Finance boss at Te Wananga o Aotearoa falls for 'whaling' scam

Jim Mather, centre, head of Te Wananga o Aotearoa, was caught up in a "whaling" scam.
Waikato Times

Jim Mather, centre, head of Te Wananga o Aotearoa, was caught up in a "whaling" scam.

The tertiary institute has enlisted Hong Kong authorities to repatriate more than $100,000 sent to offshore fraudsters.

The chief financial officer of one of New Zealand's largest learning institutions has left her job after falling for an email "whaling" scam.

The executive director of finance at Te Wananga o Aotearoa, Bronwyn Koroheke, transferred $US79,000 ($118,000) to an offshore bank account after receiving an email which appeared to be from her chief executive Jim Mather telling her to send the money.

Bronwyn Koroheke, who fell victim to a "whaling" email scam.

Bronwyn Koroheke, who fell victim to a "whaling" email scam.

In fact the email was from Chinese-based fraudsters running a whaling scam, so-called because it targets an organisation's top executives, or "big fish". They forged Mather's email address to make it look like he was sending it from a mobile device.

The scammers have been targeting New Zealand companies in recent months, prompting a warning in September from Internal Affairs for organisations to be vigilant.

It's one of the largest amounts of money sent from a New Zealand organisation to offshore email scammers.

Kiwi finance bosses have fallen for 'spoofed' emails from bosses, MPA believes
Big wananga snubs Maori king's controversial appointee
Former wananga head drops lawsuit against old empire

Koroheke agreed to resign after the incident but her supporters say she has been treated unfairly as the wananga's systems weren't capable of picking up cyber attacks.

Koroheke oversaw annual revenues of $155 million at the wananga, the second biggest tertiary institution with 32,000 students at campuses around the country.

The wananga was forced to restructure after a series of scandals and financial problems a decade ago, an Auditor-General's report finding contracts worth milllions were awarded to members of founder Rongo Wetere's family.

Ad Feedback

Mather, long-serving chief executive of Maori Television until he resigned in 2013 to take up the wananga job, said he received a text on November 19 confirming a payment had been made to an offshore account "as requested".

He launched an investigation and the payment was frozen in a bank account in Hong Kong. "The process to repatriate the funds is underway."

Mather said police here and in Hong Kong had immediately been alerted and Audit NZ was also notified.

He would not comment on the circumstances around Koroheke's departure as it was an "employment matter".

He sent an internal letter this month saying she had tendered her notice "and will be leaving us for family commitments".

Koroheke is an experienced accountant who was formerly head of the financial accounting team at Hamilton City Council and was appointed to the wananga's senior leadership team last year.  Both parties have signed a confidentiality agreement and Koroheke said it prevented her from commenting.

A close friend said Koroheke's resignation was unfair considering TVNZ had fallen for a similar scam recently.

"You can't stop something like this. She put her hand up for a degree of culpability but it should be shared culpability. The organisation is really not prepared for those kinds of cyber attacks."

But Mather said the wananga's  security settings and other controls were appropriately set.

"We have re-emphasised to staff the necessity for strict adherence to our accounts payable policies and procedures. It highlights the need for protocols and checks and balances to be followed."

Toni Demetriou, manager of the electronic messaging and compliance unit at Internal Affairs, said the department sent out a warning in September about "whaling" scams and the importance of organisations putting safeguards in place.

A single person should not have sole responsibility for money transfers and the scam highlighted the need for appropriate checks and balances.

Demetriou said there had been three or four cases where money had been sent and in some cases companies had been able to recover funds through the banks involved.

Thom Hooker, chief technology officer with email security company SMX, said the scammers were going to greater lengths than ever before.

"They are going to the trouble of researching a company, identifying individuals and then creating a domain to prop up a forging attempt to try and elicit the funds, they're actually spending money to do this."

Hooker said if the scammers didn't have a chief executive's email signature they would make it look like it was sent from a mobile device.

"They tend tend to play on people's desire to be helpful. They'll say something like 'I'm off site today can you help me out, a wire transfer needs to be paid urgently'."

Staff needed to have up to date security awareness training.

