Patco Construction Co., Inc. v. People's United Bank

United States Court of Appeals
For the First Circuit
No. 11-2031
PATCO CONSTRUCTION COMPANY, INC.,
Plaintiff, Appellant,
v.
PEOPLE'S UNITED BANK, d/b/a Ocean Bank,
Defendant, Appellee.
APPEAL FROM THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF MAINE
[Hon. D. Brock Hornby, U.S. District Judge]
Before
Lynch, Chief Judge,
Lipez and Howard, Circuit Judges.
Daniel J. Mitchell, with whom Eben M. Albert-Knopp and
Bernstein Shur were on brief, for appellant.
Brenda R. Sharton, with whom Don M. Kennedy, Katherine A.
Borden, and Goodwin Procter LLP were on brief, for appellee.
July 3, 2012
LYNCH, Chief Judge. Over seven days in May 2009, Ocean
Bank, a southern Maine community bank, authorized six apparently
fraudulent withdrawals, totaling $588,851.26, from an account held
by Patco Construction Company, after the perpetrators correctly
supplied Patco's customized answers to security questions.
Although the bank's security system flagged each of these
transactions as unusually "high-risk" because they were
inconsistent with the timing, value, and geographic location of
Patco's regular payment orders, the bank's security system did not
notify its commercial customers of this information and allowed the
payments to go through. Ocean Bank was able to block or recover
$243,406.83, leaving a residual loss to Patco of $345,444.43.
Patco brought suit, setting forth six counts against
People's United Bank, a regional bank which had acquired Ocean
Bank. The suit alleged, inter alia, that the bank should bear the
loss because its security system was not commercially reasonable
under Article 4A of the Uniform Commercial Code ("UCC"), as
codified under Maine Law at Me. Rev. Stat. Ann. tit. 11, § 4-1101et seq., and that Patco had not consented to the procedures.
-2-
On cross-motions for summary judgment,1 the district
court held that the bank's security system was commercially
reasonable and on that basis entered judgment in favor of the bank
on the first count. Patco Constr. Co. v. People's United Bank, No.
09–cv–503, 2011 WL 3420588 (D. Me. Aug. 4, 2011). The district
court also granted summary judgment in favor of the bank on the
remaining counts, holding that they were either dependent on or
displaced by the analysis and law underlying the first count. Id.We reverse the district court's grant of summary judgment
in favor of the bank and affirm its denial of Patco's motion for
summary judgment on the first count. In particular, we leave open
the question of what, if any, obligations or responsibilities
Article 4A imposes on Patco. We also reinstate certain other
claims dismissed by the district court, and remand for proceedings
consistent with this opinion.
I.
The facts, which are largely undisputed, are as follows.
Where the facts remain in dispute, we relate them in the light most
favorable to Patco, the non-moving party. See Valley Forge Ins.
Co. v. Field, 670 F.3d 93, 96-97 (1st Cir. 2012).
1
The parties dispute whether Maine or Connecticut law
governs this case. We need not decide this question here as both
states have enacted UCC Article 4A, and thus, under either state's
laws, the outcome is the same. Compare Me. Rev. Stat. Ann. tit.
11, § 4-1101 et seq. with Conn. Gen. Stat. Ann. § 42a-4A-101 et
seq. The parties do not identify any difference in the two
enactments that would affect our analysis.
-3-
A. The Parties
Patco is a small property development and contractor
business located in Sanford, Maine. Patco began banking with Ocean
Bank in 1985. Ocean Bank was acquired by the Chittenden family of
banks, which was later acquired by People's United Bank, a regional
bank based in Bridgeport, Connecticut. People's United Bank
operates other local Maine banks such as Maine Bank & Trust, where
Patco also had an account in May 2009. Ocean Bank was a division
of People's United at the time of the fraudulent withdrawals at
issue in this case.
In September 2003, Patco added internet banking -- also
known as "eBanking" -- to its commercial checking account at Ocean
Bank. Ocean Bank allows its eBanking commercial customers to make
electronic funds transfers through Ocean Bank via the Automated
Clearing House ("ACH") network, a system used by banks to transfer
funds electronically between accounts. Patco used eBanking
primarily to make regular weekly payroll payments. These regular
payroll payments had certain repeated characteristics: they were
always made on Fridays; they were always initiated from one of the
computers housed at Patco's offices in Sanford, Maine; they
originated from a single static Internet Protocol ("IP") address;2
2
"An IP address is the unique address assigned to every
machine on the internet. An IP address consists of four numbers
separated by dots, e.g., 166.132.78.215." United States v.
Kearney, 672 F.3d 81, 84 n.1 (1st Cir. 2012) (quoting United States
v. Vázquez–Rivera, 665 F.3d 351, 354 n.5 (1st Cir. 2011)).
-4-
and they were accompanied by weekly withdrawals for federal and
state tax withholding as well as 401(k) contributions. The highest
payroll payment Patco ever made using eBanking was $36,634.74.
Until October of 2008, Patco also used eBanking to transfer money
from the accounts of Patco and related entities at Maine Bank &
Trust, which maintains a branch in Sanford, Maine, into its Ocean
Bank checking account.
In September 2003, when it added eBanking services, Patco
entered into several agreements with Ocean Bank.3 Most
significantly, Patco entered into the eBanking for Business
Agreement. The eBanking agreement stated that "use of the Ocean
National Bank's eBanking for Business password constitutes
authentication of all transactions performed by you or on your
behalf." The eBanking agreement stated that Ocean Bank did not
"assume[] any responsibilities" with respect to Patco's use of
eBanking, that "electronic transmission of confidential business
3
These include the Investment and Line of Credit Sweep
Account (Managed Balance Agency Agreement), which authorized Ocean
Bank to transfer funds from Patco's account as needed to maintain
a target balance in Patco's separate investment account. Patco
also signed the Ocean Bank Automated Clearing House Agreement,
which provided that Patco was responsible for electronic transfers
"purport[ed] to have been transmitted or authorized" by Patco, even
if a transfer was not actually authorized by Patco, "provided Bank
acted in compliance with the security procedure referred to in
Schedule A." Patco asserts that the security procedures provided
in Schedule A do not, by their express terms, apply to eBanking
transactions such as those here.
-5-
and sensitive personal information" was at Patco's risk, and that
Ocean Bank was liable only for its gross negligence, limited to six
months of fees. The eBanking agreement also provided that:
[U]se of Ocean National Bank's eBanking for
Business by any one owner of a joint account
or by an authorized signor on an account,
shall be deemed an authorized transaction on
an account unless you provide us with written
notice that the use of Ocean National Bank's
eBanking for Business is terminated or that
the joint account owner or authorized signor
has been validly removed form [sic] the
account.
The agreement provided that Patco had to contact the bank
immediately upon discovery of an unauthorized transaction.
