes that the money may have been sent overseas and it is possible the city will never see the over $1 million in taxpayer money again.

A news release from the City of Saskatoon reads as follows:

The City of Saskatoon has been affected by a fraud scheme, where a fraudster electronically impersonated the CFO of a construction company and asked for a change of banking information.  The City complied, and as a result, the next contract payment intended to go to that company, $1.04 million, was directed to the fraudster’s bank account.  The fraud was identified on August 12, 2019.

“My understanding of the Saskatoon case [is] they did not catch this quick enough, and the money, if it’s outside the walls of Canada, it is as good as gone,” said Ryan Vestby, CEO of Edmonton-based CompuVision Systems Inc.

“I would almost call [it] a pandemic – a digital pandemic that’s happening where you’re seeing this more and more,” Vestby said when commenting on the frequency and effectiveness of cyber theft.

He says that cyber theft occurs every day, sometimes hourly, in the private sector, only that we don’t usually hear about it because companies are hesitant to admit such embarrassing losses.

According to Global News, it appears that the fraudster used phishing tactics, a kind of online scam, wherein “imposters target a victim, manipulate the victim into providing sensitive information and then use the information to steal money.”

This particular fraudster did just that and added an extra layer of sophistication by specifically posing as the CFO of a prominent construction company to “advise the city of a change in banking information.,” reports the Saskatoon StarPhoenix. To make matters worse, Jorgenson says that the contract with the actual construction company has not been affected by the fraud, and the money owed to that company will still need to be paid.

Jorgenson says that, due to the public nature of most government spending, the fraudster was easily able to identify ongoing city projects and predict when a major transaction would be made. He, then, used this information to get a jump on the actual construction company and request the payment slightly in advance.

Most of the information on the case is still being kept private as investigations are underway.

“As this is an ongoing investigation, the City cannot disclose further details about the fraud at this time.  The City is now notifying the media and the public in an effort to be transparent and also to warn other corporations.  The City will continue to work with and fully cooperate with law enforcement”, said Jorgenson in the news release.

Jorgenson says that, first and foremost, retrieving the money, if at all possible, is at the top of his to-do list.

“So right now, the focus is on the recovery of funds,” Jorgenson told reporters in a Thursday news conference. “The banks are working on it. The police are working on it. We have our internal auditor working on it as well. So that’s where our priority is.”

“It’s a million dollars of taxpayer money,” Mayor Charlie Clark told reporters. He added that he is optimistic about their chances of recovering the money as the fraud was identified relatively quickly.

“The world’s changing quickly. The way that identity theft and the way some of these issues are happening can affect anybody. We are going to make sure it never happens again at the city.”

“The research we’ve done has shown that some agencies were able to recover a significant amount of money, some agencies found it virtually impossible to recover the money,” Jorgenson said. “What I would say is that we’re chasing down every lead, cautiously optimistic that we will be able to recover a significant portion of the funds.”

Jorgenson also mentioned possible revisions to their cybersecurity processes, suggesting that the public nature of city hall may make them particularly vulnerable and proper process must be in place.

“Clearly, the control that was used wasn’t strong enough to prevent (the fraud),” Jorgenson said. “What I would say is internal and external staff who are experts in this area are reviewing all financial processes and controls in this area.”

According to police spokesperson Alyson Edwards, as well as Jorgenson, an internal auditor is now investigating the theft, as are Saskatoon police.

“This incident is a serious criminal matter, and the City is working hard to recover these funds, minimize the opportunities for this to occur in the future, and to cooperate with the police in this investigation,” says Mayor Charlie Clark.