The (alleged) anatomy of the $10-million heist that rocked Canadian music | Canada Voices

At the exact moment on June 11, 2024, that Canada’s musical cognoscenti gathered at a Toronto record store to celebrate the past year’s most significant albums, someone, or some group, was getting ready to siphon nearly $10-million from the music industry.

The non-profit Foundation Assisting Canadian Talent on Recordings has, for four decades, collected money from the federal government and private radio broadcasters to fund programs to help musicians and their industry pay for recording, promoting and touring – recently to the tune of $30-million a year.

That day, FACTOR had an all-staff outing to mingle alongside artists such as singer-songwriter Terra Lightfoot and rapper DijahSB at the Polaris Music Prize long-list announcement at Sonic Boom Records, just a block from FACTOR’s downtown Toronto office. The event turned out to be a coincidental confluence of financial influence. FACTOR is one of the Polaris Prize’s biggest funders – and the money that was allegedly about to be stolen was coming from FACTOR’s bank account.

Now a non-profit that tries to sustain Canadian culture in a brutal economic environment for artists is locked in litigation with multiple entities, including one of the most valuable and deep-pocketed companies in the country, as it tries to get its money back. And all parties are waiting for police to figure out who could be criminally responsible for the loss.

On June 10, according to a WhatsApp chat transcript filed with the Ontario Superior Court of Justice’s Commercial List – which focuses on complex commercial litigation – a Quebec man named James Campagna messaged an employee of Toronto crypto trading platform VirgoCX named Robert Jackson. “i have a large order possibly cooking with a customer and will need to pay supplier in usdt,” he wrote, referring to a cryptocurrency tied to the price of the U.S. dollar.

“Sounds good, how large are we thinking,” the VirgoCX rep responded.

“large…” Campagna wrote. “they seem pretty serious.” He said his buyer wanted to purchase 2,800 crypto-mining machines from Leiqing Technology Co. Ltd. through Campagna’s company, Vipera.

The Polaris Music Prize event came and went as the two men prepared for the transaction.

Then, at 11:48 a.m. on June 12, Campagna messaged VirgoCX: “i am sending you a big amount now.”

The VirgoCX rep passed on transfer details, but added that his compliance department wanted to see the purchase agreement. Campagna sent one right along: a $14,655,200 order for 2,800 crypto-mining machines from, the agreement read, “Foundation Assisting Canadian Talent” – FACTOR.

The non-profit’s chief financial officer’s name was attached, but so was an unrelated phone number and an address 20 kilometres from FACTOR’s Toronto headquarters.

FACTOR is not in the business of bitcoin mining. It helps Canadian musicians build careers. And at that moment, the day after the Polaris celebration, its accounting manager, Marina Anianova, was planning to process payroll. She was working from home when she says she suddenly got a phone call from a man who identified himself as “Derek at Scotiabank Connect.”

“Derek” allegedly told Anianova, who used the Bank of Nova Scotia to handle FACTOR’s finances, that the online platform he represented was having technical difficulties. She went about her day. She says that when “Derek” phoned again the next day, June 13, she realized that he wasn’t calling from ScotiaConnect’s usual number. Around 3 p.m., still unable to get into the system, Anianova called the bank’s actual number.

A transcript of that call is filed in court, too. “It’s terrible,” Anianova told a customer-service representative named Rahu. “I need to make payment. I have payroll. We have $15-million in our bank account.”

Rahu looked into it as she became increasingly concerned. “How much money we have in bank account now?” asked Anianova, a Latvian immigrant who is more comfortable speaking in Russian than English.

Rahu shared FACTOR’s account balance with her: $48,785.16.

“No,” Anianova said. “It should be $15-million.”

“$15-million?”

“Yes. $15-million we keep in your bank account. Come on.”

Rahu responded: “Someone else might have access to it.”

“Oh my god, oh my god, oh my god,” Anianova said. “Please. You have to help me. Please.”

By then, a culprit had made off with $9.8-million of FACTOR’s money – about 40 per cent of its public funding that fiscal year, freshly deposited by the federal Department of Canadian Heritage. (FACTOR had moved about $5-million from the Heritage deposit to a different account just before the alleged theft.)