"You can put all the algorithms and computer hardware in place but if the people aren't going to stop and think 'am I following the process?' then all the security in the world isn't going to help. The human factor is the weak link in the chain."

* Email correspondence begins with a simple email query from the "CEO" to the CFO asking if they're available, before progressing to request an urgent funds transfer.
* The emails may say they have been sent from an iPhone, iPad or similar. This may be an attempt to distract the recipient from the fact that the CEO's normal email signature is not featured in the message.
* The spoofed email address domain of the "CEO" may be slightly different than it should be; for example it may end in ".biz" rather than "".

 - Sunday Star Times

Ad Feedback
special offers

Periodic table gets new look

Dr Nicola Gaston's emoji periodic table is a thing of beauty.

As far as scientific breakthroughs go, the emoji periodic table is up there with splitting the atom.

Gunman believed at large video

A bullet hole can be seen in the windscreen of a red 4x4 inside the cordon.

Police are hunting for a gunman after two people were feared shot dead and a third injured in Northland.

Someone yelled 'she's got a knife'

Anna Brown, 36, denies murdering Carly Stewart.

Witness says she could sense something was about to happen - seconds later her cousin lay dead.

17 new trains for Auckland

The new electric trains will be in operation by 2019.

Auckland is getting 17 new electric trains to replace diesel fleet.


Pedestrian hit in Lower Hutt

Ambulances and police at the scene of an accident at a Lower Hutt roundabout.

Pedestrian in hospital after being hit by car near a busy Lower Hutt intersection.

NZ not ready for Asia

The survey has raised concerns school-leavers might be missing out on opportunities coming as New Zealand grows closer ...

Many senior high school students have poor knowledge of Asia. What about you? Try our quiz.

Warrant issued for Napier beggar

A warrant to arrest Frank Lovich was issued by Judge Geoff Rea on Wednesday.

Man with more than 300 convictions fails to show in court

Stats House 'unacceptable'

Statistics House on Wellington's waterfront was one of the worst hit buildings during the November 2016 earthquake.

Minister expresses his concerns about the 5-storey building on Wellington's waterfront, which remains closed.


Firewood queues for hours video

Adrian Allen loads firewood into his vehicle at City Firewood. He had a big load delivered after Christmas but has burnt ...

Hundreds of people queued for hours to buy firewood from Christchurch's largest supplier as harsh wintry continues loom.

Car dealer's road rage

Christchurch car dealer Nigel Thompson motors admitted assaulting a man after a collision, but escaped conviction "by a ...

He got angry after a crash, punched a man who told him to calm down, but avoided conviction by citing good works.

Snow crack clears ski area

Avalanche work was carried out at Broken River ski area after a crack was discovered in the snow pack.

Skiers were taken off a Canterbury skifield after a 30-metre crack ripped across the snow.

Rain, snow warning

Surface flooding in Christchurch on Friday. MetService says Canterbury will get "persistent" rain on Thursday.

Snow could hamper travel on alpine passes as a front moves up South Island.


Driving eases family's struggle

Anita Annan, 4, suffers from a progressive illness affecting her nervous system.

When you're dealt a heart-breaking hand, sometimes little things make a big difference.

House bought unseen

Post-auction celebrations continued into the evening after Donald Gordon (right) sold his unfinished house to Raglan ...

Raglan man who bought another man's unfinished dream house before seeing it was "blown away" when he did.

Pig's life of 'misery' revealed video

SAFE has now launched a petition calling for the government to stop mother pigs being confined to cages.

Campaigners say footage shows crates are cruel, expert says they save piglets.

Jury out in neck slashing trial

A High Court jury are considering their verdicts in the trial of Sameh Khalil Salem Ali, 42, who has been charged with ...

Both sides in the case of Sameh Ali have delivered their final arguments.


Pine trees turning red

Pine trees affected with red needle cast which has been seen in Taranaki

It may look like they're dying but these pine trees are just sick.

The last four are the best four

The Crusaders know how to work collectively to shut down opposition.

Crusaders should meet the Hurricanes in the Super Rugby final.

To Nelson, direct

Originair will offer direct flights between New Plymouth and Nelson from late-September.

Nelson and New Plymouth are to have a direct air link.

Learning to poach properly

Sauce is drizzled over the pears.

