Finance boss at Te Wananga o Aotearoa falls for 'whaling' scam

Jim Mather, centre, head of Te Wananga o Aotearoa, was caught up in a "whaling" scam.
Waikato Times

Jim Mather, centre, head of Te Wananga o Aotearoa, was caught up in a "whaling" scam.

The tertiary institute has enlisted Hong Kong authorities to repatriate more than $100,000 sent to offshore fraudsters.

The chief financial officer of one of New Zealand's largest learning institutions has left her job after falling for an email "whaling" scam.

The executive director of finance at Te Wananga o Aotearoa, Bronwyn Koroheke, transferred $US79,000 ($118,000) to an offshore bank account after receiving an email which appeared to be from her chief executive Jim Mather telling her to send the money.

Bronwyn Koroheke, who fell victim to a "whaling" email scam.

Bronwyn Koroheke, who fell victim to a "whaling" email scam.

In fact the email was from Chinese-based fraudsters running a whaling scam, so-called because it targets an organisation's top executives, or "big fish". They forged Mather's email address to make it look like he was sending it from a mobile device.

The scammers have been targeting New Zealand companies in recent months, prompting a warning in September from Internal Affairs for organisations to be vigilant.

It's one of the largest amounts of money sent from a New Zealand organisation to offshore email scammers.

Kiwi finance bosses have fallen for 'spoofed' emails from bosses, MPA believes
Big wananga snubs Maori king's controversial appointee
Former wananga head drops lawsuit against old empire

Koroheke agreed to resign after the incident but her supporters say she has been treated unfairly as the wananga's systems weren't capable of picking up cyber attacks.

Koroheke oversaw annual revenues of $155 million at the wananga, the second biggest tertiary institution with 32,000 students at campuses around the country.

The wananga was forced to restructure after a series of scandals and financial problems a decade ago, an Auditor-General's report finding contracts worth milllions were awarded to members of founder Rongo Wetere's family.

Ad Feedback

Mather, long-serving chief executive of Maori Television until he resigned in 2013 to take up the wananga job, said he received a text on November 19 confirming a payment had been made to an offshore account "as requested".

He launched an investigation and the payment was frozen in a bank account in Hong Kong. "The process to repatriate the funds is underway."

Mather said police here and in Hong Kong had immediately been alerted and Audit NZ was also notified.

He would not comment on the circumstances around Koroheke's departure as it was an "employment matter".

He sent an internal letter this month saying she had tendered her notice "and will be leaving us for family commitments".

Koroheke is an experienced accountant who was formerly head of the financial accounting team at Hamilton City Council and was appointed to the wananga's senior leadership team last year.  Both parties have signed a confidentiality agreement and Koroheke said it prevented her from commenting.

A close friend said Koroheke's resignation was unfair considering TVNZ had fallen for a similar scam recently.

"You can't stop something like this. She put her hand up for a degree of culpability but it should be shared culpability. The organisation is really not prepared for those kinds of cyber attacks."

But Mather said the wananga's  security settings and other controls were appropriately set.

"We have re-emphasised to staff the necessity for strict adherence to our accounts payable policies and procedures. It highlights the need for protocols and checks and balances to be followed."

Toni Demetriou, manager of the electronic messaging and compliance unit at Internal Affairs, said the department sent out a warning in September about "whaling" scams and the importance of organisations putting safeguards in place.

A single person should not have sole responsibility for money transfers and the scam highlighted the need for appropriate checks and balances.

Demetriou said there had been three or four cases where money had been sent and in some cases companies had been able to recover funds through the banks involved.

Thom Hooker, chief technology officer with email security company SMX, said the scammers were going to greater lengths than ever before.

"They are going to the trouble of researching a company, identifying individuals and then creating a domain to prop up a forging attempt to try and elicit the funds, they're actually spending money to do this."

Hooker said if the scammers didn't have a chief executive's email signature they would make it look like it was sent from a mobile device.

"They tend tend to play on people's desire to be helpful. They'll say something like 'I'm off site today can you help me out, a wire transfer needs to be paid urgently'."

Staff needed to have up to date security awareness training.

"You can put all the algorithms and computer hardware in place but if the people aren't going to stop and think 'am I following the process?' then all the security in the world isn't going to help. The human factor is the weak link in the chain."

* Email correspondence begins with a simple email query from the "CEO" to the CFO asking if they're available, before progressing to request an urgent funds transfer.
* The emails may say they have been sent from an iPhone, iPad or similar. This may be an attempt to distract the recipient from the fact that the CEO's normal email signature is not featured in the message.
* The spoofed email address domain of the "CEO" may be slightly different than it should be; for example it may end in ".biz" rather than "".

