Independent Oil Producer Sues Bank Over $299K Cyber Theft
TRC Operating Company (TRC), an independent oil producer based in Taft, California is suing its bank to recover $299,600 that organized cyber thieves stole in November, 2011 from the company accounts at United Security Bank of Fresno (USB).
The sustained attack against TRC Operating Company began November 10, 2011 and ended November 14, 2011 when overseas Ukrainian cyber criminals gained access to the account and used the information to attempt to make twelve unauthorized wire transfers totaling $3,450,670.00 to offshore bank accounts in the Ukraine. While some of the transfers were avoided and others were clawed back, the cyber thieves were successful in retaining $299,600 from TRC’s account.
It was not until after three transfers totaling $587,360 were successfully completed and nine additional transfers were simultaneously attempted that USB contacted TRC to “state a reason to what the payments are for” or the transfers would be “returned” and unfulfilled. TRC President Tracy Rogers and TRC’s IT consultants contacted the bank once it learned of the incident to immediately dispute the obviously fraudulent transfer said TRC representative Charlie Comfort. According to Comfort, the initial discussions with USB centered around getting the FBI to help recover TRC’s stolen money.
“It was only after we got the attorneys involved on our side that it became apparent they were through helping us. The eye opener came when I spoke with the FBI in early December 2011 and was told that the FBI doesn’t get our money back, they only decide if there is a case worth pursuing and try to get the bad guys if possible. The bank never told me directly it was my problem, only that they would try to help get the money back from the bad guys banks,” said Comfort.
The security procedure followed by USB in connection with the fraudulent transfers was not, and continues not to be, commercially reasonable. TRC alleges that if a commercially reasonable security procedure existed, USB failed to follow it. And as such, the successful transfer was not effective as an order of TRC under Commercial Code section 11202.
Despite the fact that the successful transfer was not authorized by TRC, United Security Bank refused, and continues to refuse, to refund the $299,600.00 that was transferred from TRC Operating Company’s accounts as a result of the fraud.
As of publication deadline on May 30, 2012 United Security Bank of Fresno had not yet responded to TRC’s lawsuit.
TRC filed its lawsuit in Kern County (California) Superior Court (CASE NO.: S-1500-CV-276652) on May 17, 2012 [read the full complaint here].
Summary of Events
The total of the number of transfers attempted was 12: 3 actually went through, with 2 being clawed back (these were on November 10th, leaving 9 attempts on November 14th that were unsuccessful because the bank emailed TRC on that date).
The total amount of those attempted transfers is $2,275,950.00.
The total attempted but unsuccessful, successful and clawed back, and successful transfers, is $3,450,670.00.
The total remaining amount USB owes TRC is $299,600.00 (plus interest), as referenced in the Complaint.