Most can poach an egg but the method of cooking is not used well in the kitchen, a teacher says.


They're yelling timber

Reclaimed Timber Traders boss Robert Scott amid a vast array of wood.

Palmerston North's Reclaimed Timber Traders loses its lease.

Closure an opportunity

The Manawatu Gorge is closed indefinitely.

A "significantly more resilient route" is expected in the likelihood the gorge will never reopen.

The Catholic question

Tony Blair converted to Catholicism after his term as Britain's prime minister.

OPINION: Catholic leaders should nail their election colours to the mast.

Anzac wreaths cost police thousands

Police have traditionally laid wreaths at Anzac Day services, but they're cutting back on the practice in the Central ...

Taxpayers have forked out more than $30,000 for police to lay wreaths in the past three years.


Ex junior All Black fulfills wish

Doug Murcott and Sally Tolliday on their wedding day at the Nelson Tasman Hospice.

Doug Murcott loses his fight with throat cancer just days after fulfilling his dying wish to marry his partner.

Anatomy of a shooting

Ford Hurinui who was shot by Police in Motueka on August 20, 2015.

Holding a shotgun and surrounded by police Ford Hurinui was "prepared to die".

Robbery suspect found

Victory Discount Dairy manager Darshini Chauhan's store was robbed at gunpoint earlier this month.

A fourth man has been arrested over the armed robbery of a dairy in Victory, near Nelson, earlier this month.

Truck rolls near St Arnaud

Police are attending to a crash near St Arnaud.

Bridge closed while crane retrieves truck on Picton to Christchurch highway.


Abseilers on a mesh mission

Abseilers working at the top of a bluff at Ohau Point, with a view down to the Pacific Ocean.

Ohau Point is the only place roading contractors can't reach, but abseilers with a head for heights are working to change that.

Truck rolls on SH63

Police are attending to a crash near St Arnaud.

The alternate highway claims another truck, but luckily nobody was hurt.

Cycle trail will happen - advocate

A cycleway will run along the edge of this damaged stretch of SH1, just south of Ohau Point, as part of $231 million of ...

Government chips in to build stretch around Ohau Point, deemed the most difficult section.

Time to fix 'scary' highway

The section of State Highway 6 from Okaramio to Havelock is the most dangerous stretch on the Blenheim to Nelson road, ...

The road from Blenheim to Nelson has claimed 12 lives in 10 years. Now it's a priority.

South Canterbury

Celtic set to be best

Celtic are shooting for their ninth consecutive title. (From left) Matt Fetu, captain Nick Strachan and Kali Latu have ...

Celtic Rugby Club's golden run in grand finals could see them stand alone.

Infected cows must go

Labour spokesman for Primary Industries Damien O'Connor is calling for all the cows on the property where Mycoplasma ...

The 150 stricken cattle on a South Canterbury farm should be put down, MP says.

Council hotly denies claims

A smoky chimney in Timaru.

ECan shoots down claim by former policeman it could be caught by peeping tom rule.

Wilding conifer GPS welcomed

Wilding pines growing near the shore of Lake Pukaki.

New technology to help fight the spread of wilding conifers welcomed in South Canterbury.


Resident wants to beautify wharf

Bluff resident Cherie Chapman stands near the closed Bluff Wharf which she wants to see it beautified and made open to ...

Bluff resident Cherie Chapman has put her case to the Bluff Community Board to restore the old Bluff wharf and return it to the public.

Let sleeping seals lie

The seal is believed to have travelled up the nearby Waiau river, and was found about 10kms from the sea.

DOC is asking the public to trust its judgement when it comes to dealing with wild animals.

MPI proposing changes

10082016. News.Kavinda Herath. Southland Times/FairfaxNZ-Uplift of oysters to tanker in  Big Glory Bay, Stewart Island today

MPI is hosting a public meeting about proposed changes to the aquaculture industry.

Coroner reminds hunters of gun safety after death

Cromwell man Garry Tall, 61, was killed in a hunting accident on the Old Woman Range in March 2016.

Cromwell man Garry Tall was an experienced hunter but on March 3, 2016, he died after shooting himself in the stomach after a hunt.

Ad Feedback