A Canadian University Just Lost $10M In an Email Phishing Scam

A Canadian university has unintentionally lost nearly $10 million after falling prey to an online phishing scam.

Officials at MacEwan University in Edmonton, Alberta recently received fake emails that said they were from one of the school’s major vendors, and that the vendor was changing its banking information, according to BBC News. The staff then paid money into the new banking account — which did not go to their client.

Three staffers made payments in three separate installments, according to the Toronto Star. The funds totaled $9.5 million or $11.8 million Canadian dollars.

The mistake was only discovered when the actual client called the university, saying it had not yet been paid, BBC News reported.

Police have now tracked the majority of the money to bank accounts in Montreal and Hong Kong, and are working to recover the money.

MacEwan University has said it is conducting a review of its practices to prevent a similar fraud from taking place in the future. An initial investigation found the university’s processes “inadequate,” according to BBC.

“There is never a good time for something like this to happen,” university spokesman David Beharry said in a statement, according to BBC. “As our students come back to start the new academic year, we want to assure them and the community that our IT systems were not compromised during this incident.”

Write to Abigail Abrams at abigail.abrams@time.com.