CJ-2026-1155 - Salt Yoga, LLC v. Gordon & McCurley, P.C.

What's This Case About?

Let’s get one thing straight: this is not your average accounting dispute. We’re not talking about a misplaced decimal or an overcharged hourly rate. No, this is the kind of story that starts with “Wait, what?” and ends with “Did he really just do that?” An accountant — a certified public accountant, mind you, the same guy who’s been handling the books for a yoga studio and its owner for over two decades — is now accused of being the unwitting (or maybe not-so-unwitting?) middleman in a $159,000 cyber heist. How? By allegedly transferring money to a fake email address from a bank account that didn’t even exist. And no, the yoga studio didn’t lose the money to a rogue chakra cleanse investment. They lost it because their trusted CPA may have fallen for the most basic phishing scam since “Nigerian prince.”

Meet Teresa Gawey, the owner of Salt Yoga, LLC — a serene little wellness oasis tucked inside Utica Square in Tulsa, Oklahoma, where people presumably go to find inner peace, not get financially gut-punched. Teresa’s been working with Steve A. McCurley, a partner at the accounting firm Gordon & McCurley, P.C., for 25 years. That’s longer than some marriages last. McCurley wasn’t just doing her taxes — he was handling bookkeeping, financial statements, and even executing bank transfers on her behalf. He had access to her accounts. He knew her habits. He knew she only banked with Mabrey Bank. He knew her email was [email protected]. This wasn’t some fly-by-night gig. This was a full-on financial symbiosis.

So picture this: it’s January 2026. The air is crisp, the yoga mats are rolled out, and Teresa does what she’s done every January for years — she asks McCurley to move some cash from her business account to her personal savings. This year, it’s $114,000. She emails him from her usual address, gives clear instructions, even throws in the last four digits of her accounts to avoid confusion. All systems go. McCurley replies: “Will get the funds moved over.” Classic. Professional. Nothing seems amiss.

But then — plot twist — someone else emails McCurley. Same name. Similar email. But not the same. This message comes from [email protected] — note the misspelling: “gaway,” not “gawey,” and a Gmail account she’s never used. This imposter — let’s call them “Fake Teresa” — casually drops in: “Hey Steve, also move $45,000 to our other checking account ending in 2316… you got the routing number?” Now, remember: Teresa has never had a Chase account. Never mentioned one. Never authorized transfers to any bank outside Mabrey. But McCurley, instead of picking up the phone or doing a basic sanity check like, “Wait, since when do we have a Chase account?” — goes full autopilot. He says, “No, I don’t have it — send it to me.” And Fake Teresa does. Like it’s totally normal.

And then McCurley does the unthinkable: he transfers $45,000 to that Chase account. Then, when Fake Teresa says one of the transfers failed (probably because reality briefly tried to intervene), McCurley transfers the other $114,000 — the very money Teresa had asked to go to her Mabrey savings account — to the same Chase account. Total damage: $159,000. Poof. Gone. To a bank Teresa has never set foot in. To an email she didn’t send. To a request she never made.

When Teresa realizes the money never showed up in her account, she panics. She calls McCurley. She tells him something’s wrong. That his email might have been hacked. That someone’s impersonating her. And what does McCurley say? Not “Oh my God, I’ll call the bank.” Not “Let me reverse the transfers.” No. He says: “I was confused the day the transfers were made and still confused to day.” (Yes, “to day.” We assume that’s a typo, but honestly, at this point, who knows?)

Now, here’s the legal tea: Salt Yoga and Teresa aren’t suing the hacker — they’re suing McCurley and his firm. Why? Because they say he failed his duty as a professional. They’re not just mad — they’re alleging professional malpractice, negligence, and unjust enrichment. In plain English: “You were supposed to protect our money. You had all the red flags — wrong email, unfamiliar bank, out-of-character request — and you didn’t even blink. You didn’t call. You didn’t verify. You just handed over six figures like it was Monopoly money.” And because McCurley was acting as part of his job at Gordon & McCurley, the firm is on the hook too — legally speaking, they’re responsible for his screwups.

