If someone forged your signature and used your information to wire money from your bank account without your knowledge, is the bank responsible for not catching it? Should they refund your money? What if you borrowed money from that same bank to cover losses?
Questions like these are the subject of a lawsuit between Covington law firm The Lawrence Firm and Heritage Bank, which has offices throughout the region but whose main operating center is in Burlington.
In a complaint filed the with Kenton County Circuit Court on Aug. 9, the Lawrence Firm laid out its case.
The firm had two accounts with Heritage. The first was an Interest On Lawyers’ Trust Account, or IOLTA, which is an interest earning account where lawyers deposit clients’ money to prevent it from co-mingling with the firms’ own money and creating a conflict of interest. Payouts to clients as the result of a suit are often made from IOLTAs.
The other account was the firm’s general operating account.
The firm’s complaint alleges that in early August 2023, someone by the name of Jeffrey Levin (it’s unknown if this is the person’s true name or an alias) masqueraded as a new employee with the firm, hacked into the firm’s email accounts and sent an email from the account of attorney Jennifer Lawrence, the daughter of the firm’s founder and one of the firm’s primary shareholders. The email, which went to an unnamed firm employee, requested full access to the firm’s bank accounts, claiming that Lawrence had delegated full admin privileges to him, including the ability to perform wire transfers.
The firm employee then sent Levin an online account access form, which Levin filled out, signed with his own signature and a forged version of Lawrence’s signature, the suit alleges.
Even though Levin turned the form in to Heritage, the complaint reads, “the section of the form for the bank customer to identify which accounts were to be granted online access was left completely blank,” and “despite the fact that no [firm] employee had ever been granted authority to transmit online wire transfers, that same day, another Heritage employee advised Levin that he was being granted online wire transfer authority.”
Additionally, Levin failed to turn in the proper permission form, which would have granted him the authority to make wire transfers per an agreement with the bank. In short, the suit alleges that Levin lied about who he was and even then failed to follow the proper protocols to gain wire transfer access, which the bank missed and granted him wire transfer authority anyway.
“At least three different Heritage employees were involved in the process of granting Levin unrestricted access to [the Lawrence Firm’s] bank accounts,” the complaint alleges.
Levin then initiated four different wire transfers from the firm’s IOLTA, collectively totaling just over $1 million, to three different LLCs throughout the country.
Lawrence told LINK nky the firm was able to act quickly enough and succeeded in preventing the loss of any client money. They did this by borrowing money from Heritage Bank. They covered additional losses by borrowing money from other institutions.
The suit identifies this kind of fraud as business email compromise fraud, which the FBI defines as “a sophisticated scam targeting both businesses and individuals performing transfers of funds. The scam is frequently carried out when a subject compromises legitimate business email accounts through social engineering or computer intrusion techniques to conduct unauthorized transfers of funds.”
The FBI Internet Crime Complaint Center received 21,489 complaints and reported adjusted losses of over $2.9 billion resulting from business email compromise fraud in 2023, according to the agency’s 2023 Internet Crime Report.
The firm alleges the bank failed in its due diligence in allowing the transfers to occur.
“We just expected so much more,” Lawrence said, “and there were numerous breaches of their internal protocols.”
Lawrence said authentication protocols the bank had followed for years were not adhered to in this case.
“It’s just very disappointing because we just look to Heritage Bank to protect our clients’ funds and the funds overall,” Lawrence said. “This really could have been absolutely prevented.”
Even though about $400,000 of the money has since been recovered, court documents attest, “the actions of Heritage in first granting Levin full and unrestricted access to [the Lawrence Firm’s] bank accounts, and second, in processing four obviously fraudulent wire transfers, demonstrates the inadequacy of Heritage’s security procedures and its failure to implement even basic steps to counter [business email compromise] fraud.”
The firm reported the crime to both the Covington PD and the FBI. Lawrence said the time stamp on the fraudulent documents Levin turned into the bank bore a WAT, or West Africa Time zone, time stamp.
Levin has not been caught.
The complaint concludes by demanding a jury trial where the firm could seek full refunds of the payment orders from the bank plus interest.
The bank issued a counterclaim on Sept. 3, in which it denied many of the firm’s allegations against it, including the claims that the bank failed to follow proper security protocols.
The court documents lay out the bank’s counter arguments.
For one thing, the bank’s counterclaim says, “any damages suffered by Plaintiff were caused by persons not within the authority, control and/or agency of the Bank.”
Moreover, the bank alleges, the firm was the one who assumed any risk of loss and that they had failed to insulate themselves from damages.
Finally, the counterclaim points to the money the firm borrowed to cover their losses, citing the firm’s promissory note, security agreement and some subsequent changes to terms of the loan. The loan’s maturity date was July 24, 2024, which passed without a payment from the firm.
In other words, the bank said, “as of August 27, 2024, the amount of not less than $518,937.98” is still owed, and the firm, thus, is in default. The July 24 date when the payment was due occurred before the firm submitted its Aug. 9 complaint to the court.
To that end, the bank asked the court to dismiss the firm’s complaint, enforce the loan repayment (plus extra interest and fees for the default) and force the firm to pay for the bank’s legal fees. On the same date, Sept. 3, the bank also made a motion to directly pursue repayment from Lawrence and the other shareholders of the firm, who listed themselves as guarantors on the lending documents.
The court granted the bank’s motion on Sept. 12.
The firm answered back on Monday, Sept. 23, demanding the counterclaim be dismissed.
Lawrence maintains the bank is responsible for following through with Levin’s requests.
“This was their responsibility,” Lawrence said. “We couldn’t wire money. The bank did it.”
Heritage Bank and its attorneys declined to comment on the pending litigation.
The lawsuit will now move into its discovery phase, where the two parties will submit information and evidence to the court that will be used in a possible trial. Lawrence said the litigation will likely continue.
