Someone in Nunavut was scammed out of $3M last year. RCMP are still trying to find out who did it

Nearly $3 million was lost in a single incident of spear-phishing in Nunavut last year, according to the RCMP. 

Nunavut RCMP Cpl. George Henrie told CBC News because the case is still under investigation, no further details will be released. 

Henrie also said no one has been charged in connection to the incident. 

According to data provided to CBC News by the Canadian Anti-Fraud Centre, almost all of Nunavut's $3,006,533.67 fraud losses in 2024 were from a single victim of spear phishing, who lost $2,956,653.67.

The Nunavut RCMP put out a notice in November, warning people about an increase in "fraudulent activity" in the territory, but did not mention the $3-million loss.

Highly targeted attacks 

Kwasi Boakye-Boateng, a research associate with the Canadian Institute for Cybersecurity, said spear phishing is "highly targeted" compared to other types of phishing scams. 

Whereas regular phishing could ask for general information, spear phishing usually targets specific individuals or organizations. 

"For spear phishing to actually succeed, they would have to first personalize themselves as someone the victim knows," Boakye-Boateng said. 

"So attackers would go on various, for example, social media websites or read emails, go to LinkedIn, Facebook, TikTok, anywhere they can get relevant information about who they want to impersonate," he said. 

Boakye-Boateng said it used to be easier to detect attacks over email because words would be spelled wrong or details would be incorrect. Artificial intelligence has changed that. 

"Now, because there's ChatGPT, or all these other names out there, adversaries can easily craft emails that are well-written and make a lot of sense." 

For example, he said, someone could send a fake LinkedIn request that asks for login details before accepting. Those details would then be stolen and used to impersonate someone. 

"What I would recommend people to do is that anytime you receive an email, you need to check who's [it] being sent from. You need to sometimes hover the mouse over the sender and then you can notice that, OK, the e-mail address isn't in the right format."

Boakye-Boateng said people should also call the person in question to verify it's them who sent the email. 

Jeff Horncastle, client and communications officer at the Canadian Anti-Fraud Centre, said it's not extremely common for spear phishing scams to be into the millions of dollars, but people should always be cautious. 

He said spear phishing could also look like an invoice sent to a contractor. 

"So if you get a request, even if the invoice is the actual, you know, invoice number, we have to remember that the supplier's network could be infiltrated," Horncastle said. "So we want to add a second verification step where the victim is picking up the phone and verifying with the supplier." 

In an email to CBC News, a spokesperson from the Nunavut government said they were not the target of the November 2024 attack. 

The data for Nunavut  is part of a feature for CBC's Marketplace airing Friday. 

The Marketplace team joins professional scam busters as they crack into the networks of organized criminal groups, confront the fraudsters and expose how AI is making it so much harder to defend ourselves. The show airs at 8 p.m.