'CEO Spoofing' costs drug company $50 million

MAPLE GROVE, Minn. (KMSP) - It’s one of the oldest scams around, yet it cost a local drug company tens of millions of dollars, according to court documents. Now, the drug company and its bank are fighting over the damages.

According to the lawsuit, scammers e-mailed the accounts payable coordinator at Upsher-Smith Laboratories, a drug company in Maple Grove, and pretended to be the CEO. The thieves instructed the employee to follow directions from the “CEO” as well as a lawyer’s name they provided. Over the course of three weeks in 2014, the employee asked the company’s bank, Fifth Third Bank, to make nine wire transfers totaling more than $50 million.

“This is really basic. This is just someone fooling you. This is like a prank phone call, only it’s an email,” Mark Lanterman, a digital forensics specialist at Computer Forensic Services, told Fox 9. "It’s referred to as CEO spoofing, where a hacker pretends tone a CEO or authorized signer on the account."

While Upsher-Smith Laboratories recalled one wire, the company claims it is out $39 million plus interest.

The drug company’s lawsuit says the bank missed “multiple red flags”: the “rushed nature” of the requests, the scammers’ “insistence on confidentiality,” the departure from “ordinary procedures,” failure to include a second person on the requests,” the “amounts and frequency of the transfers,” and “suspicious beneficiaries” — including one named “Sunny Billion Limited.”

Neither the bank nor drug company would comment given the pending litigation.

Lanterman believes the bank may be on the hook for missing the red flags, but that the case provides a big lesson. “The takeaway is education. Corporations should be conducting training for their employees about this very type of scam,” Lanterman told Fox 9. “The problem is you should never take an email at face value.”

An FBI spokesperson said this type of scam is increasing nationally, and they have received reports in the Twin Cities. Lanterman says he’s seen six or seven cases in the past couple years — all with losses over a million dollars.