'It's really a coin flip': Experts weigh in on if Sudbury will recover $1.5M lost to fraud

The City of Greater Sudbury is hoping to recover more than $1.5 million it lost late last year when fraudsters infiltrated the email account of the contractor handling the Lorraine Street development – but experts say getting money back after a fraud, isn’t that easy.

“It really is a coin flip whether you’re able to recover or not,” said cyber security expert and technology analyst Ritesh Kotak.

Kotak told CTV News that this is not the first time a business or organization has fallen victim to what he calls “social engineering attacks” – where access is gained to information before a fraud actually occurs.

“This (case) is a very complex situation with multiple stakeholders and it’s happening more frequently,” he said.

“And it’s becoming even harder to catch the individuals that are literally weaponizing our banking systems.”

City officials said the contractor’s email account was hacked and previous email chains were used to legitimatize the request to change bank account information prior to staff sending payment for work done.

The Canadian Anti-Fraud Centre (CAFC) said this kind of attack is called spear phishing.

“Fraudsters, in a lot of cases, will set up a rule if they have infiltrated the network where incoming emails to that account go to an alternate email and the supplier wouldn’t necessarily see the communication going back and forth because the emails are getting redirected to an alternate email,” said Jeff Horncastle, a client and communications outreach officer with the CAFC.

Canadians lost more than $58 million in the 1,239 spear phishing fraud cases reported to the Canadian Anti-Fraud Centre in 2023. (CTV News Northern Ontario)Horncastle told CTV News that spear phishing was the second most costly form of fraud reported to the centre last year with more than $58 million lost to 668 victims – but there could be many more victims that never reported incidents to the national fraud centre.

Experts said after money is handed over, fraudsters use sophisticated technology to cover their tracks.

“Historically it’s very low that they’ll be able to collect the money and the reason for that is once the money has been transferred it has most likely been transferred to bank accounts to bank account to bank account,” said Kotak.

“Then it is very hard to trace, it is very hard to get that money back.”

Experts who spoke with CTV News said the solutions for avoiding high-tech crimes such as this case are actually quite low-tech – things like phoning to verify payment requests or setting up protocols and procedures for changing payment information with clients that have fail-safes or verifications in place.

• Download the CTV News app now and get local alerts on your device
• Get local breaking news and updates sent to your email inbox
• Want more local news? Check out the Sudbury page

The city's case on the matter will be heard in a Toronto courtroom at a later date.