[author: Craig Hoffman]

We reported in July on a First Circuit Court of Appeals decision finding that a bank failed to implement commercially reasonable security methods to prevent unauthorized transfers by a criminal that gained the online banking credentials of a construction company. The criminal was able to steal $345,000 from the construction company’s account. It was then reported on November 30 that the bank agreed to resolve the lawsuit by reimbursing the construction company for all of the money that was taken plus $45,000 interest.

The First Circuit decision and resulting settlement highlight the risk to banks if they do not implement and maintain adequate security solutions, especially as the attack vectors used by criminals continue to evolve.  This summer, a crime ring operating what became known as the  Eurograbber campaign—a sophisticated operation that used customized versions of the Zeus and Zeus in the mobile (ZITMO) Trojans to bypass two-factor authentication measures to gain access to customer bank accounts—stole $47 million from over 30,000 customers across more than 30 banks in Europe.

The lessons-learned and issues to consider we included in our July post on the First Circuit’s decision were:

(1) Implementing a one-size fits all security solution or failing to implement the solution as designed will leave a bank vulnerable to a finding of commercial unreasonableness, especially if the tools give the bank sufficient information to detect and prevent the fraud (e.g. reviewing high-risk transactions before processing) but the bank does not.

(2) When bank employees are contacted by customers who report suspected fraud, what instructions are being given to customers?

•Are customers instructed to engage a qualified computer forensic expert to examine their computer network and appropriately preserve relevant data?

•It may be beneficial to develop a standard set of recommendations that can be sent to customers in this scenario, and documentation of sending that communication should be preserved.

•Are there protocols that results in at least temporarily blocking or adding heightened monitoring to all orders on accounts where the customer reports suspicious activity to prevent fraudulent orders from being processed after the bank receives the first report of suspicious activity?

(3) If banks are communicating with customers regarding available features and options to enhance the security of Internet banking, are those communications being preserved and documented appropriately so that they may be properly introduced as evidence to show security options made available but not implemented by the customer?

(4) In addition to other security features and best-practices, are banks advising customers to use a dedicated computer that is used only for accessing their Internet banking account (e.g. the computer is not used to browse any other sites on the Internet or to check e-mail)?

(5) In deciding how to address the dispute with customers, one factor to consider is that the commercial reasonableness of the security will be judged by courts and juries several years after the incident occurred. And even though the security should be judged based on what was appropriate at the time of the incident, given the speed at which technology and attack vectors change, the passage of time will likely negatively impact the perception of whether the security was commercially reasonable.