How a fraudster got $12 million out of a Canadian university: They just asked for it

By scouring court documents from cities across the country that tracked investigations in Edmonton, Vancouver, the United Kingdom and Hong Kong, StarMetro has pieced together the most comprehensive picture of the case ever published and uncovered new details about how the money was stolen and where it went.

It began in the summer of 2017, when MacEwan was in the midst of constructing the $180-million Allard Hall: a state-of-the-art building boasting music studios and dance halls with room for 1,800 students. Emails detailing transactions worth millions of dollars were pinging back and forth between school staff and vendors.

As a result, one particular email, sent June 27, didn’t set off any alarms. Sent by a James Ellis of Clark Builders, a construction company working on the project, the email opened with the affable “Hiya” before asking the school’s accounts receivable department to reroute payments to a new National Bank of Canada account.

A supporting letter attached to the email appeared to have been signed by Marc Timberman, the company’s chief financial officer.

Read more:

Edmonton’s MacEwan University recovers more than $10 million lost to phishing attack

Alberta’s MacEwan University loses $11.8M after being fooled by email phishing scam

Udeni Jayasinghe, an accounting technician with the university, changed the banking information on file. Exactly a month later, MacEwan wired $1.9 million into the new National Bank of Canada account.

Oddly, the payment bounced back. The university’s bank confirmed the transfer didn’t go through because the account didn’t exist. Concerned, Jayasinghe replied to the email asking for updated banking co-ordinates.

A response four days later provided new banking information, this time to an account with TD Bank. The email was accompanied by a revised letter that once again appeared to have been signed by Timberman.

In just over a week, the university made three payments into the TD Bank account totalling more than $11.8 million.

It would be almost two months before the university would learn the awful truth: Clark Builders never received these payments, no James Ellis had worked for the company for at least eight years and the real Timberman had no knowledge of the letters using his name.

The email was a fraud. Over the course of a month, MacEwan University lost the equivalent of $622 for every part-time and full-time student enrolled. That’s enough to cover a year of tuition for more than 2,600 students pursuing bachelor’s degrees, or more than one-eighth of the total amount the university took in through tuition and fees during the 2016-2017 academic year.

MacEwan had been fooled by what Const. William Lewadniuk, with the Red Deer RCMP financial crimes unit, called a “spear phishing scheme.”

“It’s targeted to a specific individual,” said Lewadniuk. “Generally with a spear phishing scheme you would spoof the email address and try to get them to send you money, so you would pretend to be a contractor or a person’s boss.”

The fraud was only discovered when Serge L’Abbe, senior project manager with Clark Builders, contacted the university on Aug. 23, 2017 to inquire about the missing money.

The university immediately started investigating, according to a sworn statement filed in court in Montreal by Stuart McLean, associate vice-president of facilities with Grant MacEwan’s board of governors.

They quickly discovered that while the email appeared to have been sent by “accounts.receiveable@clarkbuilders.com” the email address had been “spoofed.” The display name of the email was different than the actual originating account.

The university’s first break came on Aug. 25, 2017 when a Montreal Superior Court justice issued a seizure order and took back $6.3 million from the TD account, recovering more than half of the missing funds.

The account had been opened under the name of Mono Shoes Inc., a company registered to a fifth-floor apartment near downtown Montreal. Before MacEwan’s millions of dollars poured in, according to documents filed in court, the account had a balance of less than $70.

But this was just the beginning of the trail, not the end. In another plot twist, the man identified by a corporate registry search as president, sole director and shareholder of Mono Shoes — Jehad Albatniji — claimed he, too, had been a victim of fraud.

In September, while he was in Jordan, Albatniji exchanged emails with one of MacEwan’s lawyers. He alleged a man in Montreal introduced him to another man in Toronto — the “main culprit,” Albatniji said, who had access to an account in Hong Kong.

Here the story enters its second major theatre: East Asia. From the Mono Shoes TD account, investigators were able to track a trail of transactions to accounts based in Hong Kong.

Lewadniuk — who has worked with the RCMP’s financial crimes unit in Red Deer for three years, with expertise in money laundering involving the proceeds of crime — said the money stolen in these types of schemes typically doesn’t stick around.

“More and more, the money doesn’t stay in Canada,” he said. “They’ll try to get it sent out to a country outside of Canada because it is harder for us to recover the funds or follow up.”

In cases like this, Lewadniuk said, finding out exactly who is responsible and building a case strong enough to lay criminal charges is rare.

Criminals often create shell companies with corporate accounts, sometimes using stolen identities, to shuffle money around while concealing the identity of the people controlling the accounts.