What do they want? At least $75,000 in actual damages — though they lost $159,000, they’re asking for a minimum of $75K, likely because some legal math or recovery attempts are factored in. But here’s the spicy part: they’re also demanding exemplary (a.k.a. punitive) damages. That’s not about making them whole — that’s about punishing the defendant. It’s the legal equivalent of saying, “You didn’t just mess up. You messed up so badly that we need to slap your wrist with a financial trout to make sure no other accountant ever zones out during a phishing scam again.”

Is $75,000 a lot? For a yoga studio, absolutely. That’s rent, payroll, new mats, essential oils, and maybe even a few silent retreats — all gone. But in the grand scheme of accounting firms and malpractice cases? Not crazy high. It suggests they’re not trying to bankrupt the firm — just hold them accountable. The real kicker is the punitive damages, which could multiply that number if the court agrees McCurley’s actions were that reckless.

Now, let’s talk about what’s really absurd here. It’s not that someone got hacked — cybercrime happens. It’s not even that an email scam worked — those are depressingly common. It’s that a certified public accountant, after 25 years of handling someone’s finances, didn’t have a single verification protocol. No phone call. No text. No “Hey Teresa, just confirming — since when do we have a Chase account?” Nothing. He saw an email from “Teresa” (sort of), asked for bank details (which any hacker could fabricate), and then moved six figures without a second thought. And then, when called out, his defense is “I was confused”? That’s not a defense. That’s a confession.

We’re not saying McCurley is the hacker. But we are saying that if your CPA is more trusting than a golden retriever at a dog park, maybe it’s time to reevaluate your financial relationships. And look, we’re all for mindfulness and trusting the universe — that’s what yoga’s about, right? But when it comes to moving $159,000, maybe a little paranoia is healthy. A quick phone call could’ve saved the day. Instead, we’ve got a lawsuit that reads like a cybersecurity PSA directed at middle-aged accountants who still use fax machines.

So whose side are we on? Hard to root for anyone who loses that much money — but Teresa and her yoga studio didn’t do anything wrong. They trusted a professional. And McCurley? Either he was shockingly careless, or he had the worst judgment of any CPA in Oklahoma history. Either way, this case is less about yoga and more about how not to run a financial practice. Namaste, but also — seriously, pick up the phone.

Case Overview

Petition

Jurisdiction

District Court of Tulsa County, Oklahoma

Filing Attorney

William W. O'Connor

Hall, Estill, Hardwick, Gable, Golden & Nelson, P.C.

Relief Sought

$75,000 Monetary

$1 Punitive

Plaintiffs

Salt Yoga, LLC business
Rep: Hall, Estill, Hardwick, Gable, Golden & Nelson, P.C.
Teresa Gawey individual
Rep: Hall, Estill, Hardwick, Gable, Golden & Nelson, P.C.

Defendants

Gordon & McCurley, P.C. business
Steve A. McCurley individual

Claims

#	Cause of Action	Description
1	negligence, professional malpractice, unjust enrichment	allegations of breach of duty to exercise reasonable care to protect client funds and prevent unauthorized transfers

