Brickbat: Big Money

Ottawa city treasurer Marian Simulik wired nearly $130,000 ($98,000 in U.S. dollars) to a fraudster after getting an email she thought was from the city manager. She later got another email asking for $200,000 ($150,000 U.S.), but this time the city manager happened to be sitting nearby. That's when they discovered Simulik had sent money to a scammer.

Comments

[Fist of Etiquette]

Hughes’ report also said Ottawa police didn’t investigate the incident even though they were called in to assist.

“On that day, they weren’t interested in this particular case,” Hughes said.

Too much work and too little payoff.

[Pathogen]

"Meh, Fuck it.. ain't our money.."
-Ottawa police

[Brandybuck]

It didn't fit the narrative.

[Still Curmudgeoned (Nunya)]

Has anyone stopped to think about the needs of the so called scammer? I hear lately that the needs outweigh everything else.

[TangoDelta]

Maybe the Ottawa police just got $130k "donation" via email.

[Radioactive]

come on it is after all Canada, and so it's only like $14.37 in real money...

[Pathogen]

The city’s auditor general said it’s “always concerning” when scammers can convince an organization to give up taxpayer dollars.

Tell that to the UN..

[Inigo Montoya]

I take it there are no procedures, forms, budget outlays, and the like that apply? These are not petty cash amounts. You would think that there’d be a system that would simply block the electronic fund withdrawals unless the correct boxes have been ticked.

But then again, I thought the same thing when that incoming missile alert went out in Hawaii. It’s funny that you’re computer asks “Are you sure? Y/N” before deleting a file, but government systems lack even those kinds of measures.

[Pathogen]

I blame the Russians..

[Rich]

It’s funny that you’re computer asks “Are you sure? Y/N” before deleting a file, but government systems lack even those kinds of measures.

"Puh-leeeeze, Sir! I've been doing this job for twenty-nine years! Anyway, those kinds of measures cost a lot of YOUR tax money."

[Kevin Smith]

Hughes also identified several other problems in the City of Ottawa’s policies and procedures, including:
Inadequate controls of wire transfers
Five people working for the city have the authority to transfer up to $25 million by themselves
A lack of fraud awareness training

Well, there's your problem.

[Cyto]

Actually, that makes me wonder if there isn't a whole bunch of money.

Those are, of course, external controls - the bank accounts have those requirements. I'm sure their internal controls are tighter than that...

But still. If there is $200 million sitting in an account and one person has the authority to clean that out in just a handful of transactions.. well, that's a problem.

Because nobody making $200k in a cushy government job is going to skip town with a million bucks. But $100 million? That might be tempting. Bounce that out through 5 transactions and into a bitcoin wash and you'd probably be able to get away with most of your $100 million as you jet off to some remote island nation to live like a king.

$100 million is the kind of money smart people might steal. They aren't going to steal $80k, because they can just earn that kind of money. And they aren't going to steal $2 billion, because then people will come and find you wherever you are. But there are numbers in between, where the payoff is big enough but not so big that they are going to hire people with questionable morals for a lot of money to come get you.

[Cyto]

Hmm... that seems *so* very odd that it makes me wonder....

You would have procedures. Spending that kind of money would require more than one signature, surely.

Yet the treasurer is wiring that kind of money based on a email?

So.... is this how you cover for an embezzlement scheme? Reveal an email that asks you to wire money and "discover" that you've been scammed?

I could see this if we were talking about some small town. But Ottawa? That ain't New York, but it ain't Mayberry either. That's a million people in the city proper. It is twice the size of Sacramento, and you wouldn't expect anything like this from Sacramento.

I know government is incompetent, but this goes beyond that. This is a failure to have controls in place. The kind of controls that would catch this would have been in place at almost any midsize company long before SOX, definitely after SOX. And that's been the better part of two decades. Yet a government this size doesn't have those controls in place?

Mmmm.... nah. Something is fishy. Not buying it.

Even if this scam is real, you couldn't pull this scam off unless there was something very corrupt going on.

[Cyto]

Their annual budget is $3.5 billion.

No way you move that kind of cash through and don't have strict controls in place. It ain't the Mayor's personal checking account.

Definitely something shady is going on if a couple hundred grand moves out without more than one person's say-so. I doubt they buy a box of pencils without two approvals.

[Ray McKigney]

IOW, she got away with it the first time, but the second time she was stopped because the city manager was right next to her.

[I am the 0.000000013%]

Obviously the solution is to hire a city manager to watch every subordinate. That will make sure we don't waste any more money.

