Phishers (almost) scam grocery giant out of $10 million

Computerworld - Apparently it's not just unwary individuals that fall victim to online scammers. Even large corporations, it seems, can get suckered into parting with their money by devious phishers.

Case in point: Eden Prairie, MN.-based grocery chain Supervalu Inc., which earlier this year got conned into depositing more than $10 million into two fraudulent bank accounts before recognizing the ruse. Details of the case are contained in court documents filed in connection with two forfeiture cases stemming from the incident.

According to federal court filings in the U.S. District Court for the District of Idaho, the fraudulent activity took place in late February and early March this year. In the court filings, Stephen Kilgroff, Supervalu's vice president of legal affairs, said that on February 26 and 28 the company received two separate e-mails, one purporting to be from an employee at American Greetings Corp. and the second from an employee at Frito-Lay, both company-approved vendors.

Both e-mails told Supervalu to send future payments for each vendor to new bank account numbers. In the case of the e-mail that purported to be from American Greetings Corp., Supervalu was advised to send payments to an HSBC account in Miami. The other e-mail advised Supervalu to send Frito-Lay payments to an account at First Security Bank in Rogers, Arkansas.

Between Feb 28 and March 3, Supervalu deposited just over $6.5 million via multiple wire-transfers to the HSBC account, thinking that it was sending the money to American Greetings Corp. Similarly, on March 2 it made eight separate wire-transfers to the bank in Arkansas, depositing a total of $3.6 million to an account it thought belonged to Frito-Lay.

In addition to the $6.5 million deposited by Supervalu into the HSBC account, an additional amount of $500,000 had been deposited into the same account by a second company, identified as "ROHM" on court documents. No information has been available concerning the second company, and it is not a party to subsequent litigation.

Around March 6, according to the filings made by Kilgroff, Supervalu discovered that it had been "induced" into making the transfers to the bogus accounts. Following the discovery of the fraud, Supervalu quickly notified the appropriate law enforcement authorities, who managed to recover nearly all of the money before it could be withdrawn from the accounts.

The recovered money is now being claimed by Frito-Lay, American Greetings and Supervalu. In making the claim to the recovered money, Frito-Lay said that it believes the money belongs to Supervalu and said supported that company's claim to ownership of the misdirected funds.

"However to the extent there is any determination that the ownership of these funds changed from Albertsons / Supervalu [the Albertsons grocery chain was recently acquired by Supervalu -- eds.] to Frito-Lay (as a result of the attempted transfer, the misdirection, or any other development) Frito-Lay makes this claim to these funds in the alternative and subject to any claim of ownership by Albertsons / Supervalu" the company said in an affidavit.

A federal judge is expected to rule sometime in November on which firm should receive the recovered funds.

A spokeswoman from Supervalu responded via e-mail to a request for comment. "As indicated by the forfeiture complaint filed by the U.S. Attorney's Office in Boise, Supervalu was the target of attempted financial fraud," spokeswoman Haley Meyer said. "Due to our internal controls and processes, we were able to quickly discover and report this to the FBI. As a result of the quick work of the Boise FBI Office and the U.S. Attorney, any funds lost are minimal."

Read more about Security in Computerworld's Security Topic Center.