The bank also reserved the right to modify the terms and
conditions of the eBanking agreement at any time, effective upon
publication. The bank claims that at some point before May 2009,
it modified the eBanking agreement to state:
If you choose to receive ACH debit
transactions on your commercial accounts, you
assume all liability and responsibility to
monitor those commercial accounts on a daily
basis. In the event that you object to any
ACH debit, you agree to notify us of your
objection on the same day the debit occurs.
The bank claims that it published this modified eBanking agreement
on its website before May 2009. Patco disputes that this agreement
was modified and/or published on the bank's website before May
2009, and argues that the modified agreement was therefore not
effective as between the parties.
-6-
B. Ocean Bank's Security Measures
In 2004, Ocean Bank began using Jack Henry & Associates
to provide its core online banking platform, known as "NetTeller."
Jack Henry provides the NetTeller product to approximately 1,300 of
its 1,500 bank customers.
In October 2005, the agencies of the Federal Financial
Institutions Examination Council4 ("FFIEC"), responding to
increased online banking fraud, issued guidance titled
"Authentication in an Internet Banking Environment." See Fed. Fin.
Insts. Examination Council, Authentication in an Internet Banking
Environment (Aug. 8, 2001), available at http://www.ffiec.gov/pdf/
authentication_guidance.pdf [hereinafter "FFIEC Guidance"]. The
Guidance was intended to aid financial institutions in "evaluating
and implementing authentication systems and practices whether they
are provided internally or by a service provider." Id. at 1. The
Guidance provides that "financial institutions should periodically
. . . [a]djust, as appropriate, their information security program
in light of any relevant changes in technology, the sensitivity of
its customer information, and internal or external threats to
information." Id. at 2.
4
The FFIEC is an interagency body created by statute and
charged with "establish[ing] uniform principles and standards and
report forms for the examination of financial institutions which
shall be applied by the Federal financial institutions regulatory
agencies." 12 U.S.C. § 3305(a).
-7-
The Guidance explains that existing authentication
methodologies involve three basic "factors": (1) something the user
knows (e.g., password, personal identification number); (2)
something the user has (e.g., ATM card, smart card); and (3)
something the user is (e.g., biometric characteristic, such as a
fingerprint). Id. at 3. It states:
Authentication methods that depend on more
than one factor are more difficult to
compromise than single-factor methods.
Accordingly, properly designed and implemented
multifactor authentication methods are more
reliable and stronger fraud deterrents. For
example, the use of a logon ID/password is
single-factor authentication (i.e., something
the user knows); whereas, an ATM transaction
requires multifactor authentication: something
the user possesses (i.e., the card) combined
with something the user knows (i.e., PIN). A
multifactor authentication methodology may
also include "out-of-band" controls for risk
mitigation.
Id. The Guidance also states:
The agencies consider single-factor
authentication, as the only control mechanism,
to be inadequate for high-risk transactions
involving access to customer information or
the movement of funds to other parties. . . .
Account fraud and identity theft are
frequently the result of single-factor (e.g.,
ID/password) authentication exploitation.
Where risk assessments indicate that the use
of single-factor authentication is inadequate,
financial institutions should implement
multifactor authentication, layered security,
or other controls reasonably calculated to
mitigate those risks.
Id. at 1-2.
-8-
Following publication of the FFIEC Guidance, Ocean Bank
worked with Jack Henry to conduct a risk assessment and institute
appropriate authentication protocols to comply with the Guidance.
The bank determined that its eBanking product was a "high risk"
system that required enhanced security, and in particular,
multifactor authentication.
Jack Henry entered into a re-seller agreement with Cyota,
Inc., an RSA Security Company ("RSA/Cyota"), for a multifactor
authentication system to integrate into its NetTeller product so
that it could offer security solutions compliant with the FFIEC
Guidance. Through collaboration with RSA/Cyota, Jack Henry made
two multifactor authentication products available to its customers
to meet the FFIEC Guidance: the "Basic" package and the "Premium"
package.
Ocean Bank selected the Jack Henry "Premium" package,
which it implemented by January 2007. The system, as implemented
by Ocean Bank, had six key features:
1. User IDs and Passwords: The system required each
authorized Patco employee to use both a company ID and password and
a user-specific ID and password to access online banking.
2. Invisible Device Authentication: The system placed a
"device cookie" onto customers' computers to identify particular
computers used to access online banking. The device cookie would
be used to help establish a secure communication session with the
-9-
NetTeller environment and to contribute to the component risk
score. Whenever the cookie was changed or was new, that impacted
the risk score and potentially triggered challenge questions.
3. Risk Profiling: The system entailed the building of a
risk profile for each customer by RSA/Cyota based on a number of
different factors, including the location from which a user logged
in, when/how often a user logged in, what a user did while on the
system, and the size, type, and frequency of payment orders
normally issued by the customer to the bank. The Premium Product
noted the IP address that the customer typically used to log into
online banking and added it to the customer profile.
RSA/Cyota's adaptive monitoring provided a risk score to
the bank for every log-in attempt and transaction based on a
multitude of data, including but not limited to IP address, device
cookie ID, Geo location, and transaction activity. If a user's
transaction differed from its normal profile, RSA/Cyota reported to
the bank an elevated risk score for that transaction. RSA/Cyota
considered transactions generating risk scores in excess of 750, on
a scale from 0 to 1,000, to be high-risk transactions. "Challenge
questions," described below, were prompted any time the risk score
for a transaction exceeded 750.
4. Challenge Questions: The system required users, during
initial log-in, to select three challenge questions and responses.
The challenge questions might be prompted for various reasons. For
-10-
example, if the risk score associated with a particular transaction
exceeded 750, the challenge questions would be triggered. If the
challenge question responses entered by the user did not match the
ones originally provided, the customer would receive an error
message. If the customer was unable to answer the challenge
questions in three attempts, the customer was blocked from online
banking and would be required to contact the bank.
5. Dollar Amount Rule: The system permitted financial
institutions to set a dollar threshold amount above which a
transaction would automatically trigger the challenge questions
even if the user ID, password, and device cookie were all valid.
In August 2007, Ocean Bank set the dollar amount rule to $100,000.
On June 6, 2008, Ocean Bank lowered the dollar amount rule from
$100,000 to $1. After the Bank lowered the threshold to $1, Patco
was prompted to answer challenge questions every time it initiated
a transaction. In May 2009, when the fraud at issue in this case
occurred, the dollar amount rule threshold remained at $1.
6. Subscription to the eFraud Network: The Jack Henry
Premium Product provided Ocean Bank with a subscription to the
eFraud Network, which compared characteristics of the transaction
(such as the IP address of the user seeking access to the Bank's
system) with those of known instances of fraud. The eFraud Network
allowed financial institutions to report IP addresses or other
discrete identifying characteristics identified with instances of
-11-
fraud. An attempt to access a customer's NetTeller account
initiated by someone with that characteristic would then be
automatically blocked. The individual would not even be prompted
for challenge questions.
