After months of legal wrangling, Edmonton's MacEwan University has recovered nearly all of the $11.8 million lost to an online phishing scam. 
 
 In a statement Wednesday, MacEwan said it was able to recover $10.92 million before concluding legal proceedings. 
 
 "MacEwan's administration credits the recovery of such a large percentage of the funds — just over 92 per cent — to the swift response and diligent efforts of an internal team at the university, legal counsel in several jurisdictions, fraud units at the banks involved in the transactions and law enforcement agencies," the statement said. 
 
 The total amount not recovered was $880,000. To get back the $10.92 million, the university spent $250,000 in legal and banking fees, MacEwan spokesperson David Beharry said. 
 
 After it was discovered last August, the fraud prompted Advanced Education Minister Marlin Schmidt to instruct all university board chairs in the province to review their financial controls. 
 
 Wednesday's statement from MacEwan said it now has stronger financial controls including mandatory IT security training for staff and improved vendor verification protocols. Schmidt said he's glad to see the university has improved its safeguards. 
 
 "I'm very pleased that MacEwan has made significant progress on recovering the money, as well as the improvements that they have made in their financial processes and control," Schmidt told reporters at the legislature. 
 
 "We raised some significant concerns last summer when this issue came to light and we're very pleased with the progress that they're making." 
 
 The university was defrauded last summer when staff failed to verify as legitimate emails requesting a change in banking information for one of its vendors. 
 
 Three payments were made to a fraudulent account: one on Aug. 10 for $1.9 million; another on Aug. 17 for $22,000 and a third on Aug. 19 for $9.9 million. 
 
 MacEwan discovered the fraud after the legitimate vendor, a construction company, called to ask why it hadn't been paid. 
 
 At the time, Beharry said most of the missing money — $11.4 million — was traced to a bank account in Montreal and to two accounts in Hong Kong. He said $6.3 million was seized from the Montreal account and action was taken to freeze the two Hong Kong accounts. 
 
 We knew we were at fault, and that's why I'm here to tell you that it was our fault and we accept that. - David Beharry, MacEwan spokesperson 
 
 He also said three employees involved were not high-level staffers and the university did not believe there was any collusion. He did not say if the three had been suspended or reprimanded. 
 
 On Wednesday, Beharry said auditors determined human error made the scam possible. 
 
 "We didn't have the proper controls in place," Beharry said. "Since then we have changed that, the reporting structure. The reporting structure has to go through a manager or a director, so there's multiple levels of checks and balances now. 
 
 "The university looked at all its processes after this and we knew we were at fault, and that's why I'm here to tell you that it was our fault and we accept that." 
 
 The Edmonton Police Service and other police agencies are still investigating the fraud. 
 
 No charges have been laid in the case, police said. ||||| EDMONTON—The email started with an innocent “Hiya,” but the words that followed set off a chain of events that would tarnish a university’s reputation and send investigators on a months-long chase across the ocean and back. It’s been just over a year since MacEwan University was blindsided by an $11.8-million fraud. While the ruse itself was simple, the case that followed was anything but. Police had to navigate a complex money-laundering scheme that funnelled some of the stolen public funds through various accounts in two continents before reinvesting it in a real-estate deal in Richmond, B.C. 
 
 The fraud began in the summer of 2017, when MacEwan was in the midst of constructing the $180-million Allard Hall: a state-of-the-art building boasting music studios and dance halls with room for 1,800 students. ( Codie McLachlan / For StarMetro Edmonton ) 
 
 By scouring court documents from cities across the country that tracked investigations in Edmonton, Vancouver, the United Kingdom and Hong Kong, StarMetro has pieced together the most comprehensive picture of the case ever published and uncovered new details about how the money was stolen and where it went. It began in the summer of 2017, when MacEwan was in the midst of constructing the $180-million Allard Hall: a state-of-the-art building boasting music studios and dance halls with room for 1,800 students. Emails detailing transactions worth millions of dollars were pinging back and forth between school staff and vendors. As a result, one particular email, sent June 27, didn’t set off any alarms. Sent by a James Ellis of Clark Builders, a construction company working on the project, the email opened with the affable “Hiya” before asking the school’s accounts receivable department to reroute payments to a new National Bank of Canada account. 
 
