An unnamed customer of Houston-based Prosperity Bank has fallen victim to a phishing scam that has cost it $2.6 million as a result of a fraudulent ACH payment.
The issue came to light in an unusual lawsuit that Prosperity Bank filed against JP Morgan Chase last week in Harris County.
According to the lawsuit, a customer of Prosperity Bank revised the ACH instructions for payments to one of its vendors based on a phishing email. As a result, Prosperity initiated an ACH in the amount of $2,582,762.13 to an account at Chase that did not belong to the intended beneficiary. It’s not clear when the ACH was initiated but Prosperity was informed of the fraudulent ACH instructions on April 11, 2019.
Prosperity sued Chase on April 12, 2019 and obtained a temporary injunction in order to freeze the account at Chase so that the funds could not be withdrawn or transferred to another account.
It’s not clear at this stage whether the funds are still in the Chase account or are long gone.
According to the Association for Financial Professionals 2019 Payments Fraud & Control Survey, 80% of businesses reported fraud from Business Email Compromise in 2018. For 44% of the emails that fraudsters send, they are trying to impersonate vendors requesting payment.