A technical university has been the victim of a €98,500 online scam concerning a fraudulent email that resulted in a legitimate payment to a supplier going to a rogue bank account.
That is according to the 2024 annual report for the Technological University of the Shannon Midlands-Midwest (TUS), which was formed in 2021 following the merger of Limerick Institute of Technology and Athlone Institute of Technology.
In the report, the scam – which was reported by TUS to An Garda Síochána and the Higher Education Authority (HEA) – draws the attention of the Comptroller and Auditor General (C&AG), Seamus McCarthy, who reports that TUS received a legitimate invoice for services to the value of €98,500 from a supplier in August 2024.
A fraudulent email – on September 25th, 2024 – was subsequently received by the university, directing a change in the bank details for payment of the invoice.
READ MORE
He said the university paid the full invoiced amount to the bank account indicated in the fraudulent email, without checking independently with the supplier that the bank account details were correct, as required by TUS’s control system.
He said TUS reached agreement with the supplier on a 50-50 sharing of the amount of the loss.
In response to the online scam, TUS “reviewed and enhanced internal controls and provided a cyber fraud training workshop to finance staff”.
The annual report states that the matter was reported internally to the governing body among others and externally to An Garda Síochána, the Higher Education Authority and the office of the C&AG as part of the annual audit process.
TUS last year recorded a surplus before tax of €6.06 million as its spend increased from €205.96 million to €229 million, with staff costs being the main driver behind the increase, rising from €117.59 million to €127.99 million.