Ocean Bank asserts that on December 1, 2006, as it began
to implement the Jack Henry system, it also began to offer the
option of e-mail alerts to its eBanking customers. If the customer
chose to receive such alerts, the bank would send the customer e-
mails regarding incoming/outgoing transactions, changes to the
customer's balance, the clearing of checks, and/or alerts on
certain customer-specified dates. Patco claims it did not receive
notice that e-mail alerts were available and this is a disputed
issue of fact. It appears that notice of the availability of e-
mail alerts was not readily visible. To set up alerts through the
eBanking system, a user would have to first click the "Preferences"
tab on the eBanking webpage, then click on a second tab labeled
"Alerts," and then follow several additional steps to activate
individual alerts. Patco claims it never saw anything on the
website indicating that e-mail alerts were available, and it
therefore never set up e-mail alerts.
C. Security Measures Available Which Ocean Bank Chose Not to
Implement
There were several additional security measures that were
available to Ocean Bank but that the bank chose not to implement:
-12-
1. Out-of-Band Authentication: Jack Henry offered Ocean
Bank a version of the NetTeller system that included an out-of-band
authentication option. Out-of-band authentication "generally
refers to additional steps or actions taken beyond the technology
boundaries of a typical transaction." Id. at 3 n.5. Examples of
out-of-band authentication include notification to the customer,
callback (voice) verification, e-mail approval from the customer,
and cell phone based challenge/response processes. The FFIEC
Guidance identifies out-of-band authentication as a useful method
of risk mitigation. See id. at 11-12.
2. User-Selected Picture: Ocean Bank's security
procedures did not include the user-selected picture function that
was available through Jack Henry's Premium option. Ocean Bank
states that it did not utilize the user-selected picture function
because it already utilized other anti-phishing5 controls.
3. Tokens: Tokens are physical devices (something the
person has), such as a USB token device, a smart card, or a
password-generating token. The FFIEC Guidance identifies tokens as
a useful part of a multifactor authentication scheme. See id. at
8. Tokens were not available from Jack Henry when Ocean Bank
5
Phishing involves an attempt to acquire information such as
usernames, passwords, or financial data by a perpetrator
masquerading as a legitimate enterprise. Typically, the
perpetrator will provide an e-mail or link that directs the victim
to enter or update personal information at a phony website that
mimics an established, legitimate website which the victim either
has used before or perceives to be a safe place to enter
information.
-13-
implemented its system in 2007, but were readily available to
financial institutions at that time through other sources.
Although People's United Bank has used tokens since at least
January of 2008, Ocean Bank did not do so until after the fraud in
this case occurred.
4. Monitoring of Risk-Scoring Reports: In May 2009, bank
personnel did not monitor the risk-scoring reports received as part
of the Premium Product package, nor did the bank conduct any other
regular review of transactions that generated high risk scores. In
May 2009, the bank had the capability to conduct manual review of
high-risk transactions through its transaction-profiling and
risk-scoring system, but did not do so. The bank also had the
ability to call a customer if it detected fraudulent activity, but
did not do so. The bank began conducting manual reviews of
high-risk transactions in late 2009, after the fraud in this case
occurred. Since then, the bank has instituted a policy of calling
the customer in the case of uncharacteristic transactions to
inquire if the customer did indeed initiate the transaction.
D. The Fraudulent Transfers
Beginning on May 7, 2009, a series of withdrawals were
made on Patco's account over the course of several days.
On May 7, unknown third parties initiated a $56,594 ACH
withdrawal from Patco's account. The perpetrators supplied the
proper credentials of one of Patco's employees, including her ID,
-14-
password, and answers to her challenge questions. The payment on
this withdrawal was directed to go to the accounts of numerous
individuals, none of whom had previously been sent money by Patco.
The perpetrators logged in from a device unrecognized by Ocean
Bank's system, and from an IP address that Patco had never before
used. The risk-scoring engine generated a risk score of 790 for
the transaction, a significant departure from Patco's usual risk
scores, which generally ranged from 10 to 214. There is no
evidence that Patco's risk scores prior to the fraudulent transfers
in this case ever exceeded 214. The risk-scoring engine reported
the following contributors to the risk score for that transaction:
(1) "Very high risk non-authenticated device"; (2) "High risk
transaction amount"; (3) "IP anomaly"; and (4) "Risk score
distributor per cookie age." An RSA manual describing risk score
contributors states that any transaction triggering the contributor
"Very high risk non-authenticated device" is "a very high-risk
transaction." Despite this high risk score, Patco was not
notified. Moreover, it appears no one at the bank monitored these
high-risk transactions. Bank personnel did not manually review the
May 7, 2009 transaction. The bank batched and processed the
transaction as usual, and it was paid the next day.
The activities of May 7 having successfully resulted in
payment, on Friday, May 8, 2009, unknown third parties again
successfully initiated an ACH payment order from Patco's account,
-15-
this time for $115,620.26. As before, the perpetrators wired money
to multiple individual accounts to which Patco had never before
sent funds. The perpetrators again used a device that was not
recognized by Ocean Bank's system. The payment order originated
from the same IP address as the day before. The transaction was
larger by several magnitudes than any ACH transfer Patco had ever
made to third parties. Despite these unusual characteristics, the
bank again took no steps to notify Patco and batched and processed
the transaction as usual, which was paid by the bank on Monday, May
11, 2009.
On May 11, 12, and 13, unknown third parties initiated
further withdrawals from Patco's account in the amounts of $99,068,
$91,959, and $113,647, respectively. Like the prior fraudulent
transactions, these transactions were uncharacteristic in that they
sent money to numerous individuals to whom Patco had never before
sent funds, were for greater amounts than Patco's ordinary
third-party transactions, were sent from computers that were not
recognized by Ocean Bank's system, and originated from IP addresses
that were not recognized as valid IP addresses of Patco. As a
result of these unusual characteristics, the transactions continued
to generate higher than normal risk scores. The May 11 transaction
generated a risk score of 720, the May 12 transaction triggered a
risk score of 563, and the transaction on May 13 generated a risk
-16-
score of 785. The Bank did not manually review any of these
transactions to determine their legitimacy or notify Patco.
Portions of the transfers, beginning with the first
transfer initiated on May 7, 2009, were automatically returned to
the bank because certain of the account numbers to which the money
was slated to be transferred were invalid. As a result, the bank
sent limited "return" notices to the home of Mark Patterson, one of
Patco's principals, via U.S. mail. Patterson received the first
such notice after work on the evening of May 13, six days after the
allegedly fraudulent withdrawals began.
