Three weeks after Urban-gro Inc. (Nasdaq: UGRO) reported it had been hit with $ 5.1 million in fraudulent wire transfers, the interior agricultural engineering company sued its bank for having allegedly allowed fraud.
In a lawsuit filed in Boulder County District Court on Friday, Urban-gro, a Lafayette-based interior farming engineering company, accuses Denver-based Sunflower Bank of ignoring the practices of established security, approving fraudulent transfers despite obvious red flags, without following through once Urban-gro discovered the fraud and refused to release the recovered funds unless Urban-gro signed an agreement compensation.
Urban-gro retained Giovanni Ruscitti of Berg Hill Greenleaf Ruscitti LLP in the lawsuit. Sunflower Bank is represented by Eric Liebman of Moye White LLP.
“Sunflower just received the complaint over the weekend and is still reviewing it,” Liebman told BizWest in an email. “As a result, Sunflower is unable to provide comment at this time.”
According to the complaint, Urban-gro opened several business accounts with Sunflower Bank in March, including a sweep account which the complaint claimed was for the sole purpose of maintaining a specified minimum balance and was not authorized to send transfers. electronic. CFO Dick Ackright and Vice President and Controller Wes Smith were the only Urban-gro representatives to receive account signing authorizations.
Besides them, only four other employees were given online banking credentials, and only two of them were allowed to make wire transfers. New administrative users with such permissions were not allowed to be added without the approval of the Urban-gro board of directors.
Before the fraud occurred, all of Urban-gro’s legitimate wire transfers were initiated by one of these two employees and approved by Smith, and “exceptions to this practice have never occurred and have not occurred. never been requested, ”according to the complaint. Sunflower Bank’s procedures allowed wire transfers to be made through the online banking platform, over the phone, or in person, depending on the complaint, but never by email.
On September 20, according to the complaint, an individual hacked Ackright’s email account and used it to send an email to Sunflower Bank requesting that someone named “Alan Myers” be added as administrator to all Urban-gro accounts while “Urban-gro was unaware that this had happened. Rather than contacting Urban-gro about it, according to the complaint, Sunflower Bank approved the unauthorized user as administrator of the Urban-gro accounts.
The complaint goes on to claim that on October 1, the scammer again contacted Sunflower Bank using Ackright’s email address to ask if the scanning account could be set up for wire transfers and if the process for checking out. Two-factor authentication could be bypassed, requests that “were unprecedented and should have been a red flag for the defendant.” The bank’s branch manager responded that she would create an exception and process transfers directly, according to the lawsuit.
On October 4, according to the complaint, the unauthorized user emailed the branch manager from “an obvious fake account” whose domain did not match the Urban-gro email domain, requesting three fraudulent wire transfers. totaling $ 2.4 million on the sweep account. These were approved despite exceeding the daily limit of $ 1 million on wire transfers from this account.
According to the complaint, the transfers were:
- $ 810,500 at a Citi bank in Vernon Hills, Illinois.
- $ 744,280.50 at a TD bank in New York.
- $ 875,950 to a TD bank in Pensacola, Florida.
On October 7, the fraudster contacted Sunflower Bank again using a fake email address and requested three more fraudulent transfers exceeding the daily limit of $ 1 million. Additionally, one of those transfers was in South Carolina, a state where Urban-gro had never sent a transfer before, according to the complaint. These transfers were also approved by the branch manager of Sunflower Bank, according to the lawsuit.
These transfers were:
- $ 852,700.50 at a Chase Bank in Delray Beach, Florida.
- $ 895,000.75 at a Wells Fargo in Buena Park, California.
- $ 924,700 at a Chase bank in Greenville, SC
“This process of requesting and processing wire transfers bypassed established security procedures in place and violated Urban-gro’s reasonable expectations of how wire transfers are requested and processed,” the complaint states. “The defendant authorized the unauthorized user to use Urban-gro funds without (1) providing secure information such as username and password, (2) using established two-factor authentication , (3) independent wireline verification by a separate initiator and approver, and (4) without having the appropriate authority to even initiate or approve such wire transfers. “
On October 13, according to the complaint, Smith discovered the fraudulent transactions and immediately notified the bank. However, according to the complaint, Sunflower Bank did not contact the receiving banks or contact the FBI, but instead “told Urban-gro to confirm the authenticity of the transfers internally before drawing any conclusions.” On October 13 and 14, Smith spoke with representatives from TD Bank and Chase Bank who were able to identify two of the fraudulent transactions. On October 20, Urban-gro filed a report with the FBI’s Internal Crime Complaint Center.
Finally, the complaint alleges that even after these fraudulent transfers were identified, Sunflower Bank refused to return more than $ 800,000 of recovered funds unless Urban-gro signed a compensation agreement, “Consideration to which the defendant is not legally entitled as a condition of returning the funds to their rightful owner, Urban-gro.
Urban-gro has yet to recover any of the stolen funds.
Urban-gro seeks damages, pre- and post-judgment interest, attorney fees and costs and “other remedies that the court deems appropriate”. He also requested a jury trial.
© 2021 BizWest Media LLC