Petition Text

1,683 words

IN THE DISTRICT COURT OF TULSA COUNTY STATE OF OKLAHOMA SALT YOGA, LLC, an Oklahoma limited liability company, and TERESA GAWEY, an individual, Plaintiffs, v. GORDON & McCURLEY, P.C. an Oklahoma professional corporation, and STEVE A. McCURLEY, Defendants. PETITION Plaintiffs, Salt Yoga, LLC ("Salt Yoga") and Teresa Gawey ("Gawey") (collectively, "Plaintiffs"), for their Petition against Defendants, Gordon & McCurley, P.C. ("G&M") and Steve A. McCurley ("McCurley") (collectively, "Defendants"), allege and states as follows: 1. Jurisdiction and venue are proper in this Court. 2. Salt Yoga is an Oklahoma limited liability company with its principal place of business in Tulsa, Oklahoma. Gawey is an individual who resides in Tulsa, Oklahoma. Gawey is the sole member and manager of Salt Yoga. Salt Yoga provides a variety of health and wellness services to the public at its yoga studio located at Utica Square in Tulsa. 3. G&M is an Oklahoma professional corporation with its principal place of business in Tulsa, Oklahoma. McCurley is an individual who resides in Tulsa, Oklahoma. G&M is an accounting firm, and McCurley is a certified public accountant and partner in G&M. G&M provides professional accounting, tax, advisory and bookkeeping services to the public and has done so for decades. 4. For at least twenty-five (25) years McCurley has provided professional tax, accounting, advisory and bookkeeping services to Gawey and her family. Similarly, McCurley has provided these same services to Salt Yoga since its creation in 2012. 5. As Plaintiffs’ long-time certified public accountant and advisor, McCurley and G&M have detailed knowledge of and access to Gawey’s and Salt Yoga’s bank accounts. During all relevant and material periods, these accounts have been located at Mabrey Bank. Neither Gawey nor Salt Yoga have a checking or savings account at any other bank or financial institution other than Mabrey Bank. Likewise, neither Gawey nor Salt Yoga have ever provided McCurley with any information or indication that they had an account at a financial institution other than Mabrey Bank. During all material and relevant periods, when communicating with McCurley by email, Gawey has primarily used only one email account, [email protected]. 6. In January of every year, McCurley creates financial statements for Salt Yoga showing the prior year’s financial performance, including the amount of cash on hand at the end of the year. With this information, Gawey transfers a portion of these funds from the Salt Yoga account to Gawey’s personal checking account. Each time this process occurs, Gawey seeks McCurley’s input on the amount of the transfer to ensure there is enough cash remaining in Salt Yoga’s account to fund ongoing operations. And because McCurley has on-line access to Gawey’s business and checking accounts, he typically handles the transfer of funds on her behalf as part of his service to her and has done this previously. 7. On or about January 25, 2026, McCurley sent Gawey Salt Yoga’s 2025 financial statements. As she had done before, Gawey emailed McCurley the next day on January 26, 2026, instructing him to transfer $114,000.00 in funds from her Salt Yoga business account at Mabrey to her personal savings account at Mabrey. 8. McCurley responded to Gawey’s email, advising her that the amount of the transfer would leave sufficient operating funds in the Salt Yoga account. However, McCurley advised that he could not make the transfer since he did not have access to Gawey’s savings account. Gawey immediately responded by authorizing McCurley to transfer the funds to her personal checking account, which he did have access to. McCurley responded that he “will get the funds moved over” as instructed. 9. Importantly, when authorizing McCurley to transfer the $114,000.00 funds on her behalf, Gawey provided the last four digits of both her savings and her checking account to ensure there was no confusion and that her instruction was clear. 10. After Gawey authorized McCurley to transfer the $114,000 in funds from her Salt Yoga business account to her personal Mabrey checking account, McCurley received a communication on January 26, 2026, from a person purporting to be Gawey but who in fact was an imposter ("Imposter"). The Imposter, using an email address of [email protected], instructed McCurley as follows: "And also Steve, Would like to move $45,000 to our other checking account ending in 2316, Do you have the account number and routing number or do you need me to have it sent now?" McCurley responded, as follows: "No...I don’t have the account ending in 2316; please send it to me." 11. The Imposter provided the account and routing number for the Chase account ending in 2316. On January 26, 2026, McCurley confirmed that he had successfully made the transfer: "It is done --- will deposit to Chase on the 28th …. the transfer requires two days." Later that same day, McCurley further advised the Imposter that "The Mabrey transfer was also made ….i was able to deposit into the Savings account." 