On March 26, the U.S. Court of Appeals for the Fourth Circuit reversed a district court’s decision holding a credit union liable for a wire transfer in a business email compromise scam case where the credit union lacked “actual knowledge” of the mismatch between the account number and beneficiary.
Background
In Studco Building Systems, U.S. v. 1st Advantage Federal Credit Union, the plaintiff, Studco, received a fraudulent email, purportedly from a supplier, instructing it to redirect ACH payments to a new account at 1st Advantage Federal Credit Union. Unbeknownst to Studco, the email was part of a sophisticated scam. Consequently, Studco began ordering ACH funds transfers to be made to the purported supplier account at 1st Advantage Federal Credit Union. The transferred funds were deposited into the account bearing the number that Studco gave, even though that account was not held by the actual supplier, but instead by another customer of 1st Advantage.
Notably, 1st Advantage had in place a system to monitor ACH transfers, which automatically generated and stored reports of each ACH transfer, including warnings if the identified payee on an ACH order did not exactly match the name on the receiving account. However, the system generated hundreds to thousands of warnings related to mismatched names on a daily basis, did not notify anyone when a warning was generated, and no one at 1st Advantage reviewed the reports as a matter of course.
Upon discovering the fraud, Studco filed suit seeking reimbursement from 1st Advantage, alleging among other claims, negligence in failing to detect the misdescription of the account, liability under Article 4A-207 of the UCC, and common law bailment. Following a bench trial, the district court ruled in favor of Studco, awarding it $558,868.71 in damages (which included the amount of the misdirected ACH transfers), plus attorney fees and costs. Specifically, the district court ruled that “1st Advantage failed to act ‘in a commercially reasonable manner or exercise ordinary care in allowing [the withdrawal of] six-figures over the course of a month.'” The district court explained that had 1st Advantage implemented reasonable routines, they “‘would have alerted 1st Advantage to the misdescription and possible fraud upon the posting of the first ACH transfer.'” On appeal, with several heavy-hitting amici weighing in and urging the Court to find the district court erred, the Fourth Circuit reversed. “Because there was no evidence of actual knowledge presented in the case, it was error for the court to have held 1st Advantage liable on a finding of negligence or commercial unreasonableness.”
The Fourth Circuit’s Decision
The crux of the case involved the application of § 4A-207 of the UCC, which governs the rights and duties of parties involved in funds transfers that involve a misdescription. The Fourth Circuit held that the beneficiary bank (the bank that receives the funds transfer from the sending bank), 1st Advantage, was not liable under § 4A-207 because it did not have actual knowledge of the misdescription at the time funds were received via ACH transfer.
Section 8.4A-207(b)(1) provides, as applicable here, that, “[i]f a payment order received by the beneficiary’s bank identifies the beneficiary both by name and by an identifying or bank account number and the name and number identify different persons” and if “the beneficiary’s bank does not know that the name and number refer to different persons,” the beneficiary’s bank “may rely on the number as the proper identification of the beneficiary of the order.” Va. Code Ann. § 8.4A-207(b)(1) (emphasis added). That provision goes further and states that “[t]he beneficiary’s bank need not determine whether the name and number refer to the same person.” Id. Thus, the provision protects the beneficiary’s bank from any liability when it deposits funds into the account for which a number was provided in the payment order, even if the name does not match, so long as it “does not know that the name and number refer to different persons.” Id. (emphasis added).
The court found that 1st Advantage had no duty to verify the name and number match and that even though the bank’s automated system generated internal alerts regarding the misdescription, this did not constitute actual knowledge. “Countless discrepancies can arise inadvertently and harmlessly. For instance, the inclusion or omission of a suffix such as Jr. or a middle initial could trigger an alert, as could the listing of a surname prior to the first name. Requiring individualized review for meaningless differences such as these would be most impractical, time-consuming, and expensive and would impede the efficient transfer of funds, imposing gridlock on the financial system.” The Fourth Circuit concluded that because 1st Advantage deposited the funds into the account number designated in the payment order, even though that account was not held by the depositor identified in the payment order, 1st Advantage had no liability given that there was no evidence in the record that it had “actual knowledge” of the misdescription.
The court also addressed Studco’s claim that the ACH deposits created a common law bailment, imposing a duty of care on 1st Advantage. The Fourth Circuit rejected this argument, clarifying that under Virginia law, a general deposit in a bank does not create a bailment. The court concluded that ACH funds transfers, which merely alter account balances, do not involve the transfer of a physical chattel and therefore do not establish a bailment relationship.
Concurrence by Judge Wynn
Judge Wynn concurred with the majority’s interpretation of the UCC but added a nuanced perspective. He noted that evidence suggested 1st Advantage may have had actual knowledge of the misdescription before Studco’s final two deposits. However, he agreed with the reversal based on the UCC’s privity requirement, which mandates that Studco seek recovery from its own bank rather than directly from 1st Advantage.
Judge Wynn highlighted that the UCC’s remedial scheme requires an orderly chain of recovery, preventing a party from bypassing its direct banking relationship to seek redress from another bank in the transfer chain. This interpretation aligns with the majority of circuit and district court decisions on the issue.
Our Take
As cybercrimes become more prevalent, the fact pattern presented in Studco has likewise become more common. The Fourth Circuit’s decision brings clarity to misdescription claims and prevents the imposition of a watchdog requirement on financial institutions in their processing of ACH transactions and wires. The decision also emphasizes the need for customers to be vigilant over email communications, complete due diligence before making changes to payment instructions, and monitor transactions to take appropriate measures to ensure financial safety.
