Banking Law

Last week, A Texas bank and a former business customer quietly settled a lawsuit that arose out of the diversion by cyber criminals of over $800,000 from the customer's account with the bank. Although neither side publicly commented about the dispute (obviously, confidentiality provisions were included in the settlement agreement), the business press fired off a closing salvo at the bank by quoting a previous statement made by the customer's co-owner.

?After we were ripped off, PlainsCapital filed suit against us for protection from us getting money back from them.?

As explained in a January post at the excellent Bank Info Security website, the crooks managed to compromise the customer's security system and stole user name and password for the bank account, then used that stolen information to access the account online and direct the bank to wire out $801,495.00. Although there was a dispute as to whether the wire transfers were made from Texas directly to overseas banks or first to banks in the US, the money did wind up in foreign countries. Moreover, the early press reports indicated that notwithstanding the fact that the bank's security procedures required customers to register the IP addresses of computers that they used to access their accounts, the transfers were in initiated by IP addresses in Italy and Romania. Although the bank was able to recover all but $200,000.00 of the diverted funds, when the customer demanded that the bank fork over the remainder, the bank sued its customer and asked the court for a declaratory judgment that the bank's security procedures were "commercially reasonable."

We've discussed the requirements for multi-factor authentication at length (ad nauseam, some might think). It appears that the bank had a multi-factor authentication system in place but, for some reason, it failed to stop this sort of theft. Was someone asleep at the switch? We'll never know.

One thing we do know is that a bank that suffers this kind of loss can win the legal battle and lose the customer relationship war. In the initial press report, the bank comes off looking like it's unsophisticated, if you read between the lines of some of the "experts" who are quoted.

Whatever the outcome of this lawsuit, security experts say that institutions and customers alike must increase their vigilance and strength when securing and authorizing online transactions. "There is a need for transaction verification," says Vatsal Sonecha, vice president at TriCipher, a security vendor. "By making an effort to contact the customer before a transaction occurs, banks are protecting themselves from a faulty transaction. There is a need for communicating the details of each transaction, so that customers have the ability to stop a non-authorized fund transfer."

Fund transfers have the potential for terrible consequences, Vatsal warns. He suggests institutions employ multi-factor authentication and transaction verification, a single-use password sent to a smart phone or mobile device acts as an additional layer of security that customers need.

"As we can see from this case, wire and funds transfers are transactions that can cause quick and devastating results for banks and online bankers," Vatsal says. "Banks need to think about safeguarding the channels that hackers traditionally take to steal sensitive log-in information with strong multi-factor authentication."

Phil Neray, vice president of security strategy for Guardium, an IBM Company, sees the fraudsters winning the battle, as they seem to be targeting the regional banks and community bank commercial customers. "It's a game of catch-up for those institutions that don't have the layered protections and checks and balances across their network," Neray says.

A follow-up article in March of this year presented another opportunity for the customer to bash the bank.

"Our new banking partner asked us not to mention their name, as they would rather not be brought into this whole fiasco," says Troy Owen, a vice president at Hillary Machinery. But he describes the institution as a "large world bank that takes fraud very seriously, as they have much more at risk than a smaller bank."

[...]

"PlainsCapital's decision to deny its inherent responsibility to protect a customer and file a lawsuit is what prompted us to start looking for another bank," says Owen. "PlainsCapital left us little choice. We needed a bank that could protect our deposits."

After researching trends in bank security and due diligence of several financial institutions, Hillary chose a large money center bank to protect its future commercial deposits. "Specifically, major money center banks simply have more resources to dedicate to a defense-in-depth, or a layered security program," Owen says. The selection team sought true two-factor authentication as a first layer, intense fraud controls as a second layer, as well as resources to change as threats evolve. "They also don't simply comply with regulator's expectations," he says. "They do whatever is necessary to protect themselves and their customers."

Ouch!

To me, there are a number of obvious lessons from this unfortunate set of circumstances (and I'm capable of discerning nothing deeper than the most obvious lessons from any set of circumstances). One is that even if you've implemented multi-factor authentication and security guidelines, they won't do you much good if you don't constantly monitor their operation, test them, and make sure that they actually work. Hiring security experts whose job it is to circumvent them and who can tell you where you have holes you need to plug ought to be standard operating procedure for all banks engaged in online banking activities.We don't have enough uncontested facts in this particular case to know whether the bank did or did not follow such practices.

Another lesson is that most customers, whether they are consumers or businesses, are simply not up to the task of covering their own cyber backsides when faced with the intellectual giants who are running these types of criminal enterprises. The banks have got to continue to run hard to try to keep ahead of the bad guys, knowing full well that the race will never end. Banks have to assume that their customers are "challenged" in the online banking security environment and that the security burden falls disproportionately on the banks. That's facing facts, whether the end result is fair or unfair, and whether or not your security procedures would be deemed to be "commercially reasonable" under applicable law.

Yet one more lesson is that when bad things happen, focusing first and foremost on protecting your legal flanks can result in the legal tail wagging the business dog. While suing for a declaratory judgment might have been a smart legal maneuver, how did it work out from a PR standpoint? You be the judge of that. In addition, while banks can craft all the great legal protections they want in their agreements with their business customers, when the crooks come calling and money goes out the bank's door, you may not only have a very upset customer, you may have a reporter sniffing about who would just love to write another "bad bank" story in order to play to a public that currently thinks all banks are lower than pond scum. That simply can't be good for business.