The next morning, on May 14, 2009, Patco called the bank
to inform it that Patco had not authorized the transactions. Also
on the morning of May 14, another alleged fraudulent transaction
was initiated from Patco's account in the amount of $111,963.
Despite the information from Patco, the bank initially processed
this payment order on May 15, 2009. However, because of the alert
from Patco of the ongoing fraud, the bank then took steps to block
completion of a portion of this transaction and recovered a portion
of the transferred funds shortly thereafter.
At the end of the string of thefts, the amount of money
fraudulently withdrawn from Patco's account totaled $588,851.26, of
which $243,406.83 was automatically returned or blocked and
recovered.
-17-
According to Ocean Bank, on May 14, 2009, immediately
after the allegedly fraudulent withdrawals occurred, the bank gave
instructions to Patco. It instructed Patco to disconnect the
computers it used for electronic banking from its network; to stop
using these computers for work purposes; to leave the computers
turned on; and to bring in a third-party forensic professional or
law enforcement to create a forensic image of the computers to
determine whether a security breach had occurred. Ocean Bank
claims, and Patco disputes, that Patco did not isolate its
computers or forensically preserve the hard drives; and that Patco
employees continued to use their computers during the week
following the alleged fraud. In another dispute of fact, Patco
states that Ocean Bank recommended only that Patco check its system
for a security breach using a third-party forensic professional,
which Patco did.
Shortly after the fraudulent transfers, Patco hired an IT
consultant, who ran anti-malware scans on the computers. A remnant
of a Zeus/Zbot malware was found. However, the Zeus/Zbot malware,
which contained the encryption key for the Zeus/Zbot configuration
file, was quarantined and then deleted by the anti-malware scan.
Without the encryption key, it is impossible to decrypt the
configuration file and identify what information, if any, the
Zeus/Zbot malware would have captured, if in fact it was of a type
that would have intercepted authentication credentials.
-18-
II.
On September 18, 2009, Patco filed suit against People's
United in Maine Superior Court, York County. The complaint
included six counts: (I) liability under Article 4A of the Uniform
Commercial Code ("UCC"); (II) negligence; (III) breach of contract;
(IV) breach of fiduciary duty; (V) unjust enrichment; and (VI)
conversion. On October 9, 2009, People's United removed the case
to the United States District Court for the District of Maine.
On August 27, 2010, Patco moved for summary judgment on
Count I, its claim under Article 4A of the UCC. That same day, the
bank moved for summary judgment on all six counts. On May 27,
2011, the magistrate judge issued a recommended decision on the
cross-motions for summary judgment. Patco Constr. Co. v. People's
United Bank, No. 09–cv–503, 2011 WL 2174507 (D. Me. May 27, 2011).
The magistrate judge determined both that the bank's security
procedures were commercially reasonable, id. at *32-34, and that
Patco had agreed to those procedures, id. at *24-25. Therefore,
the magistrate concluded, Patco -- not the bank -- bore the loss of
the fraudulent transfers. Id. at *34. The magistrate also
determined that Counts II-IV of Patco's complaint were displaced by
the provisions of Article 4A, and that Counts V and VI failed along
with Count I because the bank could not have been unjustly
enriched, or have wrongly converted Patco's funds, if it employed
commercially reasonable security procedures. Id. at *34-35.
-19-
Accordingly, the magistrate recommended that the district court
grant the bank's motion for summary judgment and deny that of
Patco. Id. at *35.
Patco objected to the recommended decision on June 13,
2011, and People's United responded to Patco's objection on June
27, 2011. On August 4, 2011, the district court adopted the
magistrate's recommendation in full. It granted People's United's
motion for summary judgment, denied Patco's motion for summary
judgment, and found the parties' outstanding motions to be moot.
On September 6, 2011, Patco appealed.
III.
We review orders granting or denying summary judgment de
novo. Certain Interested Underwriters at Lloyd's, London v.
Stolberg, 680 F.3d 61, 65 (1st Cir. 2012). In doing so, we
consider the record and all reasonable inferences in the light most
favorable to the non-moving party. Id.We affirm only if there is no genuine dispute as to any
material fact and the movant is entitled to judgment as a matter of
law. Id. "A dispute is genuine if the evidence about the fact is
such that a reasonable jury could resolve the point in the favor of
the non-moving party." Rodríguez-Rivera v. Federico Trilla Reg'l
Hosp. of Carolina, 532 F.3d 28, 30 (1st Cir. 2008) (quoting
Thompson v. Coca-Cola Co., 522 F.3d 168, 175 (1st Cir. 2008)). "A
fact is material if it has the potential of determining the outcome
-20-
of the litigation." Id. (quoting Maymí v. P.R. Ports Auth., 515
F.3d 20, 25 (1st Cir. 2008)).
A. Article 4A of the UCC
The claim under Count I is governed by Article 4A of the
UCC, which was meant to govern the rights, duties, and liabilities
of banks and their commercial customers with respect to electronic
funds transfers. See Me. Rev. Stat. Ann. tit. 11, § 4-1102 cmt.
Article 4A was enacted in toto by Maine in 1991, well before the
transfers at issue in this case.6 Id. § 4-1101.
Article 4A was developed to address wholesale wire
transfers and commercial ACH transfers, generally between
businesses and their financial institutions.7 Id. § 4-1102 cmt.
6
In its enactment of Article 4A, the Maine legislature
provided that while "the text of that uniform act has been changed
to conform to Maine statutory conventions[, . . . u]nless otherwise
noted in a Maine comment, the changes are technical in nature and
it is the intent of the Legislature that this Act be interpreted as
substantively the same as the uniform act." 1992 Me. Legis. Serv.
ch. 812, § 3.
7
By contrast, consumer payments that are made
electronically, such as through direct wiring or the use of a debit
card, are covered by a separate federal statute, the Electronic
Fund Transfer Act (EFTA), 15 U.S.C. § 1693 et seq. Article 4A does
not apply to any funds transfer that is covered by the EFTA; the
two are mutually exclusive. Me. Rev. Stat. Ann. tit. 11, § 4-1108& cmt. The drafters of Article 4A felt that a separate framework,
apart from the more consumer-focused EFTA, was needed to cover
electronic transfers between commercial institutions because of the
sheer volume and magnitude of such transfers. Id. Art. 4-A, Refs.
& Annots. cmt. At the time of Article 4A's drafting, the volume of
payments by non-consumer wire transfer exceeded well over one
trillion dollars per day and the dollar volume of payments made by
wire transfer far exceeded the dollar volume of payments made by
other means. Id.-21-
Before Article 4A was drafted, "there was no comprehensive body of
law -- statutory or judicial -- that defined the juridical nature
of a [commercial] funds transfer or the rights and obligations
flowing from payment orders." Id. Instead, judges relied on
general principles of common law, sought guidance from other
provisions of the UCC, or analogized to laws applicable to other
payment methods. Id. The drafters of Article 4A sought to deliver
clarity to this area of law by "us[ing] precise and detailed rules
to assign responsibility, define behavioral norms, allocate risks
and establish limits on liability" in order to allow parties to
predict and insure against risk with greater certainty, given the
very large amounts of money involved in commercial funds transfers.
