Manitoba municipality loses $514K in alleged fraud

Hey there, time traveller!
This article was published 22/11/2022 (1080 days ago), so information in it may no longer be current.

A Manitoba municipality says it has lost more than $514,000 after an employee allegedly e-transferred funds out of its bank account without permission.

Gilbert Plains Reeve Jim Manchur said multiple unauthorized transfers were brought to council’s attention by its credit union, after which it brought in MNP accounting firm for a third-party inquiry.

After a nearly six-month-long investigation, Gilbert Plains contacted the RCMP.

“It’s obviously shocking, and kind of unbelievable, that it did happen,” Manchur said Tuesday.

A single employee who had access to the municipality’s e-transfer software has been fired for just cause, Manchur said, declining to name the suspect.

The municipality, 360 kilometres northwest of Winnipeg with a population of roughly 1,600, sent out a letter this month to residents explaining the situation. The letter also explained steps it had already taken to ensure there was more financial oversight in the future, including regular audits and dual authorization on e-transfers.

An insurance claim has been filed for the lost finances. Manchur said he’s hopeful, but not sure, the money will be covered.

“We do have quite strong financial reserves within our municipality, so we intend to conduct business as we intended,” he said. “In the future, we’ll still be putting a budget ahead in the new year, and we’re going to continue with the budget we presented last spring.”

More than 30 allegedly unauthorized transactions between 2020 and 2022, along with findings by MNP, were presented to the police on Nov. 9, said RCMP Sgt. Paul Manaigre. Police have yet to make contact with the suspect.

“The investigation is at the point now where we’re reviewing the documents that were provided, and I can’t speak on a time frame, I don’t know how long that will take… I will say I’m quite confident this all will eventually lead to charges and into the court system,” he said.

An e-transfer scam due to an external cyberattack cost the Rural Municipality of Westlake-Gladstone more than $472,000 when multiple withdrawals were made from its account in December 2019 and January 2020.

The RCMP has since closed that case without making an arrest. Westlake-Gladstone is in litigation with two insurance companies and Stride Credit Union.

Mayor Daryl Shipman said he was disappointed, but not surprised, at the lack of an arrest in part because cyberattacks are difficult to persecute and the RCMP cybercrime division was working with limited resources.

“Was it going to get the money back? Probably not, because (when) it’s gone, it’s out there somewhere in cyberspace and spread out wherever it was going to already. It’s not like it’s in a lockbox somewhere we can just go and grab it,” he said Tuesday.

“Other than trying to bring the people to justice, which I would have liked to have seen, because they’re going to just keep on doing this elsewhere in the world.”

It can be difficult for a small business or municipality (many of which have just one or a few people responsible for overseeing its money) to gauge just how much they need to invest in cybersecurity, Winnipeg-based Avenir IT president Mathieu Manaigre said.

“Organizations, especially smaller organizations, tend to trust their staff too much… It’s important, and oftentimes it goes overlooked, the importance of having security policies as far as who can access what, when can they access these things, how can they access these things, which computers are they using to access these things,” he said.

Smaller organizations have begun to step up cybersecurity in recent years, he said.

Avenir IT’s own cyber liability insurance 10 years ago just required a signature. Now, clients are often required to fill out questionnaires explaining how they’ve prioritized online safety before receiving any kind of insurance, Manaigre said.

While there are steps organizations can take to reduce the chance of human error, human error with intent to cause harm is less common, he said.

“To me, that’s still a pretty rare thing, at least at this level.”

The Association of Manitoba Municipalities expressed its support for Gilbert Plains leadership and residents in a statement released on Tuesday.

“The AMM recognizes cybersecurity is a growing concern for local governments across Canada, including Manitoba,” it reads.

“The AMM has shared informational materials with all municipalities related to cybersecurity risk management, while we have also offered sessions to help mitigate risks to cyberattacks and data breaches.”

malak.abas@freepress.mb.ca