What happened
CityHousing Hamilton runs social housing for the City of Hamilton in Ontario. In March 2024, weeks after the city itself had been hit by a cyber incident in February, a staff member received an email that appeared to come from a contractor CityHousing knew. Hamilton police later said the email contained altered banking details for a vendor payment. CityHousing paid about $552,000 to the new account.
The case became public in April 2025, through a city audit report covered by The Public Record. In July 2025 Hamilton police announced that a 32-year-old man from Surrey, British Columbia, had been charged.
The email
What makes this case stand out happened two weeks before the fraud. The real vendor had emailed CityHousing to warn that it had suffered a security breach. It asked CityHousing to call it about any request to change its banking details.
The fake email then did exactly what the warning described. It came in the name of the known contractor and asked for payment to new bank details. The public sources do not give the sender's address or the wording.
Why it worked
A warning sent by email is one message among hundreds. The person who read it may not have been the person who later processed the payment. And the warning described a future event in general terms, while the fake request arrived as specific, routine paperwork about a real vendor.
The timing also helped the fraudster. The city was still dealing with its own cyber incident. Staff under that kind of pressure have less time for unusual checks, and a vendor that has been breached is exactly the kind of sender whose stolen details let an impostor sound genuine.
What it cost
The audit found a second error on top of the fraud. CityHousing had mixed up the amounts owed to two vendors. The vendor the fraudster impersonated was owed about $137,000, but about $552,000 went to the fraudulent account. Police said the money was quickly spread across several newly opened personal and business accounts.
The Public Record reported that about $417,000 was traced and recovered through Norwich orders, which force banks to disclose account information, and a Mareva injunction, which freezes assets. CP24 reported that more than $130,000 remained lost, on top of forensic and legal costs. The amounts are in Canadian dollars.
What would have helped
The vendor had already named the fix: call before changing any bank details. The gap was in turning a warning into a rule. A warning about a specific vendor belongs in the payment system itself, as a hold on that vendor's record that nobody can clear without a phone call to a number on file.
What a warning inside the message would have shown. Antilure marks wording that asks to change payment details and explains the sender in its Details panel, including whether the address is new or imitates a known domain. Its banner says: don't reply or pay, check with the sender another way. That line is the same advice the real vendor gave, placed on the message where the decision is made.
Sources
- CityHousing Hamilton Paid $552,000 to Fraudster in Imposter Bank Account Scam, Joey Coleman, The Public Record, 21 April 2025.
- Man from Surrey, B.C., charged after $550,000 was stolen from the City of Hamilton in email fraud, Laura Sebben, CP24, 9 July 2025.