Id.Importantly, the drafters also sought to clarify the
interaction between the new provisions of Article 4A and existing
remedies under the common law:
Funds transfers involve competing interests --
those of the banks that provide funds transfer
services and the commercial and financial
organizations that use the services, as well
as the public interest. These competing
interests were represented in the drafting
process and they were thoroughly considered.
The rules that emerged represent a careful and
delicate balancing of those interests and are
intended to be the exclusive means of
determining the rights, duties and liabilities
of the affected parties in any situation
covered by particular provisions of the
Article. Consequently, resort to principles
of law or equity outside of Article 4A is not
appropriate to create rights, duties and
-22-
liabilities inconsistent with those stated in
this Article.
Id. The drafters "intended that Article 4A would be supplemented,
enhanced, and in some places, superceded by other bodies of law
. . . [T]he Article is intended to synergize with other legal
doctrines," so long as those doctrines are not inconsistent with
the rights, duties, and liabilities established in Article 4A.
Regions Bank v. Provident Bank, Inc., 345 F.3d 1267, 1275 (11th
Cir. 2003) (omission in original) (quoting Baxter & Bhala, The
Interrelationship of Article 4A with Other Law, 45 Bus. Law. 1485,
1485 (1990)) (internal quotation mark omitted). Article 4A further
provides that, in general, the parties may not vary by agreement
any rights and obligations arising under Article 4A. See Me. Rev.
Stat. Ann. tit. 11, § 4-1202(6).
Under Article 4A, a bank receiving a payment order
ordinarily bears the risk of loss of any unauthorized funds
transfer. Id. § 4-1204. The bank may shift the risk of loss to
the customer in one of two ways, one of which involves the
commercial reasonableness of security procedures and one of which
does not. First, the bank may show that the "payment order
received . . . is the authorized order of the person identified as
sender if that person authorized the order or is otherwise bound by
it under the law of agency." Id. § 4-1202(1). But, as the Article
4A commentary explains, "[i]n a very large percentage of cases
-23-
covered by Article 4A, . . . [c]ommon law concepts of authority of
agent to bind principal are not helpful" because the payment order
is transmitted electronically and the bank "may be required to act
on the basis of a message that appears on a computer screen." Id.
§ 4-1203 cmt. 1.
If the sender of the payment order had no authority to
act for the customer, and there are no additional facts on which
estoppel might be found, the "Customer is not liable to pay the
order and [the] Bank takes the loss." Id. cmt. 2. In such cases,
"these legal principles [of agency] give the receiving bank very
little protection . . . . The only remedy of [the] Bank is to seek
recovery from the person who received payment as beneficiary of the
fraudulent order." Id. cmts. 1, 2.
Accordingly, the drafters provided a second way by which
a bank may shift the risk of loss and protect itself whether or not
the payment order is authorized. This, in turn, has several
components:
If a bank and its customer have agreed that
the authenticity of payment orders issued to
the bank in the name of the customer as sender
will be verified pursuant to a security
procedure, a payment order received by the
receiving bank is effective as the order of
the customer, whether or not authorized, if:
(a) The security procedure is a
commercially reasonable method of
providing security against unauthorized
payment orders; and
-24-
(b) The bank proves that it accepted the
payment order in good faith and in
compliance with the security procedure
and any written agreement or instruction
of the customer restricting acceptance of
payment orders issued in the name of the
customer. The bank is not required to
follow an instruction that violates a
written agreement with the customer or
notice of which is not received at a time
and in a manner affording the bank a
reasonable opportunity to act on it
before the payment order is accepted.
Id. § 4-1202(2).
In turn, Article 4A defines a security procedure as:
[A] procedure established by agreement of a
customer and a receiving bank for the purpose
of: (1) Verifying that a payment order or
communication amending or cancelling a payment
order is that of the customer; or (2)
Detecting error in the transmission or the
content of the payment order or communication.
Id. § 4-1201. One question raised in this appeal is the scope of
any agreement reached.
The UCC explains that the "[c]ommercial reasonableness of
a security procedure is a question of law" to be determined by the
court. Id. § 4-1202(3). There are two ways by which a security
procedure may be shown to be commercially reasonable. First is by
reference to:
[T]he wishes of the customer expressed to the
bank, the circumstances of the customer known
to the bank, including the size, type and
frequency of payment orders normally issued by
the customer to the bank, alternative security
procedures offered to the customer and
security procedures in general use by
-25-
customers and receiving banks similarly
situated.
Id. § 4-1202(3). The Article is explicit that "[t]he standard is
not whether the security procedure is the best available. Rather
it is whether the procedure is reasonable for the particular
customer and the particular bank . . . ." Id. § 4-1203 cmt. 4.
The UCC explains that "[t]he burden of making available
commercially reasonable security procedures is imposed on receiving
banks because they generally determine what security procedures can
be used and are in the best position to evaluate the efficacy of
procedures offered to customers to combat fraud." Id. cmt. 3.
Secondly, the Article creates a presumption of
reasonableness under certain circumstances, not applicable here.
A security procedure is deemed to be commercially reasonable if:
(a) The security procedure was chosen by the
customer after the bank offered and the
customer refused, a security procedure that
was commercially reasonable for that customer;
and
(b) The customer expressly agreed in writing
to be bound by any payment order, whether or
not authorized, issued in its name and
accepted by the bank in compliance with the
security procedure chosen by the customer.
Id. § 4-1202(3). Of course, if the security procedure offered by
the bank was not commercially reasonable, then the provision does
not apply. Id. § 4-1203 cmt. 4.
If the bank shows both that its security procedure was
commercially reasonable and that it accepted the payment order "in
-26-
good faith and in compliance with the security procedure," the
payment order is effective as an authorized order of the customer.
Id. §§ 4-1202(2)(b), 4-1203(1). In such a case, the bank may,
"[b]y express written agreement, . . . limit the extent to which it
is entitled to enforce or retain payment of the payment order."
Id. § 4-1203(1)(a).
Once the bank has shown commercial reasonableness, the
customer may shift the risk of loss back to the bank if the
customer proves that the order was not "caused, either directly or
indirectly, by a person":
(i) Entrusted at any time with duties to act
for the customer with respect to payment
orders or the security procedure or who
obtained access to transmitting facilities of
the customer; or
(ii) Who obtained from a source controlled by
the customer and without authority of the
receiving bank information facilitating breach
of the security procedure, regardless of how
the information was obtained or whether the
customer was at fault. Information includes
any access device, computer software or the
like.
