MikeFleming
03-29-2013, 10:51 AM
--Court Says Bank is Not Liable for Fraudulent US $440,000 ACH Transaction
(March 26, 2013)
A court in Missouri has ruled that Choice Escrow and Title LLC, which
lost US $440,000 in a single fraudulent automated clearinghouse (ACH)
transaction in March 2010, cannot hold its financial institution liable
for the loss. Choice filed a lawsuit against Bancorp South in November
2010, alleging that Bancorp did not employ adequate security measures
and that it should have noticed that the transfer request came from
outside the country, an anomaly for Choice. Bancorp countersued, saying
that the wire transfer request was made using legitimate account access
credentials through an IP address associated with Choice's bank account.
The US District Court for the Western District of Missouri said that
despite having been warned about just this sort of attack, Choice did
not adhere to Bancorp's recommended security procedures to require two
people to approve wire requests. Choice also declined to put a daily
limit on wire transfers.
http://krebsonsecurity.com/2013/03/missouri-court-rules-against-440000-cyberheist-victim/
http://www.computerworld.com/s/article/9237919/Victim_of_440K_wire_fraud_can_t_blame_bank_for_loss_judge_ru les?taxonomyId=17
http://krebsonsecurity.com/wp-content/uploads/2013/03/Choice-Escrow-SJ-Decision-031813.pdf
[Editor's Note (Murray): I tend to agree with Krebs that, at least in
the general case, dual authorization alone is not commercially
reasonable. However, in this case it might well have prevented the
loss. On the other hand, the question of commercially reasonable was
not considered. Rather, the decision turned on the Article 4a in the
UCC which governs the duties of the parties in contract when the
security offered is NOT commercially reasonable. I tend to agree with
Krebs that the case is not likely to be appealed. However, it is
unlikely to set a dangerous precedent, one that might reduce the
fundamental responsibility of banks to ensure that transactions are
properly authorized.
(Paller): This decision will encourage more banks to refuse to pay for
the losses of nearly all small businesses and not-for-profits that are
victims of ACH fraud, and may even spill over to persuade some banks to
try to make their individual customers (non-business) accountable for
their losses.]
(March 26, 2013)
A court in Missouri has ruled that Choice Escrow and Title LLC, which
lost US $440,000 in a single fraudulent automated clearinghouse (ACH)
transaction in March 2010, cannot hold its financial institution liable
for the loss. Choice filed a lawsuit against Bancorp South in November
2010, alleging that Bancorp did not employ adequate security measures
and that it should have noticed that the transfer request came from
outside the country, an anomaly for Choice. Bancorp countersued, saying
that the wire transfer request was made using legitimate account access
credentials through an IP address associated with Choice's bank account.
The US District Court for the Western District of Missouri said that
despite having been warned about just this sort of attack, Choice did
not adhere to Bancorp's recommended security procedures to require two
people to approve wire requests. Choice also declined to put a daily
limit on wire transfers.
http://krebsonsecurity.com/2013/03/missouri-court-rules-against-440000-cyberheist-victim/
http://www.computerworld.com/s/article/9237919/Victim_of_440K_wire_fraud_can_t_blame_bank_for_loss_judge_ru les?taxonomyId=17
http://krebsonsecurity.com/wp-content/uploads/2013/03/Choice-Escrow-SJ-Decision-031813.pdf
[Editor's Note (Murray): I tend to agree with Krebs that, at least in
the general case, dual authorization alone is not commercially
reasonable. However, in this case it might well have prevented the
loss. On the other hand, the question of commercially reasonable was
not considered. Rather, the decision turned on the Article 4a in the
UCC which governs the duties of the parties in contract when the
security offered is NOT commercially reasonable. I tend to agree with
Krebs that the case is not likely to be appealed. However, it is
unlikely to set a dangerous precedent, one that might reduce the
fundamental responsibility of banks to ensure that transactions are
properly authorized.
(Paller): This decision will encourage more banks to refuse to pay for
the losses of nearly all small businesses and not-for-profits that are
victims of ACH fraud, and may even spill over to persuade some banks to
try to make their individual customers (non-business) accountable for
their losses.]