CyberInquirer - The Cyber Law and Insurance Blog

The following article was c0-written with my colleague Gary Klinger for a Cozen O?Connor client Alert. Gary turned it around in one-day. Then I got it? Hence the delay.

Please let us know if you would like to be added to the Alert e-blast list and receive articles on a variety of cutting-edge professional liability and general liability topics.? Also, be sure to see the Dark Knight Rises. The ending was perfect.

Rick

In a landmark decision, the First Circuit Court of Appeals held in Patco Construction Company, Inc. v. People?s United Bank, No. 11-2031 (1st Cir. July 3, 2012) ?that People?s United Bank (d/b/a Ocean Bank) was required to reimburse its customer, PATCO Construction Co., for approximately $580,000 which had been stolen from PATCO?S bank account.? In so doing, the Court reversed the decision of the United States District Court for the District of Maine which had granted summary judgment in the bank?s favor.

The dispute arose when Ocean Bank authorized six fraudulent withdrawals over seven days from an online account held by PATCO.? While the bank?s security system flagged each one of the transactions as ?high risk? because they were inconsistent with the timing, value, and geographic location of PATCO?s regular payment orders, the bank?s security system did not notify PATCO of this information and allowed the payments to go through. In light of this omission, PATCO sued, alleging that Ocean Bank should bear responsibility for the loss because its security system was not ?commercially reasonable? under the Uniform Commercial Code, as codified under Maine Law.

Ocean Bank moved for summary judgment on the basis that its use of a one-time log-in and password security requirement for transaction authentication was sufficient to comply with the ?commercially reasonable? standards.? The District Court agreed and granted the bank?s motion.

On appeal, the First Circuit reversed, based on its determination that the bank?s ?generic ?one-size-fits-all? approach to customers violates Article 4A?s instruction to take the customer?s circumstances into account.?? The Court explained that Ocean Bank?s failure to implement enhanced security procedures was unreasonable in light of its knowledge of ongoing fraud involving the same measures as had been used with respect to PATCO?s account.? When the fraud re-occurred in this ?unordinary? situation, the Court held that it was ?commercially unreasonable? for Ocean Bank?s security system to trigger only those security measures which were applicable to ?ordinary? transactions.? The Court reasoned the ?unprecedentedly high risk scores? on the potential transactions were well above PATCO?s regular risk scores and therefore should have triggered extra security measures to authenticate the transactions. The Court stressed, however, that it was the bank?s ?collective failures? taken as a whole, rather than any single failure, which rendered its security system commercially unreasonable under the circumstances.

The PATCO decision could have significant implications for financial institutions and their insurers, as it has the potential to open the ?floodgates? for businesses victimized by cyber fraudsters to sue their banks in order to recover misappropriated funds. It also could impact similar lawsuits currently pending, such as Choice Escrow and Land Title, LLC v. BancorpSouth Bank, Case No. 2010cv03531 (W.D. Miss.), which involves loss arising from ACH and wire fraud.

On the other hand, the First Circuit in PATCO suggested several proactive measures which might enable financial institutions to avoid the fate suffered by Ocean Bank.? Among other things, the Court identified the following enhanced security procedures: ?(i) manual reviews of suspect transactions by actual personnel to determine the legitimacy of a transaction, (ii) eschew a ?one-size-fits-all? security approach for customers, and (iii) ?customer verification? or notification to authenticate uncharacteristic or suspicious transactions.

At the same time, the Court noted that customers such as PATCO also might have certain responsibilities under Article 4A of the UCC, even when its bank?s security measures are found to be ?commercially unreasonable,?? although the Court left open the question of what those obligations might be.? Of course, whatever they may be, they did not exist on the facts presented.

PATCO is but one more example of the value and import of insurance products such as cyber, fidelity and related E&O coverages in an ever-changing virtual economy. Financial institutions, commercial entities and even individual account-holders cannot rely on others to protect them. Rather, they need to take pro-active steps to secure their interests, including purchasing tailored insurance which responds to their changing needs.? At the same time, the insurance industry must continue to stay ahead of the curve by anticipating the evolving risks and providing products which will address a rapidly-evolving market.

This entry was written by Richard Bortnick and posted on July 24, 2012 at 1:29 pm and filed under Banking, Cloud Computing, Electronic Communication, Fraud, General Interest, Insurance, Internet, Legal Research, Liability Insurance, Litigation, News, Online Security, Personal Identifiable Information, Privacy. Bookmark the permalink. Follow any comments here with the RSS feed for this post.

Source: http://cyberinquirer.com/2012/07/24/first-circuit-court-of-appeals-holds-bank%E2%80%99s-online-security-measures-%E2%80%9Ccommercially-unreasonable%E2%80%9D-in-landmark-decision/

the patriot nick diaz vs carlos condit hall of fame occupy dc ufc 143 fight card my fair lady conversion disorder