Id. § 4-1203(1)(b). As the commentary explains, this section of
the UCC places a burden on the customer, when the security
procedure is commercially reasonable, "to supervise its employees
to assure compliance with the security procedure and to safeguard
confidential security information and access to transmitting
facilities so that the security procedure cannot be breached." Id.
§ 4-1203 cmt. 3.
-27-
If the bank does not make its showing of commercial
reasonableness, then the analysis goes back to the question of
agency under § 4-1202(a), described above. If the court
determines, under any of these provisions, that the bank bears the
risk of loss, "the bank shall refund any payment of the payment
order received from the customer to the extent the bank is not
entitled to enforce payment and shall pay interest on the
refundable amount calculated from the date the bank received
payment to the date of the refund." Id. § 4-1204(1).
B. Ocean Bank's Motion for Summary Judgment
Ocean Bank argues that because Patco agreed to the
security system in use, and because the security system was
commercially reasonable, it is entitled to summary judgment.
Patco counters that the bank's security system was not
commercially reasonable, that it did not agree to all of the
procedures, and that the bank did not comply with its own
procedures.
As to commercial reasonableness, Patco argues the bank's
decision to lower the dollar amount rule to $1 increased the risk
of compromised security, and that the bank's failure in light of
this increased risk to monitor and immediately notify customers of
abnormal transactions which met high risk criteria was not
commercially reasonable. Patco also argues that it was not offered
and it did not decline an e-mail notice system for transactions.
-28-
Essentially, Patco argues that when Ocean Bank decided in
June of 2008 to trigger challenge questions for any transaction
over $1, the bank increased the frequency with which a user was
required to enter the answers to his or her challenge questions.
Indeed, at a $1 threshold, the frequency as to Patco became 100%,
covering every transaction. For customers like Patco who made
regular ACH transfers, the risks were even greater than for
customers who rarely made such transfers. This, in turn, also
increased the risk that such answers would be compromised by
keyloggers8 or other malware that would capture that information
for unauthorized uses. By thus increasing the risk of fraud
through unauthorized use of compromised security answers, Patco
argues, Ocean Bank's security system failed to be commercially
reasonable because it did not incorporate additional security
measures, at the very least monitoring of high risk score
transactions, use of e-mail alerts and inquiries, or other
immediate notice to customers of high-risk transactions.
In our view, Ocean Bank did substantially increase the
risk of fraud by asking for security answers for every $1
transaction, particularly for customers like Patco which had
8
A "keylogger" is a form of computer malware, or malicious
code, capable of infecting a user's system, secretly monitoring the
user's Internet activity, recognizing when the user has browsed to
the website of a financial institution, and recording the user's
key strokes on that website. In this way, the keylogger is able to
capture a user's authentication credentials, which the keylogger
then transmits to a cyber thief.
-29-
frequent, regular, and high dollar transfers. Then, when it had
warning that such fraud was likely occurring in a given
transaction, Ocean Bank neither monitored that transaction nor
provided notice to customers before allowing the transaction to be
completed. Because it had the capacity to do all of those things,
yet failed to do so, we cannot conclude that its security system
was commercially reasonable. We emphasize that it was these
collective failures taken as a whole, rather than any single
failure, which rendered Ocean Bank's security system commercially
unreasonable.
The Jack Henry Premium Product was designed to harness
the power of the risk-scoring system and included a device
identification system to trigger an additional layer of
authentication -- challenge questions -- whenever the bank's system
detected unusual or suspicious transactions. In May of 2009, bank
personnel did not monitor the risk-scoring reports, nor did the
bank conduct any other regular review of transactions that
generated high risk scores. Thus, the only result of a high risk
score or an unidentified device was that a customer would be
prompted to answer his or her challenge questions.
When Ocean Bank lowered the dollar amount rule from
$100,000 to $1, it essentially deprived the complex Jack Henry
risk-scoring system of its core functionality. The $1 dollar
amount rule guaranteed that challenge questions would be triggered
-30-
on every transaction unless caught by a separate eFraud network
which depended on the use of known fraudulent IP addresses. The
eFraud network was of no use if the address and like information
were not already known to law enforcement. Accordingly, cyber
criminals equipped with keyloggers had the much more frequent
opportunity to capture all information necessary to compromise an
account every time the customer initiated an ACH transaction. In
Patco's case, ACH transactions were initiated at least weekly, and
often several times per week. In the event a customer's computer
became infected with a keylogger, it was likely that the customer
would be prompted to answer its challenge questions before the
malware was discovered and removed from the customer's computer.
Patco's argument is supported both by evidence and by
common sense. Patco's expert testified that at the times in
question, keylogging malware was a persistent problem throughout
the financial industry. It was foreseeable, against this
background, that triggering the use of the same challenge questions
for high-risk transactions as were used for ordinary transactions,
was ineffective as a stand-alone backstop to password/ID entry.
Indeed, it was well known that setting challenge questions to be
asked on every transaction greatly increases the risk that a
fraudster equipped with a keylogger would be able to access the
answers to a customer's challenge questions because it increases
-31-
the frequency with which such information is entered through a
user's keyboard.
As early as 2005, RSA/Cyota cautioned against the regular
and frequent use of challenge questions as a stand-alone backstop
to the exclusion of further controls, stating that challenge
questions were "quicker and simpler to adopt" but were "less
secure," and should be used only "in the short term, as the first
phase of a full project." According to RSA/Cyota, challenge
questions should be triggered only selectively, when unusual or
suspicious activity is detected, so that they are less likely to be
asked after a keylogger is installed on a customer's computer and
before it can be removed. When asked frequently, they should not
be used as the only line of defense beyond a password/ID, since a
password/ID and answers to challenge questions could all be
simultaneously captured by a keylogger.
Ocean Bank's decision to set the dollar amount rule at $1
for all of its customers also ignored Article 4A's mandate that
security procedures take into account "the circumstances of the
customer" known to the bank. Id. § 4-1202(3). Article 4A directs
banks to consider such circumstances as "the size, type and
frequency of payment orders normally issued by the customer to the
bank." Id. In Patco's case, these characteristics were regular
and predictable. Patco used eBanking primarily to make payroll
payments to employees. These payments were made weekly, generally
-32-
on Fridays; they originated from a single static IP address; and
they were always made from the same set of computers at Patco's
offices in Sanford, Maine. The highest such payment Patco ever
made was $36,634.74, well below the former $100,000 threshold. The
bank does not assert that it ever offered to adjust the threshold
amount for particular customers. Instead, the bank adopted a "one-
size-fits-all" dollar amount rule of $1 for its customers.
Ocean Bank argues that it did take Patco's circumstances
into account by building a risk profile based on Patco's eBanking
habits, such that the security system could compare the
characteristics of each transaction against those in Patco's
profile.9 This argument misses the mark because, in fact, the risk
profile information played no role. It triggered no additional
authentication requirements, and the bank did nothing with the
information generated by comparing the fraudulent transactions
against Patco's profile.
