Patco Construction Co. v. People’s United Bank

Ocean Bank, a division of People’s United Bank (defendant) permitted fraudulent electronic withdrawals totaling approximately $589,000 to be made from the Ocean Bank account of Patco Construction Company (Patco) (plaintiff) after