 Article Continued Below 
 
 A supporting letter attached to the email appeared to have been signed by Marc Timberman, the company’s chief financial officer. Read more: Edmonton’s MacEwan University recovers more than $10 million lost to phishing attack Alberta’s MacEwan University loses $11.8M after being fooled by email phishing scam Udeni Jayasinghe, an accounting technician with the university, changed the banking information on file. Exactly a month later, MacEwan wired $1.9 million into the new National Bank of Canada account. 
 
 Oddly, the payment bounced back. The university’s bank confirmed the transfer didn’t go through because the account didn’t exist. Concerned, Jayasinghe replied to the email asking for updated banking co-ordinates. A response four days later provided new banking information, this time to an account with TD Bank. The email was accompanied by a revised letter that once again appeared to have been signed by Timberman. 
 
 Article Continued Below 
 
 In just over a week, the university made three payments into the TD Bank account totalling more than $11.8 million. It would be almost two months before the university would learn the awful truth: Clark Builders never received these payments, no James Ellis had worked for the company for at least eight years and the real Timberman had no knowledge of the letters using his name. The email was a fraud. Over the course of a month, MacEwan University lost the equivalent of $622 for every part-time and full-time student enrolled. That’s enough to cover a year of tuition for more than 2,600 students pursuing bachelor’s degrees, or more than one-eighth of the total amount the university took in through tuition and fees during the 2016-2017 academic year. MacEwan had been fooled by what Const. William Lewadniuk, with the Red Deer RCMP financial crimes unit, called a “spear phishing scheme.” “It’s targeted to a specific individual,” said Lewadniuk. “Generally with a spear phishing scheme you would spoof the email address and try to get them to send you money, so you would pretend to be a contractor or a person’s boss.” The fraud was only discovered when Serge L’Abbe, senior project manager with Clark Builders, contacted the university on Aug. 23, 2017 to inquire about the missing money. 
 
 StarMetro follows the money stolen from MacEwan University funneled through international accounts and reinvested in Vancouver real estate. 
 
 The university immediately started investigating, according to a sworn statement filed in court in Montreal by Stuart McLean, associate vice-president of facilities with Grant MacEwan’s board of governors. They quickly discovered that while the email appeared to have been sent by “accounts.receiveable@clarkbuilders.com” the email address had been “spoofed.” The display name of the email was different than the actual originating account. The university’s first break came on Aug. 25, 2017 when a Montreal Superior Court justice issued a seizure order and took back $6.3 million from the TD account, recovering more than half of the missing funds. The account had been opened under the name of Mono Shoes Inc., a company registered to a fifth-floor apartment near downtown Montreal. Before MacEwan’s millions of dollars poured in, according to documents filed in court, the account had a balance of less than $70. But this was just the beginning of the trail, not the end. In another plot twist, the man identified by a corporate registry search as president, sole director and shareholder of Mono Shoes — Jehad Albatniji — claimed he, too, had been a victim of fraud. In September, while he was in Jordan, Albatniji exchanged emails with one of MacEwan’s lawyers. He alleged a man in Montreal introduced him to another man in Toronto — the “main culprit,” Albatniji said, who had access to an account in Hong Kong. Here the story enters its second major theatre: East Asia. From the Mono Shoes TD account, investigators were able to track a trail of transactions to accounts based in Hong Kong. Lewadniuk — who has worked with the RCMP’s financial crimes unit in Red Deer for three years, with expertise in money laundering involving the proceeds of crime — said the money stolen in these types of schemes typically doesn’t stick around. “More and more, the money doesn’t stay in Canada,” he said. “They’ll try to get it sent out to a country outside of Canada because it is harder for us to recover the funds or follow up.” In cases like this, Lewadniuk said, finding out exactly who is responsible and building a case strong enough to lay criminal charges is rare. Criminals often create shell companies with corporate accounts, sometimes using stolen identities, to shuffle money around while concealing the identity of the people controlling the accounts. 
 