Ocean Bank also argues that it was commercially
reasonable for it to universally lower the dollar amount rule to $1
in order to target low-dollar fraud. Whether or not that is true
for certain customers, it is beside the point. Here, the increase
9
The bank also argues that it took Patco's circumstances
into account by setting Patco's ACH withdrawal limit based on its
specific needs. As the district court correctly noted, however,
ACH limits do not constitute a "security procedure" under Article
4A and thus have no bearing on the commercial reasonableness
analysis. Patco Constr. Co. v. People's United Bank, No.
09–cv–503, 2011 WL 2174507, at *28 n.131 (D. Me. May 27, 2011).
-33-
in risk to the consumer who engaged in regular high dollar
transfers, such as Patco, was sufficiently serious to require a
corollary increase in security measures for a security system to
remain commercially reasonable. The bank's generic "one-size-fits-
all" approach to customers violates Article 4A's instruction to
take the customer's circumstances into account. Further, the
reduction of the dollar amount rule to $1 was for commercial
customers, who are quite unlikely to have transfers of less than
$1.
Ocean Bank introduced no additional security measures in
tandem with its decision to lower the dollar amount rule, despite
the fact that several such security measures were not uncommon in
the industry and were relatively easy to implement. Patco's expert
testified that all of her other banking clients using the same Jack
Henry Premium Product employed manual reviews or some other
additional security measure to protect against the type of fraud
that occurred in this case.
For example, by May 2009, internet banking security had
largely moved to hardware-based tokens and other means of
generating "one-time" passwords.10 As of then, People's United Bank
10
Although tokens can be compromised, bypassing them requires
greater sophistication than is needed to obtain challenge
questions. The perpetrator must use the information within seconds
of acquiring it, before the system generates a new password to
replace the old. The answers to challenge questions, by contrast,
may be used at the perpetrator's leisure, particularly when, as was
the case at Ocean Bank, the answers are static. Even if a token
had been used and compromised in this case, the magnitude of the
-34-
(which had acquired Ocean Bank), several national banks, and many
New England community banks were using tokens for commercial
accounts. Of those banks that did not use tokens in May 2009, New
England community banks commonly used some form of manual review or
customer verification to authenticate uncharacteristic or
suspicious transactions. Such security procedures self-evidently
would not have been difficult to implement.11
This failure to implement additional procedures was
especially unreasonable in light of the bank's knowledge of ongoing
fraud. As early as 2008, Ocean Bank had received notification of
substantial increases in internet fraud involving keylogging
malware. By May 2009, Ocean Bank had itself experienced at least
two incidents of fraud on the bank's system which it attributed to
either keylogging malware or internal fraud. In both instances,
the perpetrators had acquired and successfully applied the
customer's passwords, IDs, and answers to challenge questions.
Thus, by May 2009, when the fraud in this case occurred,
it was commercially unreasonable for Ocean Bank's security system
to trigger nothing more than what was triggered in the event of a
resulting fraud would have been greatly reduced because the
captured password could not have been used after the initial
transaction.
11
Indeed, shortly after the fraud in this case occurred,
Ocean Bank began conducting manual reviews of suspect transactions.
Now, transactions that generate high risk scores are personally
reviewed by Ocean Bank personnel to determine their legitimacy.
-35-
perfectly ordinary transaction in response to the high risk scores
that were generated by the withdrawals from Patco's account. The
payment orders at issue were entirely uncharacteristic of Patco's
ordinary transactions: they were directed to accounts to which
Patco had never before transferred money; they originated from
computers Patco had never before used; they originated from an IP
address that Patco had never before used; and they specified
payment amounts significantly higher than the payments Patco
ordinarily made to third parties. As a result, the security system
flagged these transactions as uncharacteristic, highly suspicious,
and potentially fraudulent from a "very high risk non-authenticated
device." The transactions generated unprecedentedly high risk
scores ranging from 563 to 790, well above Patco's regular risk
scores which ranged from 10 to 214.
These collective failures, taken as a whole, rendered
Ocean Bank's security procedures commercially unreasonable. We
reverse the district court's grant of summary judgment as to Count
I.
That does not, however, end the matter, even as to Count
I. The issues briefed to us on appeal have largely involved
commercial reasonableness. Our conclusion that the security
procedures were not commercially reasonable does not end the
analysis of the Article 4A issues. Our conclusion as to Count I
and commercial reasonableness does, though, also lead us to vacate
-36-
the district court's grant of summary judgment on the two claims --
Count V (unjust enrichment) and Count VI (conversion) -- which the
district court considered to be dependent on the success of Count
I.
C. Patco's Motion for Summary Judgment
We affirm the district court's decision to deny Patco's
motion for summary judgment. There remain several genuine and
disputed issues of fact which may be material to the question of
whether Patco has satisfied its obligations and responsibilities
under Article 4A, or at least to the question of damages. The
district court did not reach, and the parties have not briefed, the
question of what, if any, obligations or responsibilities Article
4A imposes on a commercial customer even where a bank's security
system is commercially unreasonable. We leave these questions open
on remand so that the district court may, after briefing, assess
whether such obligations exist, either for liability purposes or
for mitigation of damages.
As to the genuine and disputed issues of fact, the
parties dispute the facts surrounding Patco's lack of e-mail
alerts. Patco alleges that it requested e-mail alerts from the
bank, but that the bank ignored these requests and never notified
Patco when e-mail alerts became available to bank customers. The
bank counters with its own allegation that it sent out a general
e-mail to customers that it would make e-mail alerts available.
-37-
Patco states that it received no such e-mail, and that instead, a
customer would have had to follow a complicated series of steps to
find an "Alerts" tab on the bank's website in order to learn that
such e-mail alerts had become available. Moreover, Patco alleges
that its account was not even set up with an "Alerts" tab; that the
account only features a "Preferences" tab. While one of Patco's
employees did successfully navigate to the "Preferences" tab, she
alleges she never saw an "Alerts" tab. Additionally, neither party
has submitted into the record an example of such an e-mail alert or
specified when such an e-mail alert would have been sent, such that
it is unclear what Patco would have learned from such an e-mail
alert and whether and when such an e-mail would have placed Patco
on notice of the fraudulent transfer.
The parties also disagree as to whether the fraud in this
case was caused by malware and keylogging in the first place, or
whether Patco shares some responsibility. Ocean Bank argues that
because Patco irreparably altered the evidence on its hard drives
by using and scanning its computers before making forensic copies,
it is unclear whether keylogging malware existed on Patco's
computers and enabled the alleged fraud. These disputed issues of
fact may be material.
Article 4A does not appear to be a one-way street.
