A clerical employee at McEwan University in Edmonton took the word of an authoritive-looking email that said all payments to Clark Builders, a firm constructing a new building for the university, should be re-routed to a new bank account. As a result, the university is out nearly $12 million. The school didn’t realize what had happened until Clark called to ask why it hadn’t been paid. Of the $11.8 million diverted by this fraud, police say $11.4 million has been frozen in bank accounts in Hong Kong and Montreal although when and how it might be returned is unclear. It is a statement about carelessness, but also about the authority that we place in email. Accountants say it is unfair to pin the blame on low-level staff. Bank account changes, they are say, are unusual. They should be treated like a request to access your own bank account. Such changes should be sent right to the top of an organization. But it seems no such protocol was in place.
