The Toronto District School Board is trying to recoup more than $1 million in public funds it lost in a cyberscam that experts say was “highly preventable.”
The public school board says a fraudster represented themselves as a long-time contractor for school renewal projects and tricked the TDSB into wiring $1.08 million to a Toronto-Dominion Bank account.
The TDSB has not publicly disclosed the 2024 fraud, which the Star discovered in reviewing court records.
In September, the board sought a court order that would force TD, which has already put a hold on the money, to disclose all banking information related to the alleged fraud. The TDSB’s statement of claim also goes after the anonymous scammer, suing “John Doe” for more than $2 million in total damages.
The TDSB is the latest public-sector institution that has fallen prey to a spate of online impostor scams across Canada in recent years. A 2024 Star investigation found at least six cities and two First Nations had been duped out of more than a total of $10 million from 2019 to 2023. Experts describe the frauds siphoning public funds as “a major Canadian problem” and indicate a lack of basic controls in the public agencies.
“What astounds me, given that there’s a history of this type of occurrence, why wouldn’t they be extremely careful?” said Ann Cavoukian, Ontario’s former privacy commissioner, who now works as the executive director of Global Privacy and Security by Design Centre.
She said the public sector appears to be an “easy target” for the fraud as they don’t seem to have taken necessary measures to prevent it.
‘So many red flags’
Claudiu Popa, a longtime cybersecurity expert who reviewed the TDSB’s court filing, said it was an unsophisticated “low-tech” scheme that should have been detected with “base-level” fraud prevention.
The fraudster used an email address that contained an extra letter from the real contractor’s account, and sent a fake invoice that misspelled the word “collegiate,” according to the lawsuit.
“We’re talking about some guy who could barely spell who sent an email. It’s shocking to me that professionals in 2024 would fall for this kind of thing. It’s highly preventable with basic due diligence,” he said.
“There were so many red flags.”
TDSB spokesperson Ryan Bird said the board was unable to speak directly to the ongoing litigation. He noted the TDSB has since “strengthened controls in place and have provided additional anti-fraud training for all impacted staff.”
He did not answer questions about why the school board had not publicly acknowledged the loss of the public funds.
Popa, who’s spent decades investigating cybercrime and educating the public, said frauds in the public sector don’t usually get publicized.
“In this case it had to be because it was such a gross violation of due diligence and the amount was so high,” he said.
“It should be embarrassing and humiliating for this institution.”
TDSB faces mounting deficit
The TDSB’s attempt to recoup its stolen money comes as it struggles to curb its growing deficits, which were projected to be more than $34 million for the current school year.
Public school boards are primarily funded by the province. In June, the Ontario government appointed a supervisor to take over TDSB’s financial decision-making and operational oversight following an auditor general’s report that raised concerns about the school board’s financial management.
As part of its operating budget, the TDSB receives hundreds of millions of dollars each year from the Ministry of Education to meet its school renewal needs, to upgrade or replace things such as roofs, windows or electrical systems. Last year’s projects included a generator upgrade at Stephen Leacock Collegiate Institute in Scarborough.
The more than $1 million swindled out of the TDBS’s coffers was intended to pay a Vaughan-based contractor called LCD Mechanical Inc. for its work at Stephen Leacock, but it was sent to a fraudster’s account instead.
LCD Mechanical is an engineering and construction organization that has been contracted by the TDSB to complete various school renewal projects since 2021.
How the fraud unfurled
The lawsuit details how the fraudster impersonated a procurement officer from LCD Mechanical by sending an email from an address that is similar to the officer’s account, and using a variety of company names such as “LCD Mechanics,” “LCD Mechanicals” and “LCD Mechanic Inc.” in their communications.
In summer 2024, the fraudster allegedly requested the TDSB update its banking information to an account registered with a TD branch nestled in a strip mall in Hamilton. The TDSB sent $1,080,260.65 to the new TD account.
The morning after the money was transferred, the school board’s own bank, Canadian Imperial Bank of Commerce, flagged the transfer as “a potential fraudulent incident” to TDSB, which then asked the bank to recall the funds. The money was subsequently put on hold with TD bank, the lawsuit says.
TD was named in the statement of claim for “the limited purpose of obtaining court-ordered disclosure,” the school board spokesperson said.
“We are now moving through the court process to have it returned by the bank,” Bird said.