 - Sunday Star Times

Ad Feedback
special offers

Blistering pace

Waitākere Cricket Club's Ben Lister has been called up to Auckland's senior squad for this season.

Young west Auckland bowler Ben Lister called up to Auckland Aces.

Million dollar wind fall

The winning ticket in Wednesday night's $1 million draw was sold at Countdown Browns Bay on Auckland's North Shore.

Mid-week celebrations for a lucky Aucklander after Lotto win.

Children love the taniwha

Mahi Pai at Manukau Institute of Technology.

More than 1500 South Auckland youngsters were treated to the very popular Mahi Pai taniwha performance over Māori Language Week.

Wide Awake at Hawkins Theatre

Hawkins Theatre is staging the play Wide Awake.

An award winning children's play is hitting the stage in Papakura.


Eli gains loyal, helpful friend video

Six-year-old Eli Burkhalter with  his new assistance dog Taffy.

Taffy the golden labrador is a welcome companion for six-year-old Waikanae boy.

Kids sick on synthetics

Synthetic drugs, often mixed with dried leaves resembling cannabis, have claimed at least 20 lives in New Zealand this ...

Youngest was just 5 as three Porirua kids taken to hospital severely ill.

SH1 blockage cleared

NZTA advised of delays on around the Paremata roundabout and Mana on State Highway 1 after a three-car crash at Plimmerton.

Minor delays continue after a two-car crash near Plimmerton.

Capital train strike likely

Capital commuters are likely to face disruptions as rail workers prepare to strike.

Disruptions ahead for Wellington rail commuters as employment dispute boils over.


'Bound together by cancer' video

Christchurch father of two  Kevin "Chalky" Carr received the news that his pancreatic cancer was back  and his prognosis ...

This time last week, cancer patient Chalky Carr had never met Isla Lunn. Now he's raising $100,000 for the 7-year-old.

Service 'horrific' video

Michelle Bishop is upset at the service received by funeral home Poppy Funerals following the death of her daughter ...

Woman calls for funeral industry to be regulated after ongoing problems following her daughter's death.

Who won the final debate? video

AUCKLAND, NEW ZEALAND - SEPTEMBER 20:  Labour party leader Jacinda Ardern speaks during the TVNZ Vote 2017 2nd Leaders ...

Jacinda Ardern looked and sounded like a woman in a fight for her political life. And she is.

Bike theft at bottle-point

Two friends were robbed of their bikes at bottle-point near Papanui High School.

The two robbers fled on bikes stolen from men in Northcote, Christchurch.


Seven daring ducklings rescued 

The rescue operation saw the safe retrieval of seven ducklings from a Whitianga drain.

It took half an hour to rescue the seven ducklings from the depths of the drain.

Cocaine, cash found

The armed offenders squad helped execute a search warrant in Te Aroha.

Seven searches in Te Aroha were undertaken netting cocaine, cash and five arrests in a pre-dawn raid.

Historic pub killing set for trial

Chris Bush was shot and killed in October 1987.

Two men to stand trial next year over the murder of pub manager Chris Bush 30 years ago.

Kiwis want water levy

Farmers protested perceived attacks from politicians in Morrinsville on Monday, September 18. A new survey shows the ...

The majority of Kiwis want to see farmers pay for water use, a new survey shows.


Ngā Manu Kōrero begins

Dr Ruakere Hond addressed the manuhiri (visitors).

Students from 52 schools across Aotearoa have arrived in New Plymouth for a speech competition.

Principal search

Lynda Stuart, president of the NZEI, said there are ore principal vacancies than usual.

Four schools are looking for principals, and another four are looking for deputies and assistants.

The 'hero' in the beauty aisle

Shane White's training kicked into action as soon as he got to the man who collapsed in the beauty aisle.

Ian Foreman collapsed in a New Plymouth supermarket only for the produce manager to save his life.

Truck rolls, spills load of urea

A truck rolled on Opunake Rd, spilling urea, and blocking the area to traffic.

Truck and trailer unit rolls and spills load.


The final debate video

From left, Greens candidate Thomas Nash, NZ First MP Darroch Ball, National candidate Adrienne Pearce, Money Free Party ...

Palmerston North candidates battle over mental health and Manawatū Gorge at final debate.

MP flees farmers

Labour candidate for Palmerston North Iain Lees-Galloway left a farmer meeting about irrigation tax early.

