Sunflower Bank files counterclaim against suit from Urban-gro

This article was updated with comments from an Urban-gro executive.

LAFAYETTE — Sunflower Bank has filed an answer and counterclaim to a lawsuit from Urban-gro Inc. (Nasdaq: UGRO), alleging that it was Urban-gro’s own security failings, not the bank’s negligence, that led to the indoor agricultural engineering firm falling victim to a $5.1 million wire transfer fraud scheme.

In a document filed Thursday in Boulder County District Court, the Denver-based bank accuses Urban-gro of breaching a contract by failing to notify the bank of the alleged fraud in a timely manner and neglecting to properly secure its Sunflower account. 

It also names as defendants two entities, Davlean LLC and Ethbase Investments LLC, that received allegedly fraudulent transfers. Sunflower filed a motion to interplead, asking the court to hold onto more than $1 million in returned funds until it can be determined if the transfers from Urban-gro to those entities were indeed fraudulent.

Urban-gro initially reported last month that it had been hit with $5.1 million in fraudulent wire transfers. Three weeks later, it sued Sunflower, accusing the bank of ignoring established security practices, approving the fraudulent wire transfers despite obvious red flags, failing to follow up once Urban-gro discovered the fraud and refusing to release recovered funds unless Urban-gro signed an indemnity agreement.

According to Urban-gro’s complaint, a fraudster hacked the email account of Urban-gro chief financial officer Dick Ackright on Sept. 20 and used it to have Sunflower give them administrative access to Urban-gro’s accounts. The fraudster then used a fake email address to initiate six wire transfers from Urban-gro’s cash sweep account between Oct. 4 and 7, the complaint alleges. 

“This process of requesting and processing wire transfers circumvented the established security procedures in place and contravened the reasonable expectations of Urban-gro as to how wire transfers are requested and processed,” Urban-gro’s complaint reads. “Defendant allowed the unauthorized user to make use of Urban-gro’s funds without (1) providing any secure information such as login and password, (2) using established two-factor authentication, (3) independent wire verification by an initiator and separate approver, and (4) without having proper authority to even initiate or approve such wire transfers.”

In its answer, Sunflower denies Urban-gro’s allegations that its practices led to the fraud, stating that the responsibility is Urban-gro’s for “its failure to monitor its accounts and emails with Sunflower for excessive periods of time, and its failure to institute and/or adhere to sufficient security procedures and protocols related to its accounts and computer systems.”

In its counterclaim, the bank alleges that Urban-gro breached its contract by not notifying it about the fraud within 24 hours and by “failing to undertake adequate protective measures to protect its own computer systems from infiltration by the alleged fraudster.”

Sunflower also said that it recovered $1.7 million in stolen money from the receiving banks, which required Sunflower to sign indemnification agreements to receive the money. Sunflower is asking Urban-gro to sign an indemnification agreement before it returns the money. 

“Urban has also steadfastly refused to provide virtually any information concerning the events surrounding the allegedly fraudulent wire transfers,” the counterclaim reads. “Without such information, Sunflower cannot investigate to verify that the transfers were in fact fraudulent or otherwise unauthorized by Urban. It is conceivable that, without limitation, the alleged transfers were valid or that the alleged fraudster has some affiliation with Urban whereby Urban would bear the responsibility for the wire transfers.”

Sunflower is asking to be discharged of liability and to have the court hold the $1.7 million until it can determine if the transfers were actually fraudulent. 

The bank is asking the court for damages and has demanded a jury trial. Urban-gro has retained Giovanni Ruscitti of Berg Hill Greenleaf Ruscitti LLP in the lawsuit. Sunflower Bank is represented by Eric Liebman of Moye White LLP.

“Urban-gro stands by the allegations in its complaint and looks forward to this matter being resolved by the judge and jury,” Ruscitti told BizWest. “We’re in the process of preparing a response in objection to [the motion to interplead] and will be submitting it in the near future, asking the funds to be released to Urban-gro, as the funds belong to Urban-gro.”

UPDATE:

Said Urban-gro president and chief operating officer Jim Dennedy: “We find it pretty disturbing that Sunflower Bank is blaming our company. We’re the victim of financial fraud, a situation we believe was only possible because a senior bank official circumvented their own security protocols.”

Urban-Gro Inc. v. Sunflower Bank, Case no. 2021CV30829, Boulder County District Court.

© 2021 BizWest Media LLC

on Facebook on LinkedIn