Hackers steal R100 million from South African University — but lost most of it
The University of Mpumalanga almost lost R100 million after a forged email convinced senior staff that its asset manager’s banking details had changed from Standard Bank to FNB, City Press reported.
Citing sources within the university’s management team, the paper reported that the social engineering attack was “strongly suspected” to be an inside job.
However, the university denied this, saying that an internal investigation uncovered no evidence of an inside job.
According to the report, Mpumalanga university finance executive director Kevin Pather discovered something was amiss during a phone call with their investment broker on 2 July 2021.
The university is with Ninety One, formerly Investec Asset Management.
When the broker informed Pather that the money was not reflecting in Ninety One’s account, Pather reportedly explained they had received an email from a person at an Investec telling them that Ninety One’s banking details had changed.
The scammer impersonated someone from Investec who regularly corresponds with Mpumalanga university’s revenue and expenditure director, Oliver Mbhalati.
The broker informed Pather that Ninety One’s banking details had not changed.
This prompted a closer inspection of the email Mbhalati received, which turned out to be a forgery.
Investec contacted FNB to stop the false account, and the university contacted its bank—Standard Bank—to stop or recall the transfer.
Fortunately, FNB had detected the suspicious transfer and had already stopped the account on 2 June after a withdrawal of R3,000 was made.
It returned R99,997,010.25 to the university. As a result, the institution suffered a loss of only R2,989.75 due to the fraud.
In a statement to City Press, the university said that it opened a fraud case with the police and put additional security measures in place to mitigate future attacks.
Nischal Mewallal, Sabric CEO
The South African Banking Risk Information Centre (Sabric) published its annual crime statistics for 2020 this week, which showed that digital banking fraud increased by 33%.
“Covid-19, in conjunction with the implementation of regulations of the Disaster Management Act, had a notable influence on financial crime trends in 2020,” Sabric stated.
“It triggered changes in human behaviour, human movement, and policing, creating new opportunities for criminals which significantly impacted the number of crime incidents.”
Sabric said that while some crime types decreased, others increased as criminals exploited Covid-19 for their own gain.
“Overall, Sabric has seen an increase in banking crime incidents.”
Loading ...