A 32-year-old Surrey, B.C., man has been arrested and charged in connection with a cyber scam that prompted half a million dollars in city funds to be sent to a fake vendor, police say.
A staff member of a city housing affiliate received an email in March 2024 that appeared legitimate with an “altered banking details for a vendor payment,” according to police.
The email was received one month after the city was hit with a ransomeware attack in February of that year that disrupted various services and cost the city millions. Police said that incident made an environment “more vulnerable to human error and external manipulation.”
“Believing the information to be accurate, the staff member processed an electronic funds transfer for over $550,000—an amount far exceeding the actual invoice — into a bank account at a financial institution in Surrey,” police said in a news release Wednesday.
The city realized the mistake later that month, police said, after the legitimate vendor said no payment was received. Police said they, alongside the city’s auditor general and an independent forensic accounting firm, discovered the funds were put into a company account linked to the Surrey man, who “quickly dispersed the funds” into other accounts.
Police said through legal action and in collaboration with police in Surrey and Edmonton, they recovered $417,000.
“The city sustained a financial loss of over $130,000, in addition to forensic and legal expenses. The city has indicated it will pursue restitution,” police said.
CBC Hamilton reached out to the city for comment but did not receive a response before publication.
Hamilton police public information officer Adam Kimber told CBC Hamilton the “investigation is ongoing into other person(s) who received funds that were the proceeds of this fraud.”
Police obtained a Canada-wide warrant for the arrest of the man and he turned himself in on July 7 at the central police station in Hamilton, according to Kimber, after they made arrangements with his legal counsel.
According to Kimber, the man was charged with:
