Lisman allegedly logged into the SAP Ariba portal and replaced the bank account information on file with information from his Chase account, along with a falsified ACH authorization and Form W-9.