BURLINGTON — The city is conducting a review after falling victim to a $503,000 online phishing scammer.

The city of Burlington says the fraud involved a single electronic transfer of funds to a bogus bank account.

It started with a phishing email to staff asking to change banking information for an established city vendor.

"This was a case of online fraud with falsified documents at a level of sophistication not typically seen, and we are taking the necessary steps to prevent it from happening in the future," Mayor Marianne Meed Ward said in a news release issued Thursday.

When the city learned it had been duped, it reported the unauthorized payment to its financial institution and notified Halton Regional Police.

The city says it has "put in place additional internal controls to prevent this from occurring in the future."

In addition to a criminal investigation, the city says it will conduct a review of its current practices to decide if more changes are needed.

"We are working closely with the police on their ongoing criminal investigation and we have also initiated an independent external investigation of the incident, which will be part of our reporting back to Council and the Audit Committee," interim City Manager Tim Commisso said in the release.

The city says its IT system wasn't compromised by the phishing scam and no personal information was shared or stolen.

It added governments and businesses are just as vulnerable to fraud as individuals, noting in 2018, the Canadian Anti-Fraud Centre fielded 2,263 reports of business fraud amounting to $17.5 million in losses.