The amount of money lost each to year fraudulent wire transfers is skyrocketing. Most of the frauds are easily preventable with a little common sense and due diligence. When money is sent to the wrong party and lost, determining who is responsible can be tricky. In this case we will examine a recent lawsuit filed in New York and segue to the larger issues surrounding spoofed emails and diverted wire transfers
Accounting Firm Sued for $1.3 Million Hacking Loss
Warner Bros says a Rockland County, New York accounting firm allowed a hacker to divert $1.3 million of the company’s money. Warner Bros. says it has not been able to recover the money from the accounting firm or the hacker.
According to a lawsuit filed in February 2020, the entertainment giant Warner Bros. hired a small New York accounting firm to help them manage the accounts of a small business they had acquired. The plan was to use the local accounting firm for a few months while the company integrated the new business’ accounting system.
Warner Bros purchased a business called EMNY. Dan Schwartz CPA PC (“Schwartz”) was EMNY’s long time accountant. During the acquisition transition, Warner Bros agreed to pay $2000 per month to Schwartz. The accounting firm was to pay EMNY’s bills, payrolls and taxes. Once the integration was complete, Schwartz understood his assignment would end and that he would transfer any account balances to Warner Bros.
As the relationship started, Schwartz and people within Warner Bros frequently communicated by email. One month into the relationship, Warner Bros sent an email to Schwartz indicating that it was getting ready to have Schwartz wire EMNY’s money into a Warner Bros account at Bank of America. Shortly thereafter, Warner Bros sent wire instructions to Schwartz.
The accounts held by Schwartz had a balance of roughly $1.3 million at the time. You probably know what happened next. The details, however, are important in establishing liability.
Warner Bros says that Schwartz’s email was hacked. That allowed a hacker to intercept the wire instructions. According to the complaint,
“Having intercepted the legitimate request from Warner Bros., the Hacker sent a fraudulent request to Schwartz to supersede it. At 3:01 p.m. (EST) on February 19, 2019, the Hacker sent an email to Schwartz from an email account that was intended to mimic – but in fact misspelled – the email address of a Warner Bros. employee. In that email, the Hacker requested that Schwartz transfer the WB Funds from EMNY’s savings account to a Wells Fargo account... The Hacker claimed that the Wells Fargo bank account belonged to Warner Bros. but in fact, it did not.” [We presume that was an account controlled by the hacker.]
The money was transferred. By the time the parties figured out the wire instructions were false, the money was gone. Warner Bros has not been able to locate the hacker and Schwartz presumably doesn’t have a spare $1.3 million lying around.
So who is responsible for the missing money? Unfortunately for Dan Schwartz, we think his accounting firm is.
The first mistake occurred when the recipient of the wire instructions (Schwartz) failed to confirm the wire instructions. This wasn’t a $50 transfer. The accounting firm relied on an email before wiring $1.3 million. There was no verification done by Schwartz before sending the money.
We always recommend using a different mode of communication and verifying the details of the transfer. If the original instructions came by email, pick up the phone and call the sender. More importantly, call the sender at a known number, not a number found on the email!
The failure to verify a wire of that size is negligence.
The second mistake is the failure to detect the many clues on the instructions. Schwartz had been told the money was going to Bank of America but apparently didn’t question things when the instructions showed a Wells Fargo account. He also didn’t notice that the email address was spoofed.
We often see hackers substitute a “1” for a “I” or an “0” for an “O.” We also frequently see misspellings and grammatical mistakes.
Much of this case will turn on whose email system was hacked. According to the complaint, it was the accounting firm’s email system that was hacked. In fact, Warner Bros says that Schwartz even ignored “security alerts” sent to him.
Had Warner Bros email been hacked, both parties may have been culpable but the sender of the wire could still have prevented the loss by simply confirming the instructions.
Dan Schwartz made just $2000 in fees but may soon be liable for $1.3 million. Warner Bros has sued the firm for accounting malpractice and breach of contract.
Accountants, lawyers, title companies… we are seeing an increasing number of these misdirected wire transfer cases. If you lost money because your lawyer or accountant sent your funds to the wrong location, you may have a case for legal or accounting malpractice. Similarly, if you are buying a business or home and your lawyer or accountant’s email was hacked and you are given incorrect wire instructions, you may also have a case for your lost funds.
How to Avoid Wire Transfer Fraud
- ALWAYS verify the instructions
- Verify emailed wire instructions by phone and vice versa.
- Don’t use an address or phone number found on an email or left on a voice mail. Use a number you know to be legit and dial it yourself. (Very sophisticated hackers have begun to spoof outgoing phone numbers and use voice synthesizers to replicate voices of other people.)
- Look carefully at the email address on the instructions. Although sophisticated hackers can spoof any email, most scam wire instructions are sent from similarly sounding email addresses.
- Look for typos and grammatical errors. Many of these hackers are overseas. Often their command of English is a bit off and random words are capitalized.
- If despite all precautions your money is lost, contact both the sending and receiving bank immediately. The longer you wait, the harder it is to recover funds. (Remember, in the hacked email / misdirected wire schemes the money usually goes offshore.)
- Contact local law enforcement and the FBI after first contacting the banks.
We hope you never need our services. If you lost $1 million or more, contact us. We can be reached online, by email [hidden email] or by phone 877-858-8018.