A Canadian university has unintentionally lost nearly $10 million after falling prey to an online phishing scam.
Officials at MacEwan University in Edmonton, Alberta recently received fake emails that said they were from one of the school’s major vendors, and that the vendor was changing its banking information, according to BBC News. The staff then paid money into the new banking account — which did not go to their client.
Three staffers made payments in three separate installments, according to the Toronto Star. The funds totaled $9.5 million or $11.8 million Canadian dollars.
The mistake was only discovered when the actual client called the university, saying it had not yet been paid, BBC News reported.
Police have now tracked the majority of the money to bank accounts in Montreal and Hong Kong, and are working to recover the money.
MacEwan University has said it is conducting a review of its practices to prevent a similar fraud from taking place in the future. An initial investigation found the university’s processes “inadequate,” according to BBC.
“There is never a good time for something like this to happen,” university spokesman David Beharry said in a statement, according to BBC. “As our students come back to start the new academic year, we want to assure them and the community that our IT systems were not compromised during this incident.”
More Must-Reads From TIME
- The 100 Most Influential People of 2024
- The Revolution of Yulia Navalnaya
- 6 Compliments That Land Every Time
- What's the Deal With the Bitcoin Halving?
- If You're Dating Right Now , You're Brave: Column
- The AI That Could Heal a Divided Internet
- Fallout Is a Brilliant Model for the Future of Video Game Adaptations
- Want Weekly Recs on What to Watch, Read, and More? Sign Up for Worth Your Time
Write to Abigail Abrams at abigail.abrams@time.com