Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A fraudster got $12M out of a Canadian university

thestar.com

Post reply on HN
Print view View original

71–80 of 119 posts

Re: A fraudster got $12M out of a Canadian university

#71

Post by na85 »

scott_s wrote: post #21
walrus01 wrote: post #14

This is why all staff, whether at a corporation, nonprofit or government that handle money should be put through a two hour anti-phishing training course. There's lots of good free training material out there. There are also services which you can hire. You give them a list of staff emails, and they send test phishes to everyone. Those who respond or click on links (there's a GUID in each phish) can be sent for furth…

While I think everyone should be aware of phishing, I don't think any amount of education can reliably prevent this sort of fraud. I see this fundamentally as a process problem, as I assume email was a common way of changing payment information. Email needs to be taken out of the loop.

I disagree. Taking email out of the loop is a technical solution to a problem that is inherently social, not technical.

Re: A fraudster got $12M out of a Canadian university

#72

Post by upofadown »

scott_s wrote: post #21
walrus01 wrote: post #14

This is why all staff, whether at a corporation, nonprofit or government that handle money should be put through a two hour anti-phishing training course. There's lots of good free training material out there. There are also services which you can hire. You give them a list of staff emails, and they send test phishes to everyone. Those who respond or click on links (there's a GUID in each phish) can be sent for furth…

While I think everyone should be aware of phishing, I don't think any amount of education can reliably prevent this sort of fraud. I see this fundamentally as a process problem, as I assume email was a common way of changing payment information. Email needs to be taken out of the loop.

Note that in this particular case the email in question had a signed document attached. So the scam could of been done with regular mail.The problem here was the lack of verification, not the medium of communication.

The ease of forging emails is more of an issue where the spear phish email is trying to disguise itself as coming from inside the company.

Re: A fraudster got $12M out of a Canadian university

#73

Post by sjroot »

bt3 wrote: post #8
sjroot wrote: post #5

Earlier quoted context omitted.

From the article: the email was spoofed to appear to be from the building company.

You can see in the screenshot (scan of the email) it was a low-tech spoof. They simply bought the same domain with a different TLD (.com vs .us) There were many red flags that weren't caught, this being one of them.

Yeah, there is a lot of UX work that could be done to address this. For example, a "HTTPS green lock" equivalent for ongoing email conversations.

Re: A fraudster got $12M out of a Canadian university

#74

Post by aj7 »

siruncledrew wrote: post #66
walrus01 wrote: post #19

Earlier quoted context omitted.

China has really strict controls on the amount of money that a Chinese citizen can legally wire transfer out of the country, to a foreign domestic bank account, per year. People have come up with all sorts of "creative" grey and black market things involving Vancouver real estate and BC casinos. Google "china money laundering BC" for news about it.

I know it's fiction, but the show "Ozark" on Netflix shows as interesting adaptation of money laundering through casinos and real estate.

Ozark is great instructional material to understand Trump Enterprises.

Re: A fraudster got $12M out of a Canadian university

#75

Post by upofadown »

badrequest wrote: post #32
scott_s wrote: post #21

Earlier quoted context omitted.

While I think everyone should be aware of phishing, I don't think any amount of education can reliably prevent this sort of fraud. I see this fundamentally as a process problem, as I assume email was a common way of changing payment information. Email needs to be taken out of the loop.

I wonder if GPG could have ensured this didn't happen.

Obviously it could of if applied correctly. That's an interesting point in general. People are still using insecure communications with no sender verification while doing business here in the 21st century.

Re: A fraudster got $12M out of a Canadian university

#76

Post by pythonaut_16 »

This seems like a place where physical security keys could've be useful.

Any invoice would be expected to be signed using a physical security key. The University or a trusted third party would have a list of vendor keys, signed by the university's master key.

Any request to change account details or for payments would require a new signed invoice. Then any user receiving such an email could easily see if the invoice had been signed by a person who can cryptographically prove they have a key that is trusted to be in the vendor's possession.

Re: A fraudster got $12M out of a Canadian university

#77

Post by bagacrap »

ta2121 wrote: post #40
wk_end wrote: post #38

Earlier quoted context omitted.

It’s not clear to me that $180 million is an unreasonable amount of money to spend on a state-of-the-art building with multiple music studios and dance halls, necessary for music or dance programs that the school (presumably) offers. Between the tuition the students pay, grants from government, and potential commercial use of the space (for concerts, shows, etc.) it’ll likely pay for itself soon enough. Also bear in…

>it’ll likely pay for itself soon enough. Thats the problem though right? "Paying for itself" means students paying higher costs which is the problem.

Only the students who feel the need to attend a university with state of the art facilities.

Re: A fraudster got $12M out of a Canadian university

#79

Post by paulie_a »

thieving_magpie wrote: post #6
cknoxrun wrote: post #2

This seems like a technology problem, not a personnel problem. There should be more checks in a system when you are changing bank accounts where so much money is going to be deposited.

It's a multifaceted problem. Certainly a social engineering problem here. I think anyone that's ever seen how an ACH file works would agree there's room to improve on the technology side.

I think anyone that has ever seen an ACH file and how it is transferred and processed should be amazed capitalism even exists.

Re: A fraudster got $12M out of a Canadian university

#80

Post by jaclaz »

rwmj wrote: post #17
cknoxrun wrote: post #2

This seems like a technology problem, not a personnel problem. There should be more checks in a system when you are changing bank accounts where so much money is going to be deposited.

This scam has been going on in the UK for a few years. It's called "authorised push payment (APP) fraud". Typically you're having some building work done (or any other large project or purchase), and an email will arrive from the builder saying they've changed their account details, could the purchaser please send future bank transfers to the new account. Of course the email is fraudulent and usually happens because…

>This scam has been going on in the UK for a few years.

Now that Brexit is near it doesn't matter anyway, but at least in Italy and Spain (but I presume the rest of EU) a more complex ID for accounts with checksum/validation, called IBAN, is used for both international and national transfers:

https://en.wikipedia.org/wiki/International_Bank_Account_Num...

that should avoid that kind of typo error.

Post reply on HN