12. A few days later on January 30, 2026, McCurley received an email from the Imposter instructing him to move additional funds from the Mabrey savings account to the Chase account ending in 2316. In response to this communication, McCurley stated that one of the two transfers of $45,000.00 and $114,000.00, respectively, was rejected likely due to an incorrect account number. The Imposter confirmed to McCurley that [they] had received the $45,000.00 deposit and then instructed McCurley to transfer the $114,000.00 to the same Chase account ending in 2316. Later that day, McCurley confirmed to the Imposter that "Transfer has been made." 13. Neither Gawey nor Salt Yoga have ever communicated with Defendants using an email address of [email protected] and do not own or use this address to communicate. Further, neither Gawey nor Salt Yoga have ever had a bank account at Chase and have never informed McCurley that they had such an account, given him access to such account or authorized him to transfer funds from any of their Mabrey accounts to an account at Chase or any other financial institution other than Mabrey Bank. 14. Neither Gawey nor Salt Yoga, when asking McCurley to transfer funds from Salt Yoga at the beginning of a fiscal year to their personal account, have ever to their knowledge asked him to revise the number or send funds to accounts at two different banks. 15. Through no fault or knowledge of Plaintiffs, it is apparent that G&M's email system was hacked by the Imposter and that said Imposter was monitoring G&W's confidential client communications before Gawey's original communication to McCurley to transfer funds. When it became apparent to Gawey that the funds she had instructed McCurley to transfer from her Salt Yoga account to her personal checking account had not been transferred per her instructions, she took immediate action to attempt to recover the fraudulent transfer but to no avail. Tellingly, once Gawey apprised McCurley that the Salt Yoga funds had never been deposited into her checking account as she had instructed and that G&M’s email accounts may have been hacked, McCurley responded as follows: “I was confused the day the transfers were made and [sic] still confused to day.” 16. McCurley owed Plaintiffs a duty to exercise the degree of skill, care, and diligence ordinarily exercised by reasonably prudent professionals in the same field and under similar circumstances to ensure the proper, secure and safe transfer of client funds according to Plaintiffs’ express instruction and authorization. 17. However, McCurley breached his duty to Plaintiffs. McCurley knew or should have known that he was communicating with an imposter when instructed to transfer funds to a bank account he knew or should have known that his clients, Gawey and Salt Yoga, did not use, own or control. At a minimum, when McCurley received communications from Gawey using a gmail.com account that he knew or should have known she did not use, own or control, McCurley should have inquired further by at least calling Gawey and verbally verifying her instruction before transferring the funds or taking other appropriate steps to ensure he was properly following his client’s instruction. 18. As a result of McCurley’s failure to use reasonable care to protect Plaintiffs’ funds as alleged herein, Plaintiffs have lost $159,000.00 that was transferred to a third-party without Plaintiffs’ knowledge and consent that despite their best efforts cannot be recovered. This loss would not have occurred if McCurley had appropriate cybersecurity protocols and protections in place to protect the confidentiality of sensitive client communications and/or if McCurley had inquired further before making the subject transfers of client funds when put on notice of conduct that a reasonable person in his position knew or should have known was suspicious or fraudulent. 19. At all material times, McCurley was acting within the course and scope of his employment and/or agency with G&M. The wrongful acts and omissions of McCurley, as alleged herein, were committed while McCurley was performing tasks and duties in furtherance of the business interests of G&M. Accordingly, G&M is vicariously liable for the acts and conduct alleged herein to the same extent as McCurley. G&M and McCurley are likewise directly liable to Plaintiffs for all acts and conduct alleged herein. 20. Without limiting the available theories of relief, Defendants’ acts and omissions as alleged herein constitute unjust enrichment, professional malpractice and negligence. 21. Defendants’ acts and omissions rise to the level set forth in Okla. Stat. tit. 23, § 9.1 entitling Plaintiffs to an award of exemplary damages. PRAYER FOR RELIEF WHEREFORE, Plaintiffs, Salt Yoga, LLC and Teresa Gawey pray for judgment against Defendants, Gordon & McCurley, P.C. and Steve A. McCurley, jointly and severally, as follows: (a) for actual damages against Defendants in an amount to be determined at trial but believed to be at least $75,000.00; (b) exemplary damages; (c) prejudgment interest as allowed by law; (d) costs and attorney fees as allowed by law; and (e) for such other and further relief this Court deems just and proper. Dated: March 13, 2026 Respectfully submitted, HALL, ESTILL, HARDWICK, GABLE, GOLDEN & NELSON, P.C. William W. O’Connor, OBA #13200 John T. Richer, OBA #19554 Hillary Hurst, OBA #36158 521 East 2nd Street, Suite 1200 Tulsa, Oklahoma 74120 Telephone: (918) 594-0400 Facsimile: (918) 594-0505 Email: [email protected] Email: [email protected] Email: [email protected] ATTORNEYS FOR PLAINTIFFS