Hacker takes flight with bird club’s half-million rand

● More than half a million rand has flown out of a bird club’s investment account after the treasurer’s e-mail account was hacked.

Cape Bird Club members who attended the 70th anniversary annual meeting this week were told how the fraud happened while treasurer Joy Fish was in Thailand in February.

In a series of transactions, a hacker who had changed Fish’s e-mail settings moved money in five tranches into two Nedbank accounts set up fraudulently in the club’s name. Police said a case of fraud was under investigation but no arrests had been made.

The money — a combination of funds raised, bequests and membership fees — had been destined for projects including the rehabilitation of bird hides in the West Coast National Park, the removal of invasive water hyacinth from Cape Town waterways, upgrading of bird habitats at the Strandfontein sewage works and educational outreach.

These are now all in the balance if the funds cannot be recovered. “Quite a lot has been sitting waiting to be spent, waiting for the City of Cape Town,” said club chairwoman Priscilla Beeton.

The scam was discovered last week when a new attempt to take money was stopped. Fish became suspicious of the details in an email giving her instructions to place R40 000 destined for the West Coast National Park project in a different account from one she had used previously.

A call to FNB revealed that the account number did not belong to South African National Parks.

Fish said she tried to call the park manager to check the account instruction while she was on leave. When Fish received an e-mail from the manager an hour later, again instructing her to use the false account number, her suspicions were raised.

After her e-mail service provider told her to check her settings, she discovered diversion instructions had been set up on her account which allowed mail between herself and SANParks, and between herself and the bird club’s investment management company, Quoin Wealth, to be sent to a third party.

The hacker was able to send fake e-mails Fish to Quoin Wealth giving instructions for funds to be released into the club’s current account — but giving a fake account number.

Fish said she wanted to warn other clubs with treasurers who were not accountants and who did not have the kind of protection against scams that companies might have.

In an e-mail to club members before Thursday’s annual meeting, Beeton said: “We are grappling with this devastating news to come to terms with what went wrong, how we could have done things differently, and what action is required to try to recover from this.”

Ian Scott, a nonexecutive director of Quoin Wealth, confirmed that money was moved based on an e-mail from the club treasurer, and the company had learnt of the scam only when contacted by the club. Quoin had filed its own police report on Tuesday.

Nedbank did not respond to requests for comment.

We are grappling with this devastating news Priscilla Beeton Cape Bird Club chairman