US Appeals Court Says Bank Liable For Losses From Poor Online Security 94
An anonymous reader writes with this extract: "Threatpost reports that a judge on the United States Court of Appeals this week ruled that People's United Bank's processes and systems for protecting customer accounts from fraud were not "commercially reasonable." The ruling in People's United Bank (formerly Ocean Bank of Maine) versus Patco Construction Company reverses a lower court's ruling in a case that stems from six allegedly fraudulent transactions that occurred over the period of a week in May, 2009 and drained close to $589,000 dollars from Patco's accounts. Patco alleged that People's United Bank did an inadequate job of protecting them against fraud, ignoring repeated 'high risk' warnings from the bank's fraud detection system. Now the Appeals Court appears to agree. The ruling could have broad implications in the U.S., where businesses that are the victim of account takeovers and fraudulent transactions are suing banks to recover lost funds."
Re:It's about fucking time (Score:5, Informative)
Basic tort theory states that responsibility for a loss should be placed on the individuals or entities that are most capable of preventing the loss. In this case, banks are responsible for security controls on their own accounts. Banks are most capable of preventing most losses due to fraudulent transactions. It's absurd that they have not already been held responsible for all the fraud out there.
Re:Right ruling (Score:5, Informative)
RTFA.
Apparently the issue is that although individuals are protected against fraud by legal statutes, businesses are not. Specifically at issue is the authorization of commerical ACH (automated clearing house) transactions to the account (when you use your debit card it's authorized under the EFTA or electronic funds transfers act).
In this case the bank so egregiously ignored it's own security measures (authorized transactions even though it's internal fraud alert systems was warning against the transaction) that it was clear the bank was in the wrong...
Now lawyers to design security protocols? (Score:4, Informative)
Each bank and brokerage account I have wants to send me an RSA dongle. "It is free! It is convenient! Add it to your key bunch! And lug it every where!". If I follow their advice my key fob will have more RSA dongles than actual keys. Then once you accept an RSA dongle, Quicken is not able to download transactions. "You want both security and also download transactions to Quicken? Choose either this or that buddy. I will tell the court we offered RSA dongle and he refused. He is totally at fault.".
Re:Now lawyers to design security protocols? (Score:3, Informative)
Re:Right ruling (Score:4, Informative)
I don't see why it's any more complicated than:
I gave the bank X dollars. I have not withdrawn any money. They owe me X dollars.
My business gave the bank X dollars. My business has not withdrawn any money. They owe my business X dollars.
Fixed.
IANAL, but as I understand it the question is the definition of "my business" in the withdrawn case. When it is a person, it is much clearer if you have authorized the money to be withdrawn because of the way the law is written. If it is a business, it isn't a statute thing, it is often a matter of the uniform commercial code or a business to business contract or the charter to your business (e.g., is the "treasurer" allowed, is a "sales-person" allowed, or third party "accountant" is allowed, or my "niece" is allowed to use a checking account), thus these facts sometimes need to be discovered in a court to determine if there is actual fraud, or if the company is instead required to sue the person who took the money (instead of the bank that authorized the transaction).
For example, if a bookkeeper employeed by a company wanted to embezzle money from the company and gave his password to his aunt in russia to do the deed, the company would probably have to sue the ex-employee and the uncle and the bank would be off the hook since to the bank, the bookeeper was authorized to take the money.
In this case, it was clearly the bank's fault, but that's not always the case in business (which is one of the reason business accounts are different than individual accounts).
Re:It's about fucking time (Score:5, Informative)
Yep. Though actually this isn't governed by tort law, it's governed by Art. 4A Sec. 202 of the Uniform Commercial Code. (http://www.law.cornell.edu/ucc/4A/4A-202.html) (But you're right; the UCC seems just to be codifying the principle you identified.) So, the good news may be that the law has always been pretty sensible about this sort of issue (at least in theory). Though perhaps individual judges and juries have lagged in their understandings of "commercially reasonable."
Re:Right ruling (Score:4, Informative)
1) 3-letter acronyms are much less clear and more easily mixed-up than 4-letter acronyms.
2) It's only YOU assuming that the F stands for something profane. I refer you to Jimmy Kimmel's "best of unnecessary censorship" series...