“They want to make it as hard as possible for people to be able to trace where the money goes, so you go from account to account to account through so many countries,” said Lewadniuk.

Just one day after MacEwan wired $1.9 million to the Mono Shoes account, $1.4 million of the stolen funds was sent from the Mono Shoes account to an account supposedly operated by a company called Kinglong Commerce Development Ltd., based in Hong Kong.

So began a series of transactions that would see the money moved from account to account before it was reinvested in a legitimate real-estate deal back on Canadian soil.

Around the same time the fraud was unfolding in Edmonton, Vancouver-based company Hoi Fu Enterprises Ltd., owned by mother Jin Lan Feng and son John Yuan, was in the process of acquiring land in Richmond, B.C. The property at 4008 Stolberg St. was valued at over $25 million, but Hoi Fu Enterprises did not have the funds to purchase it outright.

According to documents filed with the Supreme Court of British Columbia, the seller offered them a short-term mortgage to finance part of the purchase. The sale was completed on July 12, 2017, with Hoi Fu Enterprises Ltd. acquiring the property through a holding company.

To pay back the mortgage, Hoi Fu Enterprises borrowed money from Yangjiang City Jixie Zhulu Engineering Ltd. in China. The registered legal representative and shareholder of that company is Yuan’s uncle.

However, to lend Hoi Fu Enterprises the money, Yangjiang City Jixie Zhulu Engineering had to find a way to convert the funds from Chinese currency and send the money to Hoi Fu in Canada. This is how the stolen funds get involved.

Yangjiang City Jixie Zhulu Engineering was then “introduced” to two individuals, Shao Xiong Ma and Shao Yun Ma, who claimed they could help purchase Canadian funds and move them from China to Canada, according to a statement filed on behalf of Hoi Fu Enterprises. Yangjiang City Jixie Zhulu Engineering agreed to lend the Mas the money in the form of Chinese renminbi on the condition that they repay their loan in Canadian dollars to Hoi Fu Enterprises in Canada.

Between June and July of 2017, Yangjiang City Jixie Zhulu Engineering made four payments to the Mas totalling ¥6.7 million, which would have been worth approximately $1.2 million. In August, Hoi Fu Enterprises received three wire transfers totalling $1 million.

What Hoi Fu Enterprises said it didn’t know was that the Mas had made a side deal with Kinglong Commerce Development. The Mas would make payments totalling ¥5.3 million — approximately $1 million — to four individuals and one company in China.

In exchange, the Kinglong Commerce Development account, which had previously received $1.4 million in funds stolen during the MacEwan fraud, would transfer $1 million to Hoi Fu Enterprises.

Kibben Jackson, a Vancouver-based lawyer who represented Hoi Fu Enterprises during MacEwan’s investigation and subsequent civil suits, said the owners contend they never knew the money they would eventually use to repay their mortgage on the property deal in Richmond was stolen from MacEwan University.

Jackson said that after MacEwan threatened to seize $1 million from Hoi Fu Enterprises, the company settled the lawsuit in March 2018. He could not disclose how much money Hoi Fu Enterprises offered to MacEwan.

While the case may have been complex, it was certainly not unique, according to experts in the field.

Financial crimes specialist Garry Clement, who did not work on the case, said criminal networks between Canada and Asia have been well established over decades. Clement previously worked with police for 34 years, going undercover to chase some of the highest levels of organized crime in Canada. He was also formerly the national director for the RCMP’s Proceeds of Crime Program.

Clement said that, prior to 1997, there wasn’t a specific charge under the Criminal Code of Canada for being a member of an organized crime group, as there is under Hong Kong law. Without an equivalent on the books, immigrants with that kind of criminal history wouldn’t be automatically precluded from entering Canada.

“As a result, we did end up with our fair share of known organized-crime figures in Canada,” said Clement.

This allowed criminals to set up networks between the two countries that have persisted to this day.

“You’ve created a network, and that network enables you to do a lot of things through various company formations,” said Clement. “That is essentially what you are seeing in China: Money is flowing that has been defrauded.”

Clement said it is not uncommon for the proceeds of crime to end up in legitimate investments as criminals look to keep their money safe and out of reach of authorities. An investment of choice, said Clement, is real estate, given its relative stability and the large sums of money involved.

“Nobody asks the genesis of the money,” Clement said.

Through legal action in Hong Kong, the university was able to recover nearly $3.8 million from another individual — not named in court documents available in Vancouver or Montreal — who had also been transferred stolen MacEwan funds from the Mono Shoes TD Bank account.

