Hamilton lost more than $274,000 after a vendor’s EFT details were changed twice

The City of Hamilton lost more than $274,000 after someone posing as a vendor got staff to change electronic fund transfer banking details — twice. In late November 2023 an email asked for the first change; after a back-and-forth and the usual forms, staff updated the vendor’s EFT information. About a month later another request came in for January. Forms arrived. Documentation looked right. The city changed it again.

In early February 2024 the real vendor called: they hadn’t been paid since mid-November. Several payments totaling more than $274,000 had gone into two accounts controlled by the fraudster. The investigation found the vendor wasn’t in on it — their mailbox had been taken over in a business-email compromise. Someone inside that inbox could send, receive, and intercept as the vendor while Hamilton thought it was talking to a known supplier.

The city ate the loss and tightened the rule: staff now phone any vendor who asks to change billing information. Bank-detail changes are not email errands.

If you want a plain read on whether strangers can email as your company — spoofcoach.com. Free.