 Const. William Lewadniuk, with the Red Deer RCMP financial crimes unit, has expertise handling major complex frauds and money laundering involving the proceeds of crime. Lewadniuk said the money stolen in these types of schemes typically doesn't stick around. ( Trevor Howell / StarMetro Calgary ) 
 
 “They want to make it as hard as possible for people to be able to trace where the money goes, so you go from account to account to account through so many countries,” said Lewadniuk. Just one day after MacEwan wired $1.9 million to the Mono Shoes account, $1.4 million of the stolen funds was sent from the Mono Shoes account to an account supposedly operated by a company called Kinglong Commerce Development Ltd., based in Hong Kong. So began a series of transactions that would see the money moved from account to account before it was reinvested in a legitimate real-estate deal back on Canadian soil. Around the same time the fraud was unfolding in Edmonton, Vancouver-based company Hoi Fu Enterprises Ltd., owned by mother Jin Lan Feng and son John Yuan, was in the process of acquiring land in Richmond, B.C. The property at 4008 Stolberg St. was valued at over $25 million, but Hoi Fu Enterprises did not have the funds to purchase it outright. According to documents filed with the Supreme Court of British Columbia, the seller offered them a short-term mortgage to finance part of the purchase. The sale was completed on July 12, 2017, with Hoi Fu Enterprises Ltd. acquiring the property through a holding company. To pay back the mortgage, Hoi Fu Enterprises borrowed money from Yangjiang City Jixie Zhulu Engineering Ltd. in China. The registered legal representative and shareholder of that company is Yuan’s uncle. However, to lend Hoi Fu Enterprises the money, Yangjiang City Jixie Zhulu Engineering had to find a way to convert the funds from Chinese currency and send the money to Hoi Fu in Canada. This is how the stolen funds get involved. Yangjiang City Jixie Zhulu Engineering was then “introduced” to two individuals, Shao Xiong Ma and Shao Yun Ma, who claimed they could help purchase Canadian funds and move them from China to Canada, according to a statement filed on behalf of Hoi Fu Enterprises. Yangjiang City Jixie Zhulu Engineering agreed to lend the Mas the money in the form of Chinese renminbi on the condition that they repay their loan in Canadian dollars to Hoi Fu Enterprises in Canada. Between June and July of 2017, Yangjiang City Jixie Zhulu Engineering made four payments to the Mas totalling ¥6.7 million, which would have been worth approximately $1.2 million. In August, Hoi Fu Enterprises received three wire transfers totalling $1 million. What Hoi Fu Enterprises said it didn’t know was that the Mas had made a side deal with Kinglong Commerce Development. The Mas would make payments totalling ¥5.3 million — approximately $1 million — to four individuals and one company in China. In exchange, the Kinglong Commerce Development account, which had previously received $1.4 million in funds stolen during the MacEwan fraud, would transfer $1 million to Hoi Fu Enterprises. Kibben Jackson, a Vancouver-based lawyer who represented Hoi Fu Enterprises during MacEwan’s investigation and subsequent civil suits, said the owners contend they never knew the money they would eventually use to repay their mortgage on the property deal in Richmond was stolen from MacEwan University. Jackson said that after MacEwan threatened to seize $1 million from Hoi Fu Enterprises, the company settled the lawsuit in March 2018. He could not disclose how much money Hoi Fu Enterprises offered to MacEwan. While the case may have been complex, it was certainly not unique, according to experts in the field. 
 
