Bank gets sued over fraudulent wire transfers
Three weeks after Urbangro Inc. (Nasdaq: UGRO) reported that it had been hit by $5.1 million in fraudulent wire transfers, the indoor agricultural engineering firm has sued its bank for allegedly allowing the fraud to occur.
In a complaint filed Friday in Boulder County District Court, Urban-gro, a Lafayette-based indoor agriculture engineering firm, accuses Denver-based Sunflower Bank of ignoring established security practices, approving the fraudulent wire transfers despite obvious red flags, failing to follow up once Urban-gro discovered the fraud and refusing to release recovered funds unless Urban-gro signed an indemnity agreement.
Urban-gro has retained Giovanni Ruscitti of Berg Hill Greenleaf Ruscitti LLP in the lawsuit. Sunflower Bank is represented by Eric Liebman of Moye White LLP.
“Sunflower just received the complaint over the weekend and is still in the process of analyzing it,” Liebman told Bizwest in an email. “Accordingly, Sunflower is unable to provide any comment at this time.”
According to the complaint, Urban-gro in March opened several business accounts with Sunflower Bank, including a sweep account that the complaint says had the sole purpose of maintaining a specified minimum balance and was not enabled to send wire transfers. Chief financial officer Dick Ackright and vice president and controller Wes Smith were the only representatives of Urban-gro who were given account signer permissions.
Besides them, only four other employees were given online banking login credentials, and only two of those were allowed to initiate wire transfers. New
administrative users with such permissions were not allowed to be added without the approval of Urban-gro’s board of directors.
Before the fraud happened, all of Urban-gro’s legitimate wire transfers were initiated by one of those two employees and approved by Smith, and “exceptions to this practice never occurred and were never requested,” according to the complaint. Sunflower Bank’s procedures allowed wire transfers to be conducted via the online banking platform, over the phone or in person, the complaint alleges, but never by email.
On Sept. 20, according to the complaint, an individual hacked Ackright’s email account and used it to send an email to Sunflower Bank asking that someone named “Alan Myers” be added as an admin to all Urban-gro accounts while “Urban-gro was unaware that this had occurred.” Rather than contacting Urban-gro about this, the complaint alleges, Sunflower Bank approved the unauthorized user as an administrator on Urban-gro’s accounts.
The complaint then claims that on Oct. 1, the fraudster again contacted Sunflower Bank using Ackright’s email address asking if the sweep account could be set up for wire transfers and if the twofactor authentication process could be circumvented, requests that “were unprecedented and should have been a red flag to the Defendant.” The bank’s branch manager responded that she would create an exception and process the wire transfers directly, according to the lawsuit.
On Oct. 4, according to the complaint, the unauthorized user emailed the branch manager from “an obvious fake account” whose domain did not match the Urban-gro email domain requesting three fraudulent wire transfers totaling $2.4 million from the sweep account. Those were approved despite exceeding the $1 million daily limit on wire transfers from that account.
According to the complaint, the transfers were:
• $810,500 to a Citi Bank in Vernon Hills, Ill.
• $744,280.50 to a TD Bank in New York City.
• $875,950 to a TD Bank in Pensacola, Fla.
On Oct. 7, the fraudster again contacted Sunflower Bank using a fake email address and requested three more fraudulent transfers that exceeded the $1 million daily limit. Additionally, one of those transfers was to South Carolina, a state where Urban-gro had never before sent a transfer, according to the complaint. Those transfers were also approved by the Sunflower Bank branch manager, according to the lawsuit.
Those transfers were:
• $852,700.50 to a Chase Bank in Delray Beach, Fla.
• $895,000.75 to a Wells Fargo in Buena Park, Calif.
• $924,700 to a Chase Bank in Greenville, S.C.
“This process of requesting and processing wire transfers circumvented the established security procedures in place and contravened the reasonable expectations of Urban-gro as to how wire transfers are requested and processed,” the complaint reads. “Defendant allowed the unauthorized user to make use of Urban-gro’s funds without (1) providing any secure information such as login and password, (2) using established two-factor authentication, (3) independent wire verification by an initiator and separate approver, and (4) without having proper authority to even initiate or approve such wire transfers.”
On Oct. 13, according to the complaint, Smith discovered the fraudulent transactions and immediately notified the bank. However, the complaint alleges, Sunflower Bank did not reach out to the receiving banks or contact the FBI, but rather “told Urban-gro to confirm the authenticity of the transfers internally before jumping to conclusions.” On Oct. 13 and 14, Smith spoke with representatives of TD Bank and Chase Bank who were able to identify two of the fraudulent transactions. On Oct. 20, Urban-gro filed a report with the Internal Crime Complaint Center of the FBI.
Finally, the complaint alleges that even after those fraudulent transfers were identified, Sunflower Bank refused to return more than $800,000 of recovered funds unless Urban-gro signed an indemnity agreement, “consideration to which Defendant is not legally entitled as a condition of restoring the funds to their rightful owner, Urban-gro.”
Urban-gro has not yet recovered any of the stolen funds.
Urban-gro is asking for damages, pre-and-post judgment interest, attorneys fees and costs and “other and further relief as the court deems proper.” It has also demanded a jury trial.