Ottawa city treasurer transfers $130K of taxpayer funds to email fraudsters

CTV National News: Phishing scam costs Ottawa The treasurer of the City of Ottawa became a victim of a phishing scam when she sent more than $100K to fraudsters. Kevin Gallagher reports.

Ottawa’s city treasurer was scammed into wire-transferring more than $100,000 of taxpayer funds to a fraudster after she fell for an email scam, according to the city’s auditor general’s office.

Last July, Ottawa city treasurer Marian Simulik received an email from an address she thought belonged to city manager Steve Kanellakos.

In the email, someone posing as Kanellakos asked Simulik to wire transfer nearly US$98,000 – or approximately CAD$130,000 – to pay a city supplier. After several email exchanges with the fraudsters, Simulik agreed to send the funds to a U.S. bank account later that day.

Five days later, the city treasurer received another email from the same account asking her to transfer another US$150,000 or CAD$200,000 to the same company to complete the bill payment.

This time, however, Simulik was sitting near Kanellakos in a meeting when the email came in so she asked him about it in person. When he didn’t know what she was talking about, they both realized she had been the victim of a scam.

“This happens thousands of times with billions of dollars around the world with very sophisticated corporations,” Kanellakos told reporters in Ottawa on Monday. “Our treasurer was a victim in this.”

Simulik immediately reported the incident and the city’s auditor general Ken Hughes launched an internal investigation. Ottawa police were also notified about the suspected fraud.

According to the auditor general’s report, the city treasurer was the victim of a common type of fraud known as the “fake CEO scam” or a “whaling” scam because it targets so-called big fish instead of average people.

It’s also not the first time the City of Ottawa has been targeted in this type of scam, the investigation found. In the spring of 2018, the city treasurer received a similar email that was identified as a fake, but it was never reported to the city’s IT department or the auditor general’s office.

“It was something that in our mind should have been reported. This was not the run-of-the-mill phishing,” Hughes told reporters on Monday.

Hughes also identified several other problems in the City of Ottawa’s policies and procedures, including:

The city’s auditor general said it’s “always concerning” when scammers can convince an organization to give up taxpayer dollars.

Hughes’ report also said Ottawa police didn’t investigate the incident even though they were called in to assist.

“On that day, they weren’t interested in this particular case,” Hughes said.

However, one month later, Ottawa police were notified by RCMP that the U.S. Secret Service had arrested a man in Florida who is suspected of being connected to the scam.

The U.S. Secret Service says they have identified a bank account that may contain some of the City of Ottawa’s money and that some of the funds may be recovered.

“The issue is the City of Ottawa is not the only victim. There are other victims,” Hughes said. “Who knows how many other people will have access to that money? We know that the city will not recover all of the funds.”

As for Ottawa’s city treasurer, she told the committee she was “embarrassed” by the incident in an emotional statement on Monday.

“I have prided myself for professional stewardship of taxpayer money for the last 28 years,” she said. “That I should be the target and the victim of this sophisticated attack has affected me deeply both professionally and personally.”