Attorney Highlights Takeaways from Appellate Court's Reversal
The PATCO Construction Inc. case, recently reversed by a U.S. appeals court, is seen as a victory for fraud victims. But what are the key takeaways for banking institutions? Attorney Joe Burton offers insight.
The July 3 court decision found that online fraud-detection procedures used by Ocean Bank, now People's United Bank, at the time PATCO was hit with fraudulent wire transfers were "commercially unreasonable" [See PATCO ACH Fraud Ruling Reversed].
According to Burton, an information security attorney and managing partner in the San Francisco office of law firm Duane Morris, this case is important because it "focused on what in fact was done by the bank to implement security," he says in an interview with Information Security Media Group's Tracy Kitten [transcript below].
Burton highlights three takeaways from the appellate court reversal, including:
The Precedent: The ruling is a "fairly significant" one, Burton points out, since it's the first appellate case of this type. "It's going to have precedential value because it's an appellate court case, and as you know there really are a small number of cases that have considered the question of apportioning responsibility between a customer and the bank."
Customer's Responsibilities: Even though the court's decision favored the customer, Burton points out that one unanswered question in the case may end up favoring banks. That question, sent back to the lower court for further analysis: What is the responsibility of the customer even if bank's security procedures are commercially unreasonable? "It opens the possibility that you have a circumstance where you had a commercially unreasonable procedure that was utilized by the bank, but the liability might not be on the bank because there may be responsibility [on] the customer," he says
Compliance Doesn't Equal Security: "It's not enough just to have a generally accepted security procedure in place if that procedure is not implemented in a way that makes sense," Burton says. "That's the conduct aspect that has to do with the actual security and not jus the check-box [mentality]." The appellate court in this case didn't take into account conformance with the FFIEC authentication guidelines, but whether the bank had implemented appropriate security.
During this interview, Burton discusses:
- How the new ruling illustrates an increasing sophistication on the part of courts to understand security obligations of banks and commercial customers;
- Why the court's focus on reasonable security, rather than compliance, is significant;
- How this case illustrates where and how security obligations noted in Article 4 of the UCC could, in the future, place more fraud-mitigation responsibility on the shoulders of commercial customers.
Burton is the managing partner of Duane Morris' San Francisco office, where, in addition to information security and cyberfraud, he also concentrates on complex civil, criminal and appellate litigation. He is nationally recognized for his legal work field of information security, and advises and represents individuals and corporations regarding their rights and responsibilities in maintaining the security of digital information. His practice includes trade secret, trademark and patent litigation, with an emphasis on cybercrime and cybersecurity.
Burton is a former Assistant U.S. Attorney and Chief of the Silicon Valley Office for the Northern District of California, where he handled several pioneering high technology investigations and prosecutions, including the first prosecution in the nation for criminal copyright infringement of computer code.
Significance of Case Reversal
TRACY KITTEN: The July 3 appellate court reversal of a lower court's ruling in the legal dispute between PATCO Construction and the former Ocean Bank, which is now People's United, is significant for a number of reasons. For one, it's the first appellate ruling handed down in a case involving ACH and wire fraud. How significant is this federal court's reversal?
This article is for general information and does not include full legal analysis of the matters presented. It should not be construed or relied upon as legal advice or legal opinion on any specific facts or circumstances. The description of the results of any specific case or transaction contained herein does not mean or suggest that similar results can or could be obtained in any other matter. Each legal matter should be considered to be unique and subject to varying results. The invitation to contact the authors or attorneys in our firm is not a solicitation to provide professional services and should not be construed as a statement as to any availability to perform legal services in any jurisdiction in which such attorney is not permitted to practice.
Duane Morris LLP, a full-service law firm with more than 700 attorneys in 24 offices in the United States and internationally, offers innovative solutions to the legal and business challenges presented by today's evolving global markets. Duane Morris LLP, a full-service law firm with more than 700 attorneys in 24 offices in the United States and internationally, offers innovative solutions to the legal and business challenges presented by today's evolving global markets. The Duane Morris Institute provides training workshops for HR professionals, in-house counsel, benefits administrators and senior managers.
