A fraudster got $12M out of a Canadian university • Hacker News Board

Re: A fraudster got $12M out of a Canadian university

#21

Post by scott_s » Wed, Oct 10, 2018, 5:36 PM UTC

walrus01 wrote: post #14

This is why all staff, whether at a corporation, nonprofit or government that handle money should be put through a two hour anti-phishing training course. There's lots of good free training material out there. There are also services which you can hire. You give them a list of staff emails, and they send test phishes to everyone. Those who respond or click on links (there's a GUID in each phish) can be sent for furth…

While I think everyone should be aware of phishing, I don't think any amount of education can reliably prevent this sort of fraud. I see this fundamentally as a process problem, as I assume email was a common way of changing payment information. Email needs to be taken out of the loop.

Re: A fraudster got $12M out of a Canadian university

#22

Post by fwr » Wed, Oct 10, 2018, 5:36 PM UTC

walrus01 wrote: post #14

This is why all staff, whether at a corporation, nonprofit or government that handle money should be put through a two hour anti-phishing training course. There's lots of good free training material out there. There are also services which you can hire. You give them a list of staff emails, and they send test phishes to everyone. Those who respond or click on links (there's a GUID in each phish) can be sent for furth…

Can you link to some of these materials?

Re: A fraudster got $12M out of a Canadian university

#23

Post by scott_s » Wed, Oct 10, 2018, 5:41 PM UTC

bt3 wrote: post #10

crescentfresh wrote: post #7

Earlier quoted context omitted.

This was the real breach. Bank account numbers, company letterhead, the CFO's signature, these were all gathered before any attack took place!

Bank account numbers weren't leaked - the scammers simply requested the payments be rerouted to a different account. The letterhead could likely be easily reverse engineered, and I doubt the University rep knew what to look for, and the CFO's signature also doesn't carry any weight - any decent signature font could duplicate that signature (especially a digital one). I agree with the original comment - how did these…

If you know that a university is doing construction, then you know they're paying someone. It's not hard to know a university is doing construction because it will be reported on, they will have had to gain permission to do so, and you can just drive by and see the construction. Once you know that, then you just need to figure out the name of the companies involved. That should be simple: often construction companies will put up a sign, or you can just ask some people on site.

That's assuming no prior knowledge, in which case it would be even easier.

Re: A fraudster got $12M out of a Canadian university

#24

Post by deepGem » Wed, Oct 10, 2018, 5:46 PM UTC

walrus01 wrote: post #19

Scoundreller wrote: post #16

> Yangjiang City Jixie Zhulu Engineering made four payments to the Mas totalling ¥6.7 million, which would have been worth approximately $1.2 million. In August, Hoi Fu Enterprises received three wire transfers totalling $1 million. Interesting to see that a dollar in Canada is worth 16.7% more than the same dollar in China. And that was for a deal that was too good to be true. I wonder what the real going rate is fo…

China has really strict controls on the amount of money that a Chinese citizen can legally wire transfer out of the country, to a foreign domestic bank account, per year. People have come up with all sorts of "creative" grey and black market things involving Vancouver real estate and BC casinos. Google "china money laundering BC" for news about it.

https://globalnews.ca/news/4149818/vancouver-cautionary-tale...

This is really disturbing.

Re: A fraudster got $12M out of a Canadian university

#25

Post by eswat » Wed, Oct 10, 2018, 5:54 PM UTC

ig1 wrote: post #15

I'd love to fund a startup fixing this problem. It's a clear space where technology has the edge over humans and there's huge network advantages (e.g. you see a new account # for a known entity, especially at a different bank it's a big red flag).

In particular, this kind of low-tech spoofing could have been mitigated if the email client had highlighted the fact that the sender’s “name” was nearly identical to the sending address, and therefore likely a phishing email.

Re: A fraudster got $12M out of a Canadian university

#26

Post by deepGem » Wed, Oct 10, 2018, 6:02 PM UTC

charlietango92 wrote: post #20

ig1 wrote: post #15

I'd love to fund a startup fixing this problem. It's a clear space where technology has the edge over humans and there's huge network advantages (e.g. you see a new account # for a known entity, especially at a different bank it's a big red flag).

there has to be offerings already out there that address that kind of thing, but maybe not. Either way, I agree, tech has the clear edge on this, so long as the rulesets (or whatever parameters are defined) are correct.

Every major fraud vendor has an AML offering. Be it SAS or FICO or startups such as Feedzai. I am building a startup as well but it is hard to determine how effective these products are. Till date I haven't found data that shows how many money laundering cases were caught by these products and how many of those cases were prosecuted. It's not a very transparent industry, so it's super hard to take on the incumbents. This is just based on a few weeks of conversations I've had with some AML and strategy team members, so by no means this is a generalization.

Re: A fraudster got $12M out of a Canadian university

#27

Post by drewg123 » Wed, Oct 10, 2018, 6:03 PM UTC

MacEwan was in the midst of constructing the $180-million Allard Hall: a state-of-the-art building boasting music studios and dance halls with room for 1,800 students

Why does a college need a building that costs a large fraction of a billion dollars? Early this week we had an article about college education costs being one corner of the "Bermuda triangle" of personal finance. Out of control spending on new, shiny things is part of the problem, I think.

Re: A fraudster got $12M out of a Canadian university

#28

Post by LocalH » Wed, Oct 10, 2018, 6:05 PM UTC

Myrmornis wrote: post #18

> They quickly discovered that while the email appeared to have been sent by “accounts.recievable@clarkbuilders.com” the email address had been “spoofed.” The display name of the email was different than the actual originating account. Um, and it was mis-spelled apparently.

According to this link posted in another thread:

https://www.thestar.com/content/dam/thestar/edmonton/2018/10...

The email was sent containing the email address "accounts.receivable@clarkbuilders.us" and the name field "accounts.receivable@clarkbuilders.com"

Re: A fraudster got $12M out of a Canadian university

#29

Post by deepGem » Wed, Oct 10, 2018, 6:05 PM UTC

eswat wrote: post #25

ig1 wrote: post #15

I'd love to fund a startup fixing this problem. It's a clear space where technology has the edge over humans and there's huge network advantages (e.g. you see a new account # for a known entity, especially at a different bank it's a big red flag).

In particular, this kind of low-tech spoofing could have been mitigated if the email client had highlighted the fact that the sender’s “name” was nearly identical to the sending address, and therefore likely a phishing email.

This seems quite simple to accomplish - compare the name and email address in the email header and flag based on even regex matches/mismatches. Perhaps a Chrome plugin for gmail to test out ?

Re: A fraudster got $12M out of a Canadian university

#30

Post by tacostakohashi » Wed, Oct 10, 2018, 6:11 PM UTC

rwmj wrote: post #17

cknoxrun wrote: post #2

This seems like a technology problem, not a personnel problem. There should be more checks in a system when you are changing bank accounts where so much money is going to be deposited.

This scam has been going on in the UK for a few years. It's called "authorised push payment (APP) fraud". Typically you're having some building work done (or any other large project or purchase), and an email will arrive from the builder saying they've changed their account details, could the purchaser please send future bank transfers to the new account. Of course the email is fraudulent and usually happens because…

As much as people make fun of the widespread use of checks in the US, it actually seems much better for this use case, for at least two reasons:

1) the check will be handed over in person to someone you've met before, or at least mailed to a known postal address which is harder to spoof than email.

2) If you present a check for $12m to a bank, it will get the scrutiny it deserves, and won't clear immediately.