Please see below a media release issued by the City of Burlington.
Burlington, Ont. — June 13, 2019 — On Thursday, May 23, the City of Burlington discovered it was a victim of fraud. A single transaction was made to a falsified bank account as a result of a complex phishing email to City staff requesting to change banking information for an established City vendor. The transaction was in the form of an electronic transfer of funds made to the vendor in the amount of approximately $503,000 and was processed on May 16.
Upon learning of the fraudulent payment, the City took immediate steps. We reported the unauthorized payment to our financial institution; we notified the Halton Regional Police; and we put in place additional internal controls to prevent this from occurring in the future. Criminal investigations are also underway by the appropriate authorities.
A full review of our current processes will determine the need for other changes. The City can confirm that our IT system was not compromised during this incident; no personal information was stolen or shared.
These types of targeted attacks are all too common and can take many forms. Governments and businesses are just as prone to scams as are individuals. In 2018 alone, the Canadian Anti-Fraud Centre (CAFC) received 2,263 reports of business fraud incidents of various kinds, with a total reported loss of $17,501,617.
To maintain the integrity of ongoing investigations, the City will not be commenting further at this time. Additional information will be shared publicly when it becomes available.
“We are taking this matter very seriously. City staff took immediate action including notifying members of Council and our Audit Committee when the incident was first discovered. We are working closely with the police in their ongoing criminal investigation and we have also initiated an independent external investigation of the incident, which will be part of our reporting back to Council and the Audit Committee.” — Tim Commisso, Interim City Manager
This was a case of online fraud with falsified documents at a level of sophistication not typically seen and we are taking the necessary steps to prevent it from happening in the future. We are pursuing full recovery of the funds and I have asked City staff to report back to Council as soon as it can on what internal processes have changed and to keep us updated on the recovery of funds and the criminal investigation. This stresses just how important it is that we are all vigilant and recognize the signs of online fraud, phishing and other scams, and report them to the proper authorities — so that no one becomes a victim of this type of criminal activity.