Just for Laughs Victim of Email Fraud

Just for Laughs suffered a classic email fraud at a very bad time, before racking up millions in losses and sheltering itself from its creditors. From February to April 2023, the company was robbed of $813,657, show court documents that have remained confidential until now.

Gestion Just for Laughs obtained an order in January to identify the holder of the TD Bank account where the embezzled funds went.

The type of fraud the company was a victim of was based on the usurpation of the email of a company executive, manager or key supplier.

In the case of Just for Laughs, the unknown suspect, named “John Doe” in the proceedings, imitated emails from employees of L’Équipe Spectra and Groupe CH (“spoofing”). These two companies belong to the Molson family, shareholders of the producer of humorous content.

As part of internal agreements, Just for Laughs subcontracted management services to Spectra and another company belonging to the Molsons, evenko.

Baited controller

In February 2023, the financial controller of Just for Laughs received an email appearing to come from a Spectra employee. It contains instructions for changing the procedures for all payments to evenko. Going forward, the funds should go into a new account at TD Bank, according to the message.

The email is also sent as a certified copy (“cc”) to two employees of Groupe CH inc., involved in the management of these companies.

But the message came from a scammer, not Spectra. He created an address in the name of an employee responsible for accounts receivable within the company. The domain name imitates that of the company: “@equipespectras.com”, with an extra s, instead of “@equipespectra”.

The email is also sent as a carbon copy (“cc”) to two false addresses imitating those of managers of Groupe CH, which controls Spectra.

Transfers begin

The difference with the real addresses is subtle, and the controller of Just for Laughs sees nothing but fire. After changing Evenko’s banking information in the system, Just for Laughs made three payments to him: a first of $8,623 in February, a second of $209 in March, but above all, a third payment of $804,825 in April . This transfer of funds must cover the management fees that the humor specialist owes to evenko for 2022.

Just for Laughs discovered the fraud in May 2023 when Groupe CH asked him if his management fees – one month late – would soon be paid.

A few minutes later, the controller responded to the CH Group that the funds had indeed been paid to Evenko’s alleged account at TD Bank on April 13, mentioning the request from Just for Laughs to obtain its Norwich order.

The CH Group’s senior finance director then replied that this account did not belong to her.

“At this time, Just for Laughs realized that it had been the victim of fraud, initiated by the fraudulent email a few months earlier, on February 23, 2023,” according to the court document.

Account blocking

Just for Laughs then asked its financial institution, the National Bank, to investigate the flow of funds and filed a complaint with the Montreal police, who opened an investigation.

The Norwich order to identify who is behind the TD account has been granted. The Press was, however, unable to consult the file in a timely manner for details.

The motion also seeks an order to freeze the account, but available documents do not say whether the court has issued an order to that effect.

Just for Laughs’ in-house lawyer, Paul Morissette, initially led The Press to Patrick Lapierre of the Blakes firm to obtain the details, but he claims to have received “no instructions” to speak to us.

The company’s boss, Alain Boucher, did not call back.

A classic

The Just for Laughs embezzlement is a classic case of “presidential fraud,” where the criminal manages to convince a key manager to transfer funds to him, says Patrick Mathieu, founder of HackFest, a community of cybersecurity experts .

“When fraudsters start, they don’t need to have any knowledge,” he explains. Generally, they’ll make a lot of phone calls and a lot of bogus emails to find out who does what, how, schedules… Obviously, you can use LinkedIn to find out who runs the company…”

For example, fraudsters can pose as customers or suppliers having problems getting paid. This will allow them to know who is responsible for these issues. “It could take months,” says Patrick Mathieu.

He points out that businesses can easily thwart these types of schemes through simple measures, such as confirming bank account changes with the person responsible over the phone, or by responding to an old email.

“It’s a lack of basic precautions,” he laments.

Nothing to help Just for laughs, who suffered this fraud at the start of his annus horribilis, before placing himself under the protection of the Companies’ Creditors Arrangement Act.

In 2023, the group overseen by Gestion Just for Laughs lost $7.9 million, after pocketing a profit of $1.1 million the previous year.