In all, MacEwan University announced on April 4, 2018 that it had successfully recovered $10.9 million of the $11.8 million lost to the scam.

More than $960,000 remains missing — a stinging loss that has prompted change at the university and beyond.

“Taxpayers rightly expect that the money we give to universities is spent on educating our students and isn’t lost because of poor financial controls that are in place,” Advanced Education Minister Marlin Schmidt told StarMetro in a recent interview. “We all have a fiduciary responsibility to make sure that the money is spent properly.”

After finding out it had been defrauded, the university waited a week before alerting the public to the loss. A press release assured students that the university’s IT systems were secure and that it had already begun tracking the majority of the stolen funds with the help of legal counsel in Montreal, London and Hong Kong.

MacEwan University president Deborah Saucier was not made available for comment.

When the administration credited the “swift response and diligent efforts” of staff, legal counsel, investigators and the banks for seeing the return of 92 per cent of the lost funds, it revealed few details about where the money went or how it was recovered.

That was by design. A presentation to the 2018 Canadian Association of University Business Officers Conference reveals university officials feared “significant political fallout” and loss of reputation in the wake of the scam. University executives, according to the document, refused to provide media with access to Saucier and employed a “disciplined” communications strategy, despite public promises of transparency.

In a statement posted online in October 2017, Saucier said “the fraud did shine spotlights on two glaring gaps in our organization.”

An internal audit revealed there were inadequate controls in place for changing payment information. There was no requirement for a manager or supervisor to review changes to payment information on file. It also found employees didn’t bother to contact the vendor in any way to confirm the request was valid.

The press release sent out in April outlined some of the measures administration took to ensure they wouldn’t be fooled again.

Employees are now required to verify all changes to vendor files by phone and a followup email, and all financial changes must first be reviewed by a supervisor, manager or director. A supplied audit report system was also implemented, tracking every change made to vendor files. The university has made employee training in social engineering attacks, phishing and other online scams mandatory.

Minister Schmidt praised MacEwan for making changes to its financial department, “including some staff changes at the highest levels, which was a good first step.”

Brent Quinton, who was the university’s vice-president of finance and administration at the time of the fraud, resigned from his position three weeks after the fraud was discovered, walking away with a $540,000 severance payout.

No staff members were fired, though some were placed in different positions. Harry Oosteroff, executive director of the MacEwan Staff Association, said “our members were treated appropriately.”

The provincial government is taking steps to prevent such costly, embarrassing mistakes in the future. The Ministry of Advanced Education’s senior financial officer is now leading a team tasked with “identifying ways that we can help build capacity at institutions to improve their financial controls” so public dollars allocated for the benefit of post-secondary students don’t end up in the wrong hands.

“There are always improvements that can be made, and our department is working with institutions to continually improve the financial systems that are used to protect the taxpayers’ dollars,” Schmidt said.

After all, this isn’t the first time a post-secondary institution in Alberta has been fooled. An investigation into a similar fraud at the University of Lethbridge found that while the university had such controls in place, staff weren’t following them.

The University of Lethbridge sent $368,000 to scammers over a two-month period in 2016, “when payments owing to an external vendor of the university were sent through a process of misdirection to an alternative, nonauthentic bank account,” said Mike Mahon, president and vice-chancellor, in a statement in December 2016.

Const. Lewadniuk said low-tech solutions, such as having two people sign off on financial transactions or following up on emails with a phone call to the person or company in question, can be key in avoiding high-tech fraud.

There are institutional changes on the horizon as well. Clement, the financial crimes specialist, is eager to see stronger regulations around identifying beneficial ownership of property, corporations and bank accounts. Beneficial ownership is an arrangement in which the person who enjoys the benefits of the property or bank accounts, such as profits, isn’t necessarily the person listed on the title.

Clement said that, until recently, numbered companies would have one or two directors listed, “but there was not that requirement to drill down to see who is actually the beneficial owners of that money.”

Finance ministers across Canada entered an agreement to strengthen such regulations and bring them into force by July 1, 2019. The regulations seek to curb the misuse of corporations and other legal entities being exploited for tax evasion, money laundering, corruption and financing terrorism.

But until those regulations are brought into force and investigators are given the resources they need to chase down these types of crime, Clement fears such financial crime will continue “unabated.”

“If you stem the flow of money and stem their ability to make that profit, you can curb a lot of activity,” said Clement. “But as long as there’s that profit to be made, people are going to gamble.”

Claire Theobald is an Edmonton-based reporter who covers crime and the courts. Follow her on Twitter: @clairetheobald

With files from Michael Mui