{"meta":{"database":"Global Social Engineering Impact Database","license":"CC BY 4.0 — attribute to Netarx Social Engineering Incident Database","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2018-city-of-ottawa-treasurer-wires-about-us-98-000-to-fake-city-manager"},"incident":{"title":"City of Ottawa treasurer wires about US$98,000 to fake city manager","date":"2018-07","date_precision":"month","victim_org":"City of Ottawa","sector":"Government","country":"Canada","primary_vector":"Business Email Compromise","secondary_vectors":[],"ai_involvement":"No AI reported","ai_notes":"No AI or synthetic media reported.","outcomes":["Wire Fraud / Financial Loss"],"loss_usd":98000,"loss_note":"Approximately US$98,000 wired (reported locally as roughly C$128,000). A second request for US$150,000 was blocked. The U.S. Secret Service monitored a receiving account and an individual connected to the scheme was arrested.","records_affected":null,"threat_actor":null,"summary":"In July 2018 Ottawa city treasurer Marian Simulik wired about US$98,000 after receiving emails purporting to come from city manager Steve Kanellakos requesting funds to complete an acquisition. Five days later a second email requested US$150,000; Simulik happened to be sitting beside Kanellakos at a council meeting, asked him directly, and learned the request was fraudulent. The auditor general found no wrongdoing by city staff, and U.S. authorities arrested an individual linked to the receiving account.","how_it_worked":"The attacker impersonated the city manager, the one person whose instruction the treasurer would be least likely to challenge, and framed the payment as a confidential acquisition requiring a quick wire. The exchange ran over several emails, letting the fraudster answer questions and build rapport in the city manager's voice, which reinforced authenticity. Because the amount was modest by municipal standards and the requester was the treasurer's superior, the transfer cleared normal handling. The scheme unraveled only by coincidence when the treasurer was physically next to the real city manager during a follow-up request, illustrating that the control that caught it was luck rather than process.","lessons":"Executive-initiated wire requests should require verbal confirmation on a known number before release, and municipalities should bar email as an authorization channel for funds transfers entirely.","confidence":"Confirmed","sources":[{"title":"City of Ottawa treasurer fell victim to US$100K phishing scam: auditor general","url":"https://obj.ca/city-of-ottawa-treasurer-fell-victim-to-us100k-phishing-scam-auditor-general/","publisher":"Ottawa Business Journal"}],"entry_type":"incident","slug":"2018-city-of-ottawa-treasurer-wires-about-us-98-000-to-fake-city-manager","year":2018,"loss_kind":"direct_loss","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2018-city-of-ottawa-treasurer-wires-about-us-98-000-to-fake-city-manager"}}