Banking Law

Remember the multi-factor authentication guidelines for online banking that the FFIEC adopted a few years ago? The ones that bank were supposed to have complied with by the end of 2006? The ones we last posted about here?

Believe it or not, some banks have still not implemented multi-factor authentication for online banking, and are using only user names and passwords ("one-factor authentications") as their one and only line of defense against unauthorized "penetration" of their online banking systems. One of those banks managed to get itself sued for negligence when a couple of customers lost money to someone who somehow obtained their user name and password and managed to divert $26,000 from the customers line of credit into an Austrian bank, which refuses to refund the money. The banks motion for summary judgment on the negligence claim (and a couple of others) was denied by the trial judge, and the case is going forward.

The damning language from the court's opinion relates to the issue of a state law negligence claim its relation to the FFIEC Guidelines.

Citizens does not dispute that it had a duty to protect Plaintiffs? account from fraudulent access, but it does contest whether Plaintiffs have produced sufficient evidence of breach or causation.18 (Def.?s Mem. at 11?12.) Concerning breach, Citizens points to its own expert?s opinion that the bank employed reasonable security measures. (Def.?s Mem. at 12; Def.?s Reply at 6.) Citizens makes no mention of the FFIEC Report produced by Plaintiffs. In that 2005 document, the Council described single-factor identification (username/password) as ?inadequate? to secure the online transactions of financial institutions. FFIEC Report at 1. Although Citizens notes that it had begun to implement additional security measures at the beginning of 2007, a vice president of the bank admitted that only single-factor identification protected Plaintiffs? account at the time of the theft. (Milne Dep. at 88-89.) In light of Citizens? apparent delay in complying with FFIEC security standards, a reasonable finder of fact could conclude that the bank breached its duty to protect Plaintiffs? account against fraudulent access.

[...]

Assuming that Citizens employed inadequate security measures, a reasonable finder of fact could conclude that the insufficient security caused Plaintiffs? economic loss. Moreover, concerning Plaintiffs alleged ?emotional and mental pain and anguish? (Am. Compl. ¶ 34), the record abounds with evidence that the theft led to a protracted struggle over liability between Plaintiffs and Citizens, including numerous complaints to Citizens and payments to the bank under threat of foreclosure.(Def.?s 56.1 ¶¶ 34-36; Pls.? 56.1 ¶¶ 67-74.) A reasonable finder of fact could conclude that Plaintiffs suffered mental and emotional anguish, and that Citizens? alleged negligence in allowing the theft to occur and then violating the TILA was a proximate cause of the anguish.

In a post of over two years ago, I quoted one of the Gonzo Bankers who issued some pretty strong opinions along the same lines as those taken by the judge.

GonzoBankers, I do not take this guidance lightly. I firmly believe that a simple user name and password are totally ineffective in protecting access to customers? information and their online accounts. I also think blindly implementing a multifactor authentication technology solution that causes repeated customer impact is just as pointless and actually borders on naive.

Much is made in the court's opinion (because much was made in the briefs filed by the parties and whatever discovery was conducted, I assume) that the bank was in the process of adopting the use of tokens at the time the funds were diverted, but had not implemented the use of tokens for the plaintiffs' accounts. Tokens aren't the only additional authentication technique, however, and just as useful in this case would have been a software solution used by many banks that would have noted that the user had logged in from an ISP not previously used by the customer, which would have triggered additional security procedures (for example, the requirement that additional security questions be answered) that may very well have prevented the theft. We don't know how the thief obtained the user name and password, so it's not certain that such "background authentication procedures" would have worked in this specific instance, but they most likely would have protected the bank from a successful claim of negligence.

As we've noted many times previously, surviving a motion for summary judgment is a long way from winning at trial. Nevertheless, the fact that the judge's analysis is in line with opinions of experts issued at the time the FFIEC Guidelines went into effect would make me extremely nervous, were the bank my client. Lucky for me (and for the bank, I suppose, since I'm not a litigator), it is not.

Another interesting facet of the case (at least to bank law nerds) is that the bank plead the exculpatory language in its agreement with the customer as a defense to breach of contract claims but not as a defense to the negligence claim. In some states (including Texas), an indemnification or exculpatory provision in an agreement that would excuse the bank form its own negligence would be strictly construed against the bank, and might very well be held as unenforceable, at least if not clearly worded. In addition, the Uniform Commercial Code renders ineffective exculpatory provisions that would relieve the bank of its duty of ordinary care with respect to bank deposits. Since the court merely notes in a footnote that the bank did not plead the clause as a defense to negligence claims, we don't have sufficient information to make a judgment. However, bank lawyers would be well advised to review their banks' customer agreements on this issue. In the banking world, wearing both a belt and suspenders doesn't make you seem geeky, but merely prudent.