HOW TO DEFRAUD A UNIVERSITY OF $12M
Starmetro follows the money — from its being stolen from Macewan University, subsequently funnelled through international accounts and all the way to its being reinvested in Vancouver real estate
Hint: Just ask In the first comprehensive picture of the case, Starmetro tracks the global journey of the money stolen from Macewan University — which ended as an investment in Vancouver real estate
The email started with an innocent “Hiya,” but the words that followed set off a chain of events that would tarnish a university’s reputation and send investigators on a months-long chase across the ocean and back.
It’s been just over a year since Macewan University was blindsided by an $11.8-million fraud. While the ruse itself was simple, the case that followed was anything but. Police had to navigate a complex money-laundering scheme that funnelled some of the stolen public funds through various accounts in two continents before reinvesting it in a real-estate deal in Richmond, B.C.
By scouring court documents from cities across the country that tracked investigations in Edmonton, Vancouver, the United Kingdom and Hong Kong, Starmetro has pieced together the most comprehensive picture of the case ever published and uncovered new details about how the money was stolen and where it went.
It began in the summer of 2017, when Macewan was in the midst of constructing the $180-million Allard Hall: a state-of-the-art building boasting music studios and dance halls with room for 1,800 students. Emails detailing transactions worth millions of dollars were pinging back and forth between school staff and vendors.
As a result, one particular email, sent June 27, didn’t set off any alarms. Sent by a James Ellis of Clark Builders, a construction company working on the project, the email opened with the affable “Hiya” before asking the school’s accounts receivable department to reroute payments to a new National Bank of Canada account.
A supporting letter attached to the email appeared to have been signed by Marc Timberman, the company’s chief financial officer.
Udeni Jayasinghe, an accounting technician with the universino ty, changed the banking information on file. Exactly a month later, Macewan wired $1.9 million into the new National Bank of Canada account. Oddly, the payment bounced back. The university’s bank confirmed the transfer didn’t go through because the account didn’t exist. Concerned, Jayasinghe replied to the email asking for updated banking co-ordinates.
A response four days later provided new banking information, this time to a TD Bank account. The email was accompanied by a revised letter that once again appeared to have been signed by Timberman. In just over a week, the university made three payments to the TD account totalling over $11.8 million.
It would be almost two months before the university would learn the awful truth: Clark Builders never received these payments, James Ellis had worked for the company for eight years and the real Timberman had no knowledge of the letters using his name.
The email was a fraud. Over the course of a month, Macewan University lost the equivalent of $622 for every part-time and full-time student enrolled. That’s enough to cover a year of tuition for more than 2,600 students pursuing bachelor’s degrees, or over an eighth of the total the university took in through tuition and fees in the 2016-17 academic year.
Macewan had been fooled by what Const. William Lewadniuk, with the Red Deer RCMP financial crimes unit, called a “spear phishing scheme.”
“It’s targeted to a specific individual,” said Lewadniuk. “Generally with a spear phishing scheme you would spoof the email address and try to get them to send you money, so you would pretend to be a contractor or a person’s boss.”
The fraud was only discovered when Serge L’abbe, senior project manager with Clark Builders, contacted the university Aug. 23, 2017 to inquire about missing money. The university immediately started investigating, ac- cording to a sworn statement filed in court in Montreal by Stuart Mclean, associate vice-president of facilities with Grant Macewan’s board of governors.
They quickly discovered that while the email appeared to have been sent by “firstname.lastname@example.org” the email address had been “spoofed.” The display name of the email was different than the actual originating account.
The university’s first break came Aug. 25, 2017 when a Montreal Superior Court justice issued a seizure order and took back $6.3 million from the TD account, recovering over half of the missing funds. The account had been opened under the name of Mono Shoes Inc., a company registered to a fifth-floor apartment near downtown Montreal.