EDMONTON—An Alberta university says it has been defrauded of $11.8 million in a so-called phishing attack, admitting it didn’t have safeguards in place as staffers unwittingly paid out millions of dollars online. “This is an administrative error,” David Beharry, spokesperson for MacEwan University, said Tuesday. Alberta's MacEwan University has been defrauded of $11.8 million after workers were fooled by a series of fake emails asking them to change electronic banking information for one of the school’s major vendors. Article Continued Below 
 
 He said the scam occurred when fraudsters created a website that resembled the domain site of one of the university’s major vendors. Using that site, the fraudsters impersonated the supplier, asking the university to transfer accounts payable to a new bank account the fraudsters controlled. Three staffers at MacEwan made three payments to the bogus account over a nine-day period ending Aug. 19. Three payments were made to the fraudulent account: one on Aug. 10 for $1.9 million; another on Aug. 17 for $22,000 and a third on Aug. 19 for $9.9 million. MacEwan University discovered the fraud on Aug. 23 after the legitimate vendor, a construction company, called to ask why it hadn't been paid. “That’s not to say there aren’t private companies that aren’t required to disclose this stuff that haven’t had (larger) losses.” 
 
 Shipley said Facebook and Google fell victim to similar scams, transferring “in the $100-million range” after being invoiced by fake suppliers. He said an internal investigation and police investigation are underway, but added: “The university does not believe there has been any sort of collusion. “We really believe this is simply a case of human error.” 
 
 Article Continued Below 
 
 Beharry would not identify the vendor involved, but said a number of construction firms have been impersonated in similar online phishing attacks. Most of the money — more than $11.4 million — has been traced to accounts in Montreal and Hong Kong, the university said in a news release Thursday. “It’s a question of how long will it take for the university to retrieve that money.” 
 
 He said $6.3 million has been seized from the account in Montreal, and actions are underway to freeze the two accounts in Hong Kong. “We are fairly confident that we will be able to recover those funds, the $11.4 million,” MacEwan spokesman David Beharry said Thursday. “It’s a question of how long.” He said a review found the IT and financial systems safe and secure and said that the university will be able to meet its financial commitments to the vendor and others. In a statement, Advanced Education Minister Marlin Schmidt said he is “disappointed” the university fell victim to the scam and has instructed all post-secondary institutions to review their financial controls. “This is unacceptable and I’ve asked the board chair to report back to me by September 15 with details on how this occurred,” Schmidt said in a statement. "While I'm told that MacEwan has put improved internal financial controls to help prevent it from happening again, I expect post-secondary institutions to do better to protect public dollars against fraud," Schmidt said in a statement.
– A university in Canada is the victim of what is being described as one of the biggest known phishing scams ever. MacEwan University in Edmonton discovered the fraud on Aug. 23, when a construction company it works with asked why it had yet to be paid. But the school had made payments to what it thought was the company: $1.9 million on Aug. 10, $22,000 on Aug. 17, and $9.9 million on Aug. 19—a total of $11.8 million to a fraudulent account, with the money eventually being traced to Canada and Hong Kong, reports the CBC. The school has launched a full investigation, but has preliminarily pegged the scam to a series of emails and a website that used the vendor's authentic logo and claimed the vendor had a new bank account. For now, the school says it is down to "human error," where lower-level staffers failed to verify the bank account change was legitimate, so the transfers went to the phony vendor. Canada's advanced education minister issued a statement expressing his disappointment. "This is unacceptable," he says. "I expect post-secondary institutions to do better to protect public dollars against fraud." The loss is 10% of the university's entire annual operating grant from the Alberta government, reports the Edmonton Journal, with a $118 million grant provided in 2015 for the school's $237.1 million budget. One expert calls it the "single largest publicly disclosed amount I've seen" lost to a phishing scam, while noting that private companies may have fallen victim to similar scams but have not been required to disclose the amount lost. MacEwan says its computer systems have not been compromised, per the Toronto Star, and that it expects to recoup the $11.4 million it's managed to trace, though $400,000 remains missing. (Even bank CEOs have been fooled by phishing scams.)