 Garry Clement is a financial crime prevention expert and advocate, having once served as the national director for the RCMP's Proceeds of Crime Program and worked as an undercover operator investigating some of the highest levels of organized crime in Canada. Clement, who did not work on the case, said criminal networks between Canada and Asia have been well established over decades. ( Supplied ) 
 
 Financial crimes specialist Garry Clement, who did not work on the case, said criminal networks between Canada and Asia have been well established over decades. Clement previously worked with police for 34 years, going undercover to chase some of the highest levels of organized crime in Canada. He was also formerly the national director for the RCMP’s Proceeds of Crime Program. Clement said that, prior to 1997, there wasn’t a specific charge under the Criminal Code of Canada for being a member of an organized crime group, as there is under Hong Kong law. Without an equivalent on the books, immigrants with that kind of criminal history wouldn’t be automatically precluded from entering Canada. “As a result, we did end up with our fair share of known organized-crime figures in Canada,” said Clement. This allowed criminals to set up networks between the two countries that have persisted to this day. “You’ve created a network, and that network enables you to do a lot of things through various company formations,” said Clement. “That is essentially what you are seeing in China: Money is flowing that has been defrauded.” Clement said it is not uncommon for the proceeds of crime to end up in legitimate investments as criminals look to keep their money safe and out of reach of authorities. An investment of choice, said Clement, is real estate, given its relative stability and the large sums of money involved. “Nobody asks the genesis of the money,” Clement said. Through legal action in Hong Kong, the university was able to recover nearly $3.8 million from another individual — not named in court documents available in Vancouver or Montreal — who had also been transferred stolen MacEwan funds from the Mono Shoes TD Bank account. In all, MacEwan University announced on April 4, 2018 that it had successfully recovered $10.9 million of the $11.8 million lost to the scam. More than $960,000 remains missing — a stinging loss that has prompted change at the university and beyond. “Taxpayers rightly expect that the money we give to universities is spent on educating our students and isn’t lost because of poor financial controls that are in place,” Advanced Education Minister Marlin Schmidt told StarMetro in a recent interview. “We all have a fiduciary responsibility to make sure that the money is spent properly.” After finding out it had been defrauded, the university waited a week before alerting the public to the loss. A press release assured students that the university’s IT systems were secure and that it had already begun tracking the majority of the stolen funds with the help of legal counsel in Montreal, London and Hong Kong. MacEwan University president Deborah Saucier was not made available for comment. When the administration credited the “swift response and diligent efforts” of staff, legal counsel, investigators and the banks for seeing the return of 92 per cent of the lost funds, it revealed few details about where the money went or how it was recovered. 
 
 The money-laundering loop. How stolen money in Edmonton masqueraded as legitimate capital in Vancouver. ( Andres Plana/StarMetro ) 
 
 That was by design. A presentation to the 2018 Canadian Association of University Business Officers Conference reveals university officials feared “significant political fallout” and loss of reputation in the wake of the scam. University executives, according to the document, refused to provide media with access to Saucier and employed a “disciplined” communications strategy, despite public promises of transparency. In a statement posted online in October 2017, Saucier said “the fraud did shine spotlights on two glaring gaps in our organization.” An internal audit revealed there were inadequate controls in place for changing payment information. There was no requirement for a manager or supervisor to review changes to payment information on file. It also found employees didn’t bother to contact the vendor in any way to confirm the request was valid. The press release sent out in April outlined some of the measures administration took to ensure they wouldn’t be fooled again. Employees are now required to verify all changes to vendor files by phone and a followup email, and all financial changes must first be reviewed by a supervisor, manager or director. A supplied audit report system was also implemented, tracking every change made to vendor files. The university has made employee training in social engineering attacks, phishing and other online scams mandatory. Minister Schmidt praised MacEwan for making changes to its financial department, “including some staff changes at the highest levels, which was a good first step.” Brent Quinton, who was the university’s vice-president of finance and administration at the time of the fraud, resigned from his position three weeks after the fraud was discovered, walking away with a $540,000 severance payout. No staff members were fired, though some were placed in different positions. Harry Oosteroff, executive director of the MacEwan Staff Association, said “our members were treated appropriately.” The provincial government is taking steps to prevent such costly, embarrassing mistakes in the future. The Ministry of Advanced Education’s senior financial officer is now leading a team tasked with “identifying ways that we can help build capacity at institutions to improve their financial controls” so public dollars allocated for the benefit of post-secondary students don’t end up in the wrong hands. “There are always improvements that can be made, and our department is working with institutions to continually improve the financial systems that are used to protect the taxpayers’ dollars,” Schmidt said. After all, this isn’t the first time a post-secondary institution in Alberta has been fooled. An investigation into a similar fraud at the University of Lethbridge found that while the university had such controls in place, staff weren’t following them. The University of Lethbridge sent $368,000 to scammers over a two-month period in 2016, “when payments owing to an external vendor of the university were sent through a process of misdirection to an alternative, nonauthentic bank account,” said Mike Mahon, president and vice-chancellor, in a statement in December 2016. 
 