Labour MP claims he was "physically pushed" and his van rammed.

Suspected armed robbery at BP

The BP service station in Main St, Palmerston North, has had another suspected aggravated robbery.

Two people are believed to have carried weapons into a BP and robbed it in Palmerston North.

Debate strikes useful balance

The Manawatu Standard candidates debate was broadcast live on Facebook.

OPINION: Election campaign meeting mixes information with humour and differences.


'What's a candidate?' video

Birchwood School students from left Jacob 8, Talei 9, Mia 8, talk to Stuff about their thoughts on the election and politics.

They can't legally vote until 2029, but they still have strong views on the election.

Earthquake jolts NZ

The quake was centred 30 kilometres northeast of Seddon.

Central New Zealand jolted by a short and sharp earthquake.

Power back on

A power outage on Wednesday afternoon has affected residents in Richmond, Brightwater, Wakefield and Mapua.

Power has been restored to 12,000 homes and businesses after a Transpower fault. 

Kea shooter sentenced

A man's been sentenced to 200 hours community work for killing a kea.

A man who shot at kea who were damaging his property has been sentenced to community work.


Dinner's in the bag

Sous chef Emily Hulburt, 5, helps out in the kitchen preparing a 'My Food Bag' recipe.

By her own admission, reporter Paula Hulburt is a whizz with a microwave. As the first delivery of My Food Bags arrive in Blenheim, she took one for a test drive.

Earthquake jolts NZ

The quake was centred 30 kilometres northeast of Seddon.

Central New Zealand jolted by a short and sharp earthquake.

Cafe confrontation

Prime Minister Bill English stopped in at BV Gourmet in Blenheim on the campaign trail on Tuesday. (File photo)

PM's coffee break gatecrashed as Labour candidate accuses National supporters of ripping down billboards.

Weather closes newly-fixed rail line

The Main North Line between Picton and Christchurch has been closed due to bad weather, just days after its post-quake ...

Just a single train managed to traverse the newly-repaired rail line from Christchurch to Picton before bad weather closed it again.

South Canterbury

Men's health focus of campaign

Jonty Penney from Timaru is participating in the Distinguished Gentleman's Ride to raise funds for men,s health.

Two Timaru men are taking the health message on the road.

Flow-on concerns

David Hurst, from A J Engineering in Washdyke, is concerned about the impact of the water levy.

S Canty businesses concerned about impact of Labour's water levy, spokesman says concerns unjustified.

New Mackenzie CEO

New Mackenzie council chief executive Suzette van

A current staff member will take on the top job at the Mackenzie District Council.

'He's a hero,' neighbour says

The remains of the Waipopo property on Wednesday afternoon.

Waipopo man who rescued wife from fire would have used 'every bit of strength'.


Search for missing man

Missing Dunedin man Stephen Lowe.

More than 30 ground searchers, three search dogs and an aerial search have failed to find any further sign of missing Dunedin man Stephen Lowe

Serial sea lion killer at large video

A sea lion found shot on a Catlins beach in Southland in April.

A serial killer may be targeting New Zealand sea lions, with a $5000 reward on offer in exchange for the culprit.

Fired while on sick leave

The Employment Relations Authority (ERA) has ordered Oamaru-based P&W Painters (PWP) to compensate former employee Paul ...

Company that unfairly fired brush hand while on sick leave also had to compensate an ex-staffer who was called a "baby killer".

Kidnapping duo plead guilty

Nick Miles, 24, and Gary Michael Wilson, 46, have admitted kidnapping a man and dumping him on the outskirts of Dunedin.

Two men kidnapped and dumped another man on the outskirts on Dunedin.


Youth organisations make appeal

Sam Balloch was one of dozens of volunteers seeking signatures for a petition to keep Number 10 One Stop Shop and ...

Number 10 Youth One Stop Shop and the Invercargill Secondary Schools Network are gathering support for their petition to remain at their current location.

Pound in clear

An animal group and the Invercargill City Council are at odds about how a dog was treated. (File photo)

Ministry for Primary Industries clears the Invercargill City Council over captive bolt use.

Forestry gets favour: ES

Nicol Horrell, chairman of Environment Southland.

''Forestry operators will be able to operate at lower environmental standards than other resource users in Southland."

Quake off Southland coast

A magnitude 5.8 quake struck near Southland.

A 5.8 earthquake hit off the coast of Southland - but its shaking was unnoticeable, GeoNet says.

Ad Feedback