HOW TO DE­FRAUD A UNI­VER­SITY OF $12M

Starmetro fol­lows the money — from its be­ing stolen from Mace­wan Uni­ver­sity, sub­se­quently fun­nelled through in­ter­na­tional ac­counts and all the way to its be­ing rein­vested in Van­cou­ver real es­tate

StarMetro Vancouver - - VANCOUVER - CLAIRE THEOBALD With files from Michael Mui, Van­cou­ver-based in­ves­tiga­tive re­porter

Hint: Just ask In the first com­pre­hen­sive pic­ture of the case, Starmetro tracks the global jour­ney of the money stolen from Mace­wan Uni­ver­sity — which ended as an in­vest­ment in Van­cou­ver real es­tate

The email started with an in­no­cent “Hiya,” but the words that fol­lowed set off a chain of events that would tar­nish a uni­ver­sity’s rep­u­ta­tion and send in­ves­ti­ga­tors on a months-long chase across the ocean and back.

It’s been just over a year since Mace­wan Uni­ver­sity was blind­sided by an $11.8-mil­lion fraud. While the ruse it­self was sim­ple, the case that fol­lowed was any­thing but. Po­lice had to nav­i­gate a com­plex money-laun­der­ing scheme that fun­nelled some of the stolen pub­lic funds through var­i­ous ac­counts in two con­ti­nents be­fore rein­vest­ing it in a real-es­tate deal in Rich­mond, B.C.

By scour­ing court doc­u­ments from cities across the coun­try that tracked in­ves­ti­ga­tions in Ed­mon­ton, Van­cou­ver, the United King­dom and Hong Kong, Starmetro has pieced to­gether the most com­pre­hen­sive pic­ture of the case ever pub­lished and un­cov­ered new de­tails about how the money was stolen and where it went.

It be­gan in the sum­mer of 2017, when Mace­wan was in the midst of con­struct­ing the $180-mil­lion Al­lard Hall: a state-of-the-art build­ing boast­ing mu­sic stu­dios and dance halls with room for 1,800 stu­dents. Emails de­tail­ing trans­ac­tions worth mil­lions of dol­lars were ping­ing back and forth be­tween school staff and ven­dors.

As a re­sult, one par­tic­u­lar email, sent June 27, didn’t set off any alarms. Sent by a James El­lis of Clark Builders, a con­struc­tion com­pany work­ing on the project, the email opened with the af­fa­ble “Hiya” be­fore ask­ing the school’s ac­counts re­ceiv­able de­part­ment to reroute pay­ments to a new Na­tional Bank of Canada ac­count.

A sup­port­ing let­ter at­tached to the email ap­peared to have been signed by Marc Tim­ber­man, the com­pany’s chief fi­nan­cial of­fi­cer.

Udeni Jayas­inghe, an ac­count­ing tech­ni­cian with the uni­versino ty, changed the bank­ing in­for­ma­tion on file. Ex­actly a month later, Mace­wan wired $1.9 mil­lion into the new Na­tional Bank of Canada ac­count. Oddly, the pay­ment bounced back. The uni­ver­sity’s bank con­firmed the trans­fer didn’t go through be­cause the ac­count didn’t ex­ist. Con­cerned, Jayas­inghe replied to the email ask­ing for up­dated bank­ing co-or­di­nates.

A re­sponse four days later pro­vided new bank­ing in­for­ma­tion, this time to a TD Bank ac­count. The email was ac­com­pa­nied by a re­vised let­ter that once again ap­peared to have been signed by Tim­ber­man. In just over a week, the uni­ver­sity made three pay­ments to the TD ac­count to­talling over $11.8 mil­lion.

It would be al­most two months be­fore the uni­ver­sity would learn the aw­ful truth: Clark Builders never re­ceived these pay­ments, James El­lis had worked for the com­pany for eight years and the real Tim­ber­man had no knowl­edge of the let­ters us­ing his name.

The email was a fraud. Over the course of a month, Mace­wan Uni­ver­sity lost the equiv­a­lent of $622 for ev­ery part-time and full-time stu­dent en­rolled. That’s enough to cover a year of tu­ition for more than 2,600 stu­dents pur­su­ing bach­e­lor’s de­grees, or over an eighth of the to­tal the uni­ver­sity took in through tu­ition and fees in the 2016-17 aca­demic year.

Mace­wan had been fooled by what Const. Wil­liam Le­wad­niuk, with the Red Deer RCMP fi­nan­cial crimes unit, called a “spear phish­ing scheme.”

“It’s tar­geted to a spe­cific in­di­vid­ual,” said Le­wad­niuk. “Gen­er­ally with a spear phish­ing scheme you would spoof the email ad­dress and try to get them to send you money, so you would pre­tend to be a con­trac­tor or a per­son’s boss.”

The fraud was only dis­cov­ered when Serge L’abbe, se­nior project man­ager with Clark Builders, con­tacted the uni­ver­sity Aug. 23, 2017 to in­quire about miss­ing money. The uni­ver­sity im­me­di­ately started in­ves­ti­gat­ing, ac- cord­ing to a sworn state­ment filed in court in Mon­treal by Stu­art Mclean, as­so­ciate vice-pres­i­dent of fa­cil­i­ties with Grant Mace­wan’s board of gov­er­nors.

They quickly dis­cov­ered that while the email ap­peared to have been sent by “ac­counts.re­ciev­able@clark­builders.com” the email ad­dress had been “spoofed.” The dis­play name of the email was dif­fer­ent than the ac­tual orig­i­nat­ing ac­count.

The uni­ver­sity’s first break came Aug. 25, 2017 when a Mon­treal Su­pe­rior Court jus­tice is­sued a seizure order and took back $6.3 mil­lion from the TD ac­count, re­cov­er­ing over half of the miss­ing funds. The ac­count had been opened un­der the name of Mono Shoes Inc., a com­pany reg­is­tered to a fifth-floor apart­ment near down­town Mon­treal.

CODIE MCLACHLAN FOR STARMETRO ED­MON­TON

Newspapers in English

Newspapers from Canada

© PressReader. All rights reserved.