JPMorgan Chase Bank was fooled into wildly overpaying for a student loan assistance company after the bank dropped its guard on how carefully to vet the startup’s customer database.

The story of how Charlie Javice convinced JPMorgan her startup firm, Frank, had valuable data on 4.25 million college students—when it had less than 300,000 customers—offers a cautionary tale to compliance professionals on due diligence failures.

On Tuesday, the Securities and Exchange Commission (SEC) filed a complaint against Javice, alleging she orchestrated a scheme to create nearly four million fake student accounts and convince JPMorgan and a third-party verifier the bank hired the data was legitimate. The bank paid $175 million to acquire Frank in 2021 but likely would have paid much less—or rejected the merger altogether—had the number of Frank’s legitimate customer accounts been known.