Commercial customers have obligations and responsibilities as well,
under at least § 4-1204. See Me. Rev. Stat. Ann. tit. 11, § 4-
-38-
1204; but see id. § 4-1102 cmt. ("Resort to principles of law or
equity outside of Article 4A is not appropriate to create rights,
duties and liabilities inconsistent with those stated in this
Article."). Section 4-1204, entitled "Refund of payment and duty
of customer to report with respect to unauthorized payment order,"
provides:
The customer is not entitled to interest from
the bank on the amount to be refunded if the
customer fails to exercise ordinary care to
determine that the order was not authorized by
the customer and to notify the bank of the
relevant facts within a reasonable time not
exceeding 90 days after the date the customer
received notification from the bank that the
order was accepted or that the customer's
account was debited with respect to the order.
Id. § 4-1204(1).12 It is unclear, however, what, if any,
obligations a commercial customer has when a bank's security system
is found to be commercially unreasonable.
In short, we leave open for the parties to brief on
remand the question of what, if any, obligations or
responsibilities are imposed on a commercial customer under Article
4A even where a bank's security system is commercially
12
The commentary describes this burden on the customer as a
duty of ordinary care which is designed to encourage the customer
to promptly notify the bank about any instances of fraud so that
the bank can minimize its losses. Me. Rev. Stat. Ann. tit 11, § 4-
1204 cmt. 2. The commentary clarifies that a breach of this duty
results only in a loss of the interest on the refund payable by the
bank, but not a loss of the refund itself. Id.
-39-
unreasonable. The record requires further development on these
issues, precluding summary judgment at this stage.
D. Dismissal of Counts II-IV
The district court concluded that Article 4A "preempts"13
Patco's remaining common law claims: Count II (negligence), Count
III (breach of contract), and Count IV (breach of fiduciary duty).
The district court based its analysis on the commentary to § 4-
1102, which provides:
Funds transfers involve competing interests --
those of the banks that provide funds transfer
services and the commercial and financial
organizations that use the services, as well
as the public interest. These competing
interests were represented in the drafting
process and they were thoroughly considered.
The rules that emerged represent a careful and
delicate balancing of those interests and are
intended to be the exclusive means of
determining the rights, duties and liabilities
of the affected parties in any situation
covered by particular provisions of the
Article. Consequently, resort to principles
of law or equity outside of Article 4A is not
appropriate to create rights, duties and
liabilities inconsistent with those stated in
this Article.
Id. § 4-1102 cmt.
This language does not, on its face, displace Patco's
Count III for breach of contract or Count IV for breach of
13
This use of the term has nothing to do with the standard
legal use of "preemption," which involves the question of whether
federal law precludes a state from regulating on the same topic.
See, e.g., Kurns v. R.R. Friction Prods. Corp., 132 S. Ct. 1261,
1265-66 (2012). We prefer different terminology.
-40-
fiduciary duty.14 We adopt the test, as set forth in the
commentary, that Article 4A embodies an intent to restrain common
law claims only to the extent that they create rights, duties, and
liabilities inconsistent with Article 4A. See Ma v. Merrill Lynch,
Pierce, Fenner & Smith, Inc., 597 F.3d 84, 89 (2d Cir. 2010);
Regions Bank, 345 F.3d at 1275.
The common law claims of breach of contract and breach of
fiduciary duty are not inherently inconsistent with Patco's Article
4A claim. At least in theory, there could be, either by contract
or through assumption of fiduciary duties,15 higher standards which
are imposed on the bank. Indeed, courts have held that plaintiffs
may turn to common law remedies to seek redress for an alleged harm
arising from a funds transfer where Article 4A does not protect
against the underlying injury or misconduct alleged. See, e.g.,
Ma, 597 F.3d at 89-90; Regions Bank, 345 F.3d at 1275; see also
White & Summers, Uniform Commercial Code §§ 1-2, at 132 (1993
pocket part) ("With the adoption of Article 4A, electronic funds
14
We do not address whether Patco otherwise states a claim
for breach of fiduciary duty under Maine Law, see, e.g., Stewart v.
Machias Sav. Bank, 762 A.2d 44, 46 & n.1 (Me. 2000), or for that
matter, breach of contract, see, e.g., Seashore Performing Arts
Ctr., Inc. v. Town of Old Orchard Beach, 676 A.2d 482, 484 (Me.
1996).
15
We disagree with the district court's conclusion that
inconsistency is demonstrated merely because "[t]he gravamen of all
three counts is precisely the same as that of Count I: that the
Bank failed to employ proper security procedures, as a result of
which Patco suffered the loss in question." Patco Constr. Co.,
2011 WL 2174507, at *35.
-41-
transactions are governed not only by Article 4A, but also common
law . . . ."). We vacate the dismissal and leave the issue of
these two causes of action open on remand to be considered anew.
The closer question is whether Article 4A, on the facts
of this case,16 displaces the claim for negligence. That is, are
the negligence claims inconsistent with the duties and liability
limits set forth in Article 4A. We think they are, inasmuch as the
standard for the duty of care as to both sides is set forth in
Article 4A and its limitation of liability. See Ma, 597 F.3d at
89-90 (interpreting Article 4A to displace common law claims, such
as negligence, where Article 4A has already specified the relevant
duties and "protect[ions] against the type of underlying injury or
misconduct alleged in a claim"); Donmar Enters., Inc. v. S. Nat'l
Bank of N.C., 64 F.3d 944, 949-50 (4th Cir. 1995) (holding that
16
This case is not like Regions Bank in the sense that there
a beneficiary bank accepted funds it knew or had reason to know
were fraudulently obtained, and the court held other state law
remedies for fraud were not inconsistent with Article 4A. As the
court said:
Interpreting Article 4A in a manner that would
allow a beneficiary bank to accept funds when
it knows or should know that they were
fraudulently obtained, would allow banks to
use Article 4A as a shield for fraudulent
activity. It could hardly have been the
intent of the drafters to enable a party to
succeed in engaging in fraudulent activity, so
long as it complied with the provisions of
Article 4A.
Regions Bank v. Provident Bank, Inc., 345 F.3d 1267, 1276 (11th
Cir. 2003).
-42-
negligence claims are in conflict with, and therefore displaced by,
Article 4A); cf. Anderson v. Hannaford Bros. Co., 659 F.3d 151, 161
(1st Cir. 2011) (where Maine law is clear that certain damages on
given facts are not available regardless of theory pled, Maine law
will not under new cause of action allow such damages). So we
affirm the dismissal of the negligence claims.
IV.
We reverse the district court's grant of summary judgment
in favor of the bank, and affirm the district court's denial of
Patco's motion for summary judgment. We remand for further
proceedings in accordance with this opinion. On remand the parties
may wish to consider whether it would be wiser to invest their
resources in resolving this matter by agreement.
No fees are awarded; each side shall bear its own costs.
-43-