[Kevin Smith]

According to the source article they do not have any such controls, and the treasurer is one of 5 people who can transfer up to 25 million dollars with no second authorization

Its government, its not their money they are spending so they don't care

[Cyto]

Even then, the treasurer should have required more than one person's say-so. It is possible to have a relationship where the mayor says "Get this money over to Jones & Co. right now, I'll fill in the paperwork for you later". I get that. Sometimes you need to move quickly. But you'd think it would have a context such that it made sense, not just "well, the mayor says so".

If the treasurer really was in the habit of just sending out hundreds of thousands (or up to $25 million!?!) on the say-so of a single person in an email, they've got bigger problems than getting scammed out of $200k.

[Inigo Montoya]

Good point. I think they need to look into whether the city treasurer has ties to the scammer. Even if there are no procedures in place before transferring out that kind of money, surely paperwork must be filled out after the fact to show where the funds went? That means they should have at least prevented it from happening a second time.

[Griffin3]

It is twice the size of Sacramento, and you wouldn’t expect anything like this from Sacramento.

Hah HAH hah HAH HAHA ha HAA HAH!

Check the incentives. If you were working for Navy Federal Credit Union, or TGI Fridays, and you wired $98,000 to a scammer, would you keep your job? Would you at least have some amount docked from your salary until the company was made whole?

Now, read the article again. Do you see ANY hint that the city treasurer is going to lose their job over this incident? There you go.

[MatthewSlyfield]

"and you wouldn’t expect anything like this from Sacramento."

Yes, I would.

[creech]

Who, with any brains to do this kind of job, falls for this crap? I once got an e-mail purporting to be from the president of a group I do the books for. He "was at a conference and needed me to wire some small amount", around $4k, to "pay for the event, his hotel room, and some equipment he purchased." Immediate red flag, so I replied that I'd be happy to do it but would have to get a mortgage on our (non-existing) real estate in order to cover the wire. When he said, "Go ahead with the mortgage," the fraud was confirmed.
I managed to string them along for a few e-mails before they gave up.

[Brandybuck]

> Who, with any brains to do this kind of job, falls for this crap?

It's not about the lack of brains, it's about trust. Scams have been going on for millennia. A close family member got caught up in several. Not because she was dumb, but because she was way too trusting of other people. People on the other side of the phone were always her friend. People on the other side of the email were honest. She trusted strangers more than friends and family. She was so smart she fooled herself.

This is not unusual. Especially with older people who don't know the technology. Especially with people who don't understand the technology they use every day.

That's why this is called "social engineering". It's not about smarts it's about playing to common weaknesses.

We solved this problem with our family member by locking down her accounts. She still has her money but she needs valid bills and receipts and the docs to get at it. She can waste petty cash, but anything she needs to explain. Do something similar with Ottawa. Petty cash is petty cash, but no checks over a tiny amount with authorization from more than one person.

[Cyto]

These are really important points. The mark doesn't have to be dumb, in fact a good con artist will use your intelligence against you. As you say, it is about trust. There is a reason they are called confidence men.

[MoreFreedom]

The unstated lesson: government never takes good care of our money, especially compared to people in businesses (because they can get fired for getting defrauded by not following procedures that protect it), and especially compared to people spending their own money. Not that individuals/businesses aren't successfully scammed, but they're usually more cautious.

The link reports the funds were wired to "a city supplier". Someone has to withdraw that money before they can use it, or it can be traced. And also reports that:

Hughes also identified several other problems in the City of Ottawa’s policies and procedures, including:

Inadequate controls of wire transfers
Five people working for the city have the authority to transfer up to $25 million by themselves
A lack of fraud awareness training

And finally, that the US Secret Service arrested a suspect in FL that may be connected to the crime and a bank account from which they might be able to retrieve some of the money.

[jagjr]

guess you guys missed the one in Spotsylvania County, VA. they paid a falsified invoice for $600,000 for a blue field turf installation for one of their high schools. so basically, the taxpayers got screwed twice, once by the school board for approving a frivolous expense for a high school at tremendous expense, and then again by incompetent County staffers who paid the wrong folks for it (& still owe the real vendor).

[Hank Phillips]

Meh, I'm confident their motives were altruistic. Besides, easy come, easy go, right?

[Millay Moede]

Nice Post. I have been here reading for about an hour. I am a newbie and your success is very much an inspiration for me. For instant support related to the Computer or Laptop Problem such as Data Recover & Virus Removal please visit https://www.sgeeksquad.com/ or Call Geek Squad Support Number for the best solution.