Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A fraudster got $12M out of a Canadian university

thestar.com

Post reply on HN
Print view View original

91–100 of 119 posts

Re: A fraudster got $12M out of a Canadian university

#91

Post by ChuckMcM »

walrus01 wrote: post #14

This is why all staff, whether at a corporation, nonprofit or government that handle money should be put through a two hour anti-phishing training course. There's lots of good free training material out there. There are also services which you can hire. You give them a list of staff emails, and they send test phishes to everyone. Those who respond or click on links (there's a GUID in each phish) can be sent for furth…

At IBM they would randomly send people phish mails, if you clicked on them you landed on the site that provided remedial training! I always thought this would be a good service to offer companies. You could call it "Phish for Compliance" :-)

Re: A fraudster got $12M out of a Canadian university

#92

Post by module0000 »

TuringNYC wrote: post #48
tialaramex wrote: post #46

Earlier quoted context omitted.

> The solution seems obvious to me. But nobody want to do it because it's political suicide. I like that this works for both readings. If you say to yourself "Obviously the solution is to eliminate federally backed student loans" that's political suicide because it means most people can't have a tertiary education (even if at some future date this chance means the institutions charge less than today) If you say to yo…

Isnt there a middle ground? Like having tertiary education free for state/city/public universities to ensure the poor arent left without choice. And also eliminating federally backed student loans so eventually all schools normalize price and all schools become increasingly affordable?

Yes there is certainly a middle ground. The poor, middle, and upper class all have a GREAT choice available to them. Instead of spending 10, 20, or 30 years paying back your loans: spend 3 years working and have 0 loans.

https://www.benefits.va.gov/gibill/montgomery_bill.asp

Bonus points.. you learn skills/trades/work-ethic/survival-skills/basic-medical-training, and will be useful in an emergency for the rest of your life.

Re: A fraudster got $12M out of a Canadian university

#93

Post by Wingman4l7 »

JumpCrisscross wrote: post #90
PaulHoule wrote: post #45

I get incomprehensible bills from the hospital whenever I get a test or see a physical therapist, etc. Sometimes I get bills about a service that happened 2 years ago, don't remember what the service was, and it seems they can't tell me because that would violate my privacy or something. I've always wondered if I sent an invoice to the hospital for unspecified services if they'd pay it.

> they can't tell me because that would violate my privacy or something If someone can't tell you why you owe a bill, don't pay it. If they can't tell you, they can't tell a court.

The thing is, they probably could tell the court, if it came to that (nevermind that most people couldn't afford the time or money to take it that far). Just because someone isn't being candid about why you owe them money, doesn't mean you don't still technically owe them money in a way that can be proven. I don't know if a judge would have the discretion to waive a debt that wasn't fairly "divulged".

Re: A fraudster got $12M out of a Canadian university

#94

Post by nerdponx »

pythonaut_16 wrote: post #76

This seems like a place where physical security keys could've be useful. Any invoice would be expected to be signed using a physical security key. The University or a trusted third party would have a list of vendor keys, signed by the university's master key. Any request to change account details or for payments would require a new signed invoice. Then any user receiving such an email could easily see if the invoice…

What about PGP?

Re: A fraudster got $12M out of a Canadian university

#95

Post by Scoundreller »

grawprog wrote: post #60
walrus01 wrote: post #19

Earlier quoted context omitted.

China has really strict controls on the amount of money that a Chinese citizen can legally wire transfer out of the country, to a foreign domestic bank account, per year. People have come up with all sorts of "creative" grey and black market things involving Vancouver real estate and BC casinos. Google "china money laundering BC" for news about it.

Ya....a coworker of mine recently had to return to China to bring his retirement money back to canada. I'm not sure of the details of how he went about doing that. Does the limit apply to physically bringing currency back also? I'd ask my coworker but he doesn't speak English and I don't speak Cantonese.

I understand that there’s a yearly limit on how much you can bring over per person.

Lots of evasion tactics:

hiring mules to use their limits.

finding someone that needs to send money to China, then you can make 2 domestic payments and everything is settled.

Buying goods in a China for export, then accepting payment into your western accounts.

Re: A fraudster got $12M out of a Canadian university

#96

Post by forkLding »

This is more common than you expect, a friend's company recently suffered a Business Email Compromise where their clientele were emailed and sent invoices to the hackers' bank accounts instead of the actual company's bank account.

Email is definitely a unsafe way to send messages.

Re: A fraudster got $12M out of a Canadian university

#97

Post by markandrewj »

EpicEng wrote: post #87
markandrewj wrote: post #63

Earlier quoted context omitted.

I am not sure if this completely answers your question, however as a Edmontonian I can give a little feedback. The school has a very active arts and music department. These programs used to be taught in a separate building from the main campus, that was aging, and in a not so nice part of the city. For this reason I think it was consolidated to the main campus, and upgraded. You can read a bit about it here: https://…

>So although some may think that things like music studios are not a necessity, they are in this case. No one said it was unnecessary; the GP questioned why it needed to be "state of the art".

I thought about not including this sentence. I don't think it expressed what I was trying to say properly. My personal experience has been that the arts often get the short end of the stick when it comes to budget, and that what is offered for facilities and supplies ends up lacking because it is not viewed as required. I was happy to see the University invest into these facilities, in part because the music department is something the school is known for locally. Tuition is an issue and consideration though. Historically tuition has been reasonable at Macewan, maybe this has changed though. In general tuition has been getting out of control, so I wouldn't be surprised if it was the case.

Re: A fraudster got $12M out of a Canadian university

#98

Post by na85 »

scott_s wrote: post #83
na85 wrote: post #71

Earlier quoted context omitted.

I disagree. Taking email out of the loop is a technical solution to a problem that is inherently social, not technical.

I don't see it as a technical solution, but fixing a broken process .

But the process is broken by people not realizing that invoices are fraudulent. The method of delivery, be that email or some other system, is completely orthogonal.

Running their invoices through SAP or having gpg signed pdf invoices or using more node.js would not help because all of those solutions fail to address the fact that people are dumb and need to be trained to avoid scams.

Re: A fraudster got $12M out of a Canadian university

#99

Post by hunter2_ »

na85 wrote: post #98
scott_s wrote: post #83

Earlier quoted context omitted.

I don't see it as a technical solution, but fixing a broken process .

But the process is broken by people not realizing that invoices are fraudulent. The method of delivery, be that email or some other system, is completely orthogonal. Running their invoices through SAP or having gpg signed pdf invoices or using more node.js would not help because all of those solutions fail to address the fact that people are dumb and need to be trained to avoid scams.

If a (insert centralized service here) friend tells me about a change of plans, and I know that messages with that contact were successful in the past, then plans indeed changed because it's spoof-proof so long as you didn't make friends with two accounts that end up sharing a name and so long as the sender didn't fall victim to phishing of creds.

If an email from a contact comes in, the from/sender headers can be spoofed without anyone having fallen victim yet, so maybe plans didn't really change.

Yes there are social aspects but there is also this plainly technical aspect.

Re: A fraudster got $12M out of a Canadian university

#100

Post by upofadown »

scott_s wrote: post #85
upofadown wrote: post #72

Earlier quoted context omitted.

Note that in this particular case the email in question had a signed document attached. So the scam could of been done with regular mail.The problem here was the lack of verification, not the medium of communication. The ease of forging emails is more of an issue where the spear phish email is trying to disguise itself as coming from inside the company.

Which is why I said it's a process problem. But you definitely want email out of the process since it's not reliable.

OK, but what would you replace it with that was more reliable? If a company takes the time to, say, use GPG then email is probably the most reliable method available.
Post reply on HN