Firm: ACH Fraud Ruling Sets Bad Precedent

Choice Escrow Seeks Appellate Bench Review
Firm: ACH Fraud Ruling Sets Bad Precedent

Choice Escrow and Land Title LLC has asked the Eighth Circuit Court of Appeals for a rehearing of its case against Mississippi-based BancorpSouth involving an account takeover dispute dating back to 2010.

See Also: Disputing Chargebacks: A Guide for eCommerce Merchants

The appellate court is expected to decide this week whether it will allow the case to be reheard en banc, meaning before the entire appellate bench rather than just a panel of judges.

Last month, an appellate court panel ruled that Choice Escrow was responsible for the $440,000 it lost to cyberthieves in March 2010 because the bank refused to use a two-person authorization security feature offered by the bank for wire transfers (see Bank Wins Account Takeover Loss Case).

As a result, the court not only found that the Missouri-based firm would have to absorb the fraud loss it suffered, but it also would have to pay legal fees incurred by the bank as part of the dispute, which dates back to November 2010 (see Wire Fraud Victim Sues Bank).

But Choice Escrow claims the court's order requiring it to cover the bank's legal fees essentially renders meaningless Article 4A of the Uniform Commercial Code, which provides fraud protections for commercial customers and helps to define what constitutes reasonable security offered by a bank.

"The effect of the opinion will be that banks can indirectly preclude a customer's right to file Article 4A lawsuits through indemnity provisions," Choice Escrow argues in its appeal for a rehearing. "While the award of attorney fees through an indemnity provision is devastating to Choice and its continued viability, the effect of the panel's opinion will be felt well beyond this case, in that it will have a profound and pervasive chilling effect on customer's 4A-202 rights."

A Bad Precedent?

Choice Escrow also argues that the Eighth Circuit's appellate ruling conflicts with the First Circuit's appellate ruling in the PATCO Construction Inc. vs. People's United Bank handed down in July 2012 (see PATCO ACH Fraud Ruling Reversed).

In the PATCO ruling, the First Circuit reversed a lower court's decision, finding that the bank's one-size-fits-all approach to security failed to consider PATCO's unique needs; thus, People's United's security offerings were not deemed reasonable, according to the court.

Choice Escrow argues that the Eighth Circuit's decision in its case does not follow the precedent set by PATCO. In the PATCO ruling, the court found that Article 4A considerations regarding the customer's unique circumstances should be reviewed when determining reasonable security.

Additionally, Choice Escrow argues, the court in the PATCO decision held that the bank ignored Article 4A's mandate that security procedures take into account "the circumstances of the customer" known to the bank. Article 4A directs banks to consider such circumstances as "the size, type and frequency of payment orders normally issued to the bank."

Ultimately, Choice Escrow is asking that the Eighth Circuit consider the precedent it is setting in its ruling. Choice Escrow argues that by ordering that it pay BancorpSouth's legal fees, the court is making it impractical for commercial customers in the future to seek legal action against their banking institutions when losses linked to account takeover incidents occur.

"Under the opinion, no matter how much is stolen and then refunded, the customer will always lose a significant amount of money," Choice Escrow argues.

The firm also claims that by having two conflicting appellate rulings regarding what constitutes reasonable security under the provisions of Article 4A, the Eighth Circuit is creating confusion for future account takeover cases.

"Had this case been in the First Circuit, Choice would have prevailed," Choice Escrow contends. "Due to the inherent split in the Circuits, Choice requests this petition for rehearing en banc be granted in order to secure and maintain uniformity of the court's decisions."

A Careful Review?

Amy McHugh, an attorney and former FDIC IT examination analyst who now works as a banking adviser for professional services firm CliftonLarsonAllen, says the court may grant Choice Escrow the rehearing because its recent ruling in the case ordering payment of the bank's legal fees was so unusual.

She also argues that the appellate court's justification for why BancorpSouth's security measures were deemed "reasonable" has left room for further debate.

"The escrow firm stated that dual control would not be appropriate, due to its small staff, and I questioned why a $13 billion bank was not able or willing to provide another security procedure to fit the customer's circumstances," McHugh says (see Fraud: Defining 'Reasonable Security').


Amy McHugh on defining reasonable security, relative to a customer's needs.

"It looks like the appeal is focusing on the 'size, type and frequency' of the payment orders to determine the security procedure, not the size/circumstances of the customer," McHugh says. "The Choice appellate ruling stated that the wires in question were not unusual for Choice, except for the funds' ultimate destination."

Transaction monitoring - automatic or manual - may have helped the bank in this case identify the wire destination as unusual, which would have prompted an alert to the customer, she says.

"I think the question is, 'Is transaction monitoring a security procedure to be judged as commercially reasonable or not, or a UCC 4A requirement above any specific security procedures that takes into account the 'size, type, and frequency' of the orders?"

Size, Type and Frequency

McHugh says the Eighth Circuit, it if does agree to rehear Choice Escrow's case, could find that defining reasonable security hinges not only on the size, type and frequency of a customer's transactions, but also on the customer's circumstances and ability to effectively use the security procedures that are provided.

"Due to size of the business and the staff available, are the offered security procedures "commercially reasonable"? McHugh asks.

But Article 4A is not just about protecting commercial customers, argues Dan Mitchell, an attorney with Maine-based firm Berstein Shur who represented PATCO in its landmark appellate case. Mitchell says a bank can shift the risk related to a fraud loss to a commercial customer if the bank can prove it took three steps before the fraud resulted: The bank and customer entered an agreement on security procedures, the agreed-upon security procedures were commercially reasonable and the bank acted in good faith when it approved the transactions in question.

Financial fraud expert Shirley Inscoe, an analyst at the consultancy Aite, says the industry is likely to see a wide range of interpretations and precedents regarding ultimate liability involving ACH and wire fraud disputes for years to come.

"Once legal precedents exist in any area of law, they are usually studied by both parties and help avoid meaningless lawsuits being filed going forward," she says. "Business account-takeover cases have only become an issue in recent years, and legal precedents have not existed. Part of the precedent set in this case involved the company having to pay the bank's legal expenses. The court may very well have included that to discourage frivolous lawsuits in the future."


About the Author

Tracy Kitten

Tracy Kitten

Former Director of Global Events Content and Executive Editor, BankInfoSecurity & CUInfoSecurity

Kitten was director of global events content and an executive editor at ISMG. A veteran journalist with more than 20 years of experience, she covered the financial sector for over 10 years. Before joining Information Security Media Group in 2010, she covered the financial self-service industry as the senior editor of ATMmarketplace, part of Networld Media. Kitten has been a regular speaker at domestic and international conferences, and was the keynote at ATMIA's U.S. and Canadian conferences in 2009. She has been quoted by CNN.com, ABC News, Bankrate.com and MSN Money.




Around the Network

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing ffiec.bankinfosecurity.com, you agree to our use of cookies.