The $1 Million Typo: How the TDSB Was Tricked

The scam was a textbook example of Business Email Compromise (BEC). A fraudster managed to insert themselves into a digital conversation between the TDSB and one of its legitimate vendors.

Thank you for reading this post, don't forget to subscribe!

The Play-by-Play

1. The Impersonation: The scammer created an email address that looked nearly identical to a contractor the board already worked with.
2. The “Update”: They sent a message claiming the company had changed its banking information and requested that all future payments for ongoing construction projects be sent to a new account.
3. The Red Flags: According to reports and internal leaks, the email was riddled with basic spelling mistakes and grammatical errors—the kind of “red flags” usually caught by basic spam filters or a quick proofread.
4. The Transfer: Despite the unprofessional tone and lack of verification, the TDSB’s finance department authorized the change. A payment of approximately $1 million was wired directly into the fraudster’s account.

Why It Matters: A Pattern of Failure

The timing of this fraud couldn’t have been worse for Canada’s largest school board. It highlights a significant gap between their massive scale and their day-to-day administrative oversight.

• Human Error vs. System Security: The board’s IT systems weren’t “hacked” in the traditional sense; instead, the “human firewall” failed. No one picked up the phone to verify the banking change with the contractor.
• Provincial Scrutiny: This incident served as a primary catalyst for the Ontario government’s decision to appoint a provincial supervisor to oversee the board.
• The “Pencil Sharpener” Legacy: Critics have pointed out that the board has a history of procurement issues, famously highlighted years ago when it was revealed they were paying hundreds of dollars for the installation of single pencil sharpeners.

The Current Status

The TDSB has since tightened its Electronic Funds Transfer (EFT) protocols. New rules typically require “two-factor” human authentication—meaning if a vendor asks for a change in payment details, at least two board employees must verbally confirm the change with a known contact at the company.

While some of the funds involved in these types of scams are often frozen by banks if caught early enough, a significant portion of the $1 million was reportedly moved through various accounts, making full recovery difficult.