LexisNexis® CLE On-Demand features premium content from partners like American Law Institute Continuing Legal Education and Pozner & Dodd. Choose from a broad listing of topics suited for law firms, corporate legal departments, and government entities. Individual courses and subscriptions available.
By Robert D. Perrow and & J.P. McGuire Boyd Jr.
On-line or electronic banking (“e-banking”) offers many well-known advantages to financial institutions engaged in banking and to their business customers. A significant risk of on-line bank accounts for both financial institutions and their business customers is unauthorized transfers from the customer’s account caused by a breach of the customer’s computer system. A financial institution can shift the risk of loss for these fraudulent transactions to its business customers under the provisions of the Uniform Commercial Code.
To shift the loss to a customer, a financial institution and its customer must enter into an agreement that provides a security procedure for verifying the authenticity of payment orders.1 In general, a payment order in the name of the customer, whether or not authorized by the customer, is binding on the customer, provided that (i) the security procedure is “a commercially reasonable method of providing security against unauthorized payment orders” and (ii) the financial institution can prove that it accepted the payment order “in good faith” and in compliance with the agreed security procedure and any written agreement or instructions of the customer restricting acceptance of payment orders.2
What constitutes a commercially reasonable security procedure is an issue of law for a court to decide. In addition to considering the available security procedures and their appropriateness for the particular type of financial institution, a court will consider a number of factors, including the customer’s use of payment orders and their frequency and size.
Reported cases dealing with these issues highlight several best practices and potential pitfalls for financial institutions involved in a dispute with their business customers:
Establishing appropriate security procedures in compliance with the Uniform Commercial Code may prevent or minimize losses for financial institutions and customers in the event of a cyber-attack on a customer’s account. If a cyber-attack is successful, the financial institution can shift liability to the customer in its entirety. The reality, however, is that in some instances, a financial institution that has taken all proper measures to shift the risk of loss to the customer may decide that it wants to maintain a banking relationship with the customer due to the value of the customer or that it wants to avoid the reputational risk of a lawsuit accusing it of maintaining an insecure on-line banking system. In these situations, being in a position to shift the entire loss to the customer provides a financial institution with bargaining power to negotiate a sharing of the customer’s loss.
1The term “security procedure” is defined in the Uniform Commercial Code. 2A customer may shift the loss back to the financial institution if the customer proves that the confidential information needed to authorize the payment did not come from an agent or former agent of the customer or from a source controlled by the customer.
About Williams Mullen
With approximately 300 attorneys practicing in over 30 practice areas, Williams Mullen provides comprehensive legal services to regional, national and international clients. Their clients include multinational Fortune 500 companies, private family-owned businesses, nonprofit organizations and government entities. From offices in North Carolina, Virginia, Washington D.C. and London, Williams Mullen attorneys bring skills and experience to solving the legal needs of their diverse client base.
For more information about LexisNexis products and solutions, connect with us through our corporate site.