FACTOR took the bank, Campagna, his company and VirgoCX to court in the weeks after the alleged theft, hoping to extract as much information as possible about what unfolded and to recoup the missing millions. But according Scotiabank’s arguments before Justice William Black and others in the year-long legal battle that has ensued, it should not be responsible for helping FACTOR recover the whole amount. The bank declined to comment for this story because the matter is before the courts.

But a new piece of information has arisen in court briefs that has until now gone unpublicized: According to a third-party expert, in November, 2023, Anianova clicked on “a link to a malicious website masquerading as Scotiabank’s client portal and provided Factor’s Scotiabank account login and password details.” The third-party report describing the event in detail was not immediately available.

This account is based on more than 1,000 pages of court filings, including transcripts, affidavits, legal letters and third-party reports.

No allegations have been proven in court, though both FACTOR and Scotiabank have acknowledged that money was removed from FACTOR’s account. No one has been charged by a police agency in connection with the alleged theft.

As the legal limbo drags on, FACTOR has been draining its long-term savings to cover not just the missing funds, but the costs of its legal battle. That’s amounted to $1.2-million and counting in investigations, reports and legal fees “to hold those responsible accountable and get the funds back,” chief executive officer Meg Symsyk said in an e-mailed statement.

FACTOR is pinning some of its hopes on Scotiabank honouring an “online security guarantee” that claims the bank will fully reimburse clients who “suffer direct financial losses due to unauthorized activity.” The bank’s lawyers have said this guarantee doesn’t apply in FACTOR’s case.

“Scotiabank claims ‘fighting fraud’ is a shared responsibility,” Symsyk added. “This would be true if at multiple opportunities Scotiabank had actually sent ANY notifications or communicated with FACTOR” about adding a new user to its account or initiating a wire transfer “that is 100x larger than anything in the history of our decades-long banking with Scotiabank.”

The bank, meanwhile, has said FACTOR could have voluntarily turned on certain alerts.

There may be only one fact everyone can agree on about what appears to be the biggest heist in Canadian music history: It’s messy.

FACTOR launched in the early 1980s, a decade after Canadian content rules gave the domestic music industry a solid foundation. Radio stations were mandated by Canada’s broadcasters to fund music initiatives, but the money tended to go to projects like school marching bands that had little to do with the pop and rock many of the stations played.

“If we didn’t come up with something, music and broadcasting would both be hurt,” said Duff Roman, FACTOR’s founding president.

Attic Records co-founder Tom Williams and longtime CHUM program director J. Robert Wood came together to lead a mutually beneficial course correction. What if, they asked their industry colleagues, radio stations funded the creation of music they wanted to play? The biggest networks got on board, joined a few years later by the federal government. FACTOR was born.

Anianova became FACTOR’s bookkeeper in 2000 and was later promoted to accounting manager. She said in an affidavit that FACTOR had never made an external payment larger than $1-million from its general Scotiabank account, and the destination for such big transfers was always clear: the organization’s francophone counterpart, Musicaction. In the past five years, FACTOR had only sent wire transfers a handful of times a year, all of which were for about $25,000 or less.

No one at Scotiabank, Anianova added, had ever advised her that she needed to set up alerts on the FACTOR account to protect it from theft. To safely access it, she set up a digital token on an old iPhone used only for that purpose that she kept either in a desk drawer or, when she went to the office, on her person.

On Jan. 18, 2024, someone logged into FACTOR’s Scotiabank account from a TekSavvy IP address in Toronto, 45 seconds before Anianova accessed the account from her home outside of the city. That day, a new user was added to FACTOR’s account bearing the name Sara Stasiuk, who was then the non-profit’s chief financial officer.

But Stasiuk, the CEO of Winnipeg’s Forks North Portage Partnership and a past executive director of Manitoba Music, was only ever a part-time CFO. Court filings state that no one from FACTOR had granted her digital access to the account. Not even Symsyk, the CEO, had a full tier of access. Nor, the filings add, did anyone alert FACTOR that a new user had been added. The e-mail address associated with the account used an outlook.com domain, not factor.ca.