 Sent by a James Ellis of Clark Builders, a construction company working on the project, the email opened with an affable “Hiya” before asking the school’s accounts receivable department to reroute payments to a new bank account. 
 
 Const. Lewadniuk said low-tech solutions, such as having two people sign off on financial transactions or following up on emails with a phone call to the person or company in question, can be key in avoiding high-tech fraud. There are institutional changes on the horizon as well. Clement, the financial crimes specialist, is eager to see stronger regulations around identifying beneficial ownership of property, corporations and bank accounts. Beneficial ownership is an arrangement in which the person who enjoys the benefits of the property or bank accounts, such as profits, isn’t necessarily the person listed on the title. Clement said that, until recently, numbered companies would have one or two directors listed, “but there was not that requirement to drill down to see who is actually the beneficial owners of that money.” Finance ministers across Canada entered an agreement to strengthen such regulations and bring them into force by July 1, 2019. The regulations seek to curb the misuse of corporations and other legal entities being exploited for tax evasion, money laundering, corruption and financing terrorism. But until those regulations are brought into force and investigators are given the resources they need to chase down these types of crime, Clement fears such financial crime will continue “unabated.” “If you stem the flow of money and stem their ability to make that profit, you can curb a lot of activity,” said Clement. “But as long as there’s that profit to be made, people are going to gamble.” Claire Theobald is an Edmonton-based reporter who covers crime and the courts. Follow her on Twitter: @clairetheobald With files from Michael Mui 
 
 Read more about:
– How do you get millions from a Canadian university? Just ask, apparently. A fraudster emailed MacEwan University in 2017 seeking roughly $9 million (USD) and the school sent it right off, the Toronto Star reports. To be fair, the Edmonton school was busy constructing a $137 million building featuring dance halls and music studios, so the request from Clark Builders, a company on the project, made sense. Only after sending the money did MacEwan learn that Clark Builders never received it and the email's purported author hadn't worked there in years. The funds really went to a Montreal bank account that previously held under $60. From there, over $1 million of it went to East Asia and back to appear legitimate—an international route that made it harder for the RCMP to trace. But trace it they did. According to court documents, most of the money returned to Canada as a loan to Vancouver-based Hoi Fu Enterprises Ltd. The loan came from a Chinese company that, via intermediaries, bought Canadian dollars from a supposed Hong Kong company that had received the Montreal money. And presto, Hoi Fu received about $764,000 in loans to help pay a big new mortgage. Luckily, MacEwan recovered over 92% of lost funds, in part by suing Hoi Fu and seizing money from the bank. The school also set up anti-phishing measures to avoid getting fooled again. "We knew we were at fault ... and we accept that," a school rep tells the CBC. No arrests have been reported in the case. (In another story, the so-called "affluenza" mom has been charged with money laundering.)