This Week’s Fraud, Weighed: The Captain in the Gap

Edition 2 of the weekly exercise: take the fraud in the headlines, place it on the scale, and ask one question — what verification would have killed this on day one?

For seventeen years, passengers boarding certain Air Canada flights were welcomed aboard, at least indirectly, by Captain Geoffrey Wall.

The facts, as Canadian police and news reports laid them out in June: Wall, 59, was promoted to captain in 2009. Police allege he did not hold the airline transport pilot license — the ATPL — that Canadian regulations require for the left seat of a commercial airliner, and that his promotion was supported by falsified documentation. He flew more than 900 flights as captain, domestic and international, across seventeen years. He retired in 2025 with the fraud, as alleged, still airborne.

He was not caught by an incident. There was no emergency, no failed landing, no moment of cinema. He was caught by paperwork: a routine evaluation at Toronto Pearson in March 2025 turned up anomalies in his documentation, which unspooled quietly into a police investigation and, this June, into criminal charges.

Seventeen years. Nine hundred flights. And the detail worth sitting with is not the audacity of the man. It is the response of the airline — because the airline’s defense is the most instructive sentence in the entire story.

The defense that proves the case

Air Canada’s position, in substance: safety was never compromised, because all of its pilots — Wall included — undergo recurrent training every six months and regular flight checks with certified check pilots. He was tested, continuously, for seventeen years. And he passed.

Read that again, because the airline believes it is offering reassurance, and it is actually offering a confession.

They are describing two different verification systems and demonstrating that they ran only one of them. The recurrent checks verified his competence — can this man fly the aircraft? Evidently, for seventeen years, yes. What no one re-verified was his credential — is this man licensed to fly the aircraft? Those are not the same question. They are not even the same kind of question. One is answered in a simulator. The other is answered in a registry.

The fraud did not live in his flying. His flying, by every account, was the alibi. The fraud lived in the gap between the two systems — examined constantly on one side, examined never on the other. Seventeen years is not how long he fooled the airline. Seventeen years is how long the gap stayed open.

I know this gap professionally, because due diligence has its own version of it. A counterparty’s performance gets scrutinized relentlessly — the numbers re-forecast every quarter, the management presentations stress-tested, the customers called. Meanwhile the counterparty’s authority — the regulatory registration, the license to operate, the signing power, the mandate that makes the whole relationship legal — was photocopied into a file at the start of the relationship and has not been looked at since. Ask a diligence team when the target’s operating licenses were last confirmed with the issuing regulator, rather than read from the data room, and you will often be met with the special silence of people realizing the file has been vouching for itself for a decade. Performance is checked because performance is visible. Authority is assumed because authority is boring. Fraud, which is never bored, moves in accordingly.

The weighing

So put it on the scale and ask the question this series exists to ask: what verification would have killed this on day one?

Not more simulator hours — he passed those. Not sharper observation of his flying — his flying was the alibi. The verification that kills this scheme is the dullest sentence in aviation:

Check the license against the issuer.

Not against the document the pilot provides. A document supplied by the subject is an exhibit, not evidence — it tells you what the subject wants the file to say. The check that matters runs against the registry of the authority that grants the license: at promotion, and then on a cycle, forever, for everyone. A registry lookup is minutes of work. It requires no suspicion, no confrontation, no judgment call. And it is precisely the check a falsified document cannot survive, because a forger controls the paper in the file but not the database at the source.

Regular readers will recognize the shape of this rule, because it is the same rule this newsletter keeps arriving at from different directions. The cloned voice is defeated by calling back on the number you already had. The fake police uniform at the museum door is defeated by phoning the precinct. The counterfeit license is defeated by asking the issuer. One principle, three costumes: verify with the source, on a channel the subject does not control. Every fraud in this series so far has been, at bottom, a bet that nobody would use the other channel.

Why nobody checks

Here is the mechanism, and it is last week’s mechanism wearing a uniform.

Verification is front-loaded. We check credentials at the door — at hiring, at promotion, at onboarding — and then the checking stops, because from that day forward the person is no longer a claim to be verified. He is a colleague. Seventeen years of good mornings, of competent landings, of recurrent checks passed, each one depositing a little more presumption into the account. By year five, re-verifying his license would feel eccentric. By year ten, insulting. The seniority becomesthe credential, socially — and the social credential quietly replaces the legal one on everyone’s mental checklist.

I posted a note last week that turns out to have been this article in miniature: most betrayals are not failures of character judgment — they are promotions. Someone graded on familiarity, handed a role that required evidence. Wall was graded rigorously, twice a year, on familiarity’s terms: can he do the job? The one piece of evidence that determined whether he was allowed to do the job sat unexamined in a file, because every system assumed another system had it covered — the airline assumed the regulator, the regulator assumed the airline, the check pilots assumed the file.

A check that everyone assumes someone else is running is not a check. It is a rumor of a check.

What this means at your desk

Run the inventory; it takes one meeting. List every credential your organization verified once and has never re-verified: degrees, professional licenses, certifications, regulatory registrations, signing authorities, the auditor’s own standing. For each, ask two questions. When was it last confirmed with the issuer rather than with the file? And who, precisely, owns the re-check — because “someone must be doing that” is how seventeen-year gaps are built.

Then adopt the rule that makes it workable: re-verification runs on a cycle, for everyone, and seniority earns no exemption — precisely because seniority is where the presumption pools deepest. The objection will be that checking a twenty-year colleague is insulting. It is the opposite. A check applied to everyone insults no one; my grandmother’s scale weighed the neighbor’s saffron and the stranger’s identically, and that was not suspicion — it was the reason her weights meant anything at all. The insult is not the universal check. The insult is the discovery, seventeen years late, that there never was one.

The measurement

The strangest detail in this story is the one that sounds like a compliment: by every operational measure, the man could fly. The simulator said so twice a year for seventeen years. If competence were the question, there was no fraud at all.

But competence was never the question, and the marketplace my family worked in for five generations understood why. The guild did not ask, at year twelve, whether the goldsmith’s work was still good. It asked whether he was still the man the street had licensed — because the license was never a comment on his skill. It was the street’s promise to everyone who could not judge the skill for themselves. That is what a credential is: verification performed on behalf of the people who cannot perform it. The passengers in the back, boarding on faith in a system they will never see, were owed the registry check.

Everyone who boards anything — a plane, a company, a partnership, a deal — is owed the registry check.

The scale is not an accusation. It is a courtesy.

---

Sources: Canadian police statements and reporting by CBS News and CTV, June 2026. The charges against Mr. Wall are allegations and have not been tested in court; Air Canada has stated that flight safety was not compromised.

I write about how trust is built, verified, and stolen — from the deal rooms where I’ve spent twenty-six years, and from the covered streets where my family spent five generations. If someone forwarded you this, you can subscribe below.