The court has not expressly determined how this happened. But new information was filed with the court this past April. Campagna’s lawyers revealed that a recent third-party review of Anianova’s web history had found that she had “clicked on a link to a malicious website masquerading as Scotiabank’s client portal and she provided Factor’s Scotiabank account login and password details.”

A lawyer for FACTOR had previously said in court that Anianova had traditionally clicked a bookmarked link to log into ScotiaConnect. (Symsyk said FACTOR will be filing a forensic report responding to this shortly.)

It’s not clear what the court will do with this information. What is clear is that the new user accessed FACTOR’s Scotiabank account 25 times over the next five months. Camping out. Waiting.

James Campagna is a Montreal-area man who, if the public Instagram account bearing both his personal and company name offers any suggestion, spends a lot of time in Dubai and Doha, and really likes red BMWs and Porsches.

His firm, a numbered company that goes by Vipera, sells computing hardware related to just about every digital buzzword of the past five years. That includes $492,000 servers for artificial-intelligence data processing, $938 physical cryptocurrency wallet packages and a variety of bitcoin-mining machines, one worth $29,899.

Online reviews of Vipera’s customer service, some filed in court, are polarizing. While one 2024 customer wrote that its service “couldnt be any better,” another person wrote that “James the co founder” once called them “a clown” for requesting a refund.

It bears repeating that Campagna has not been charged with any crime related to FACTOR’s missing money. But FACTOR alleges that he and Vipera, “alone or together with a cybercriminal or cybercriminals, stole $9,772,875.33 from the Scotiabank General Account of FACTOR.”

Lawyers for Campagna did not respond to repeated requests for comment. But in an April filing, they said that “the logical inference from the evidence – as opposed to allegation – is that [Campagna and his company] were merely dupes, like Factor, Scotiabank and Virgo, in a calculated scheme likely conducted by professional, potentially state sponsored criminal cyber-hackers.”

Campagna’s company started using VirgoCX for cryptocurrency transactions in late 2023. Between that December and early June, 2024, his company did four transactions with VirgoCX through a Scotiabank account, the biggest of which was a US$319,000 purchase of the USDT cryptocurrency in early February, 2024.

The company had Scotiabank accounts for doing business in both Canadian and U.S. dollars, but court records show they had minimal activity around this time; multiple cheques from the U.S. dollar account bounced in May, 2024, because of insufficient funds.

The Department of Canadian Heritage deposited $14,349,539 into FACTOR’s Scotiabank account on June 4, 2024, which the non-profit was preparing to pay out to program recipients in the coming weeks. It transferred $5-million of that into a short-term investment account on June 11.

The flow of FACTOR’s funds

Ottawa had just sent FACTOR millions when an unknown entity used an invoice with incorrect contact information

to facilitate a major transaction with a numbered company, also known as Vipera, co-founded by James Campagna.

Most of the money was transferred to crypto, and, as of publication time, has not been recovered by FACTOR.

Dept. of

Canadian

Heritage

Bank acct. of

Vipera, James

Campagna’s

company

FACTOR’s

Scotia

account

Short-term

investment

account*

*Account belongs to FACTOR

josh o’kane and john sopinski/

the globe and mail

The flow of FACTOR’s funds

Ottawa had just sent FACTOR millions when an unknown entity used an invoice with incorrect contact information

to facilitate a major transaction with a numbered company, also known as Vipera, co-founded by James Campagna.

Most of the money was transferred to crypto, and, as of publication time, has not been recovered by FACTOR.

Dept. of

Canadian

Heritage

Bank acct. of

Vipera, James

Campagna’s

company

FACTOR’s

Scotia

account

Short-term

investment

account*

*Account belongs to FACTOR

josh o’kane and john sopinski/

the globe and mail

The flow of FACTOR’s funds

Dept. of

Canadian

Heritage

Ottawa had just sent FACTOR millions when an unknown entity used an invoice with incorrect contact information to facilitate a major

transaction with a numbered company, also known as Vipera, co-founded by JamesCampagna. Most of the money was transferred to crypto, and, as of publication time, has not been recovered by FACTOR.

 

FACTOR’s

Scotia

account

Bank acct. of

Vipera, James

Campagna’s

company

Short-term

investment

account*

*Account belongs to FACTOR

josh o’kane and john sopinski/the globe and mail

That’s the day after Campagna messaged VirgoCX about “a large order possibly cooking.” (Filings suggest that the order was first handled by a Dubai-based Vipera colleague – from whom Campagna later asked for copies of relevant communications, but who “appears not to want to be involved in this proceeding.”) When Campagna sent his VirgoCX rep the purchase agreement bearing FACTOR’s name on June 12, it was for $14,655,200 – a few hundred thousand dollars more than the federal deposit from early June.

Then the user bearing Stasiuk’s name transferred $9,772,875.33 from FACTOR’s Scotiabank account to another Scotia account belonging to Campagna’s company.

This happened despite the fact that the invoice indicated a purchase price of $14.7-million – that, in other words, the transaction was worth nearly $5-million less than the invoice stated.

About two hours after the transfer from FACTOR’s account to Campagna’s, the latter’s VirgoCX rep sent him the link to FACTOR’s website. “Compliance is asking if this is the client purchasing the miners as it doesn’t align with their industry.”

“Not sure,” Campagna wrote back six minutes later. “we have customers who have businesses from every walk who buy from us.” (In a court brief, his lawyers said that “the customer’s communications were not inconsistent with ordinary practices in his business, and he had no reason to be suspicious. He was duped.”)

Other than seeking a screenshot confirming the transfer, that was the only question the VirgoCX rep asked in the chat about FACTOR’s business model before he said “we can get the ball rolling.” But that process took some time, and the WhatsApp chat transcript shows Campagna appearing to become agitated as he sought to move the money into crypto.

“there was a delay in the USD coming back,” the VirgoCX rep said. “We might have to settle first thing in the morning.”

“no bro…” Campagna wrote. “to get the new price on this quantity after todays rally a huge loss of profit.” Less than a minute later: “it has to be today.”

They then spoke by video call to discuss details. An hour later, Campagna messaged: “update?”

“Compliance has asked that we get a bank statement and not just the screenshot provided and for us to jump on a video call to confirm the trade details prior to sending,” the VirgoCX rep said. He asked to set up another video call in 20 minutes.

“bro whats going on,” Campagna responded. The money was still sitting in his company’s Scotiabank account. “what does our bank statement have to do with anything.”

“I know – not sure why the added due diligence,” the VirgoCX rep said.

“you are risking my entire profit margin by it being late,” Campagna responded.

The VirgoCX rep apologized, but the transcript suggests the crypto transfer didn’t happen until the next day, June 13. Then, at 5:39 p.m. that day, the VirgoCX rep messaged Campagna: “Hey James, we just received a recall request for the 9.4MM wire you just sent – please explain.”

That was about two hours after FACTOR accountant Anianova had realized that $9.8-million was gone. In fact, FACTOR has said, she’d been deleted from the account without any official alert. At 5:24 p.m., Scotiabank’s fraud-deterrence division e-mailed VirgoCX’s bank, ATB: “Our customer has issued a fraudulent wire payment (sourced from fraud proceeds) and as a result the following wire was sent from BNS to an account belonging to ATB FINANCIAL BANK. We are seeking your assistance to restrict the beneficiary account and confirm if funds are available for recovery.”

At that point, e-mails between Symsyk and Anianova indicate that they had not been told the transaction was fraudulent. “I asked few times,” Anianova wrote, and Scotiabank representatives “confirmed that there is not fraud.”

In a court filing, VirgoCX said that after it got Scotiabank’s recall request, it “took immediate action to freeze the client in question’s account as a precautionary measure.”

Yet court documents show that the funds were moved into three cryptocurrency wallets, then “moved repeatedly to the point where they became untraceable.” And last August, Justice Black wrote that “information from VirgoCX also showed that … no steps were taken by anyone to freeze the cryptocurrency purchased with the misappropriated funds before those funds became untraceable on June 15, 2024.”

In spite of the sudden intervention, Campagna and his VirgoCX rep Jackson planned a dinner in Montreal about a week later. Campagna suggested they go somewhere “upbeat surrounded by hot chiquitas.”

VirgoCX’s lawyer Andrew Jia of Kung, Lo & Jia LLP said in an e-mail that VirgoCX staff had already planned to attend a Montreal event in late June, and that Jackson “met with many existing clients/partners as well as prospective clients” during this trip, which was customary for the company.

He added that it was not possible to truly freeze cryptocurrency, but said VirgoCX “took all steps required from us at the time of the recall.” The company, he said, was not aware “of a centralized party we could have contacted to request for a freeze, even if we had sufficient details to do so. No communication we received at the time provided us with sufficient detail.”

Campagna’s lawyers have also said in a filing that they hired a former law-enforcement professional who traced the funds to the “endpoint” wallets where the allegedly stolen cryptocurrency wound up, and that they have shared his report with FACTOR’s lawyers. “We have come to understand that law enforcement needs to do their own tracing and filing,” Symsyk said when asked about the endpoints. “That option was not able to be pursued in a timely manner by law enforcement as Scotiabank did not report the fraud.”

Symsyk had two video meetings with Scotiabank on June 14. She was furious, pointing out that if her credit card had an unusual charge, she’d get a call.

“You guys have a wire transfer that we never made for $9.7-million and nobody thinks to flag it and pick up the phone?”

Bank staff promised her an investigation, but she kept pushing for details that day as to how the money disappeared. When Scotiabank told her the mystery user had an outlook.com e-mail address, she said on one call: “Anyone could go off our website and go, ‘Oh, look. The CFO’s name is Sara Stasiuk. We’re going to make up a fake e-mail that she doesn’t have on Outlook and have her log in and get it.’ That’s basic IT security. My God.”

A Scotiabank staffer tried to step in. “We want to see what has happened exactly that –”

Symsyk interrupted him. “It sounds to me like you guys don’t know what the hell you’re doing.”

Scotiabank called Campagna into a local branch and, on June 20, he signed a letter authorizing the return of the remaining money that hadn’t been transferred to VirgoCX and shifted to crypto wallets – $378,503.35. His lawyers have said this was his profit margin from the crypto-mining-machine sale he was trying to execute. (At a court hearing last November, a lawyer for FACTOR said Campagna had been interviewed multiple times by Scotiabank, and expressed shock that a Scotiabank manager may have thrown out original notes from one of those meetings.)

The majority of FACTOR’s money has never been recovered.

Scotiabank has declined to cover the remaining $9.4-million, despite what FACTOR says are advertised guarantees that the bank will make clients whole after fraud. Each are arguing in court that the breach could have been because of the other’s security lapse. The parties are also still, a year later, trying to wrangle more details from each other that could be relevant to the case. The new information suggested in the April filing, that Anianova clicked a malicious link and provided her Scotiabank login details, could very well influence Justice Black’s decision.

While FACTOR waits for a decision, it’s been forced to dip into its reserves to cover the difference – at the expense of the ambitious music-industry programs it pilots with the interest it gains on its investments, including for Canadian concert-promotion companies that want to put on concerts in a sector dominated by Live Nation.

As helpful as the court system can be in revealing information, it will be up to law enforcement to determine whether someone is criminally responsible. But the police investigation is moving just as slowly.

According to Symsyk, Toronto police initially told her the case was outside of their jurisdiction, since the money flowed through Campagna’s company account in Quebec, then through Alberta-based ATB on its way to VirgoCX. When FACTOR pressed the RCMP, that force suggested it pursue the matter locally, Symsyk said.

So she returned to the Toronto Police Service, and said she finally met with its financial crimes unit in February – eight months after the money disappeared. The force declined to share any updates for this story, saying its investigation is still active. But as police slog through the laborious work – the Canadian Anti-Fraud Centre reported that Canadians lost $648-million to fraud last year – the music industry is still left without nearly $10-million.

“It is critical that our federal and provincial governments work together to investigate online fraud swiftly, and have consequences for those committing, as well as aiding and abetting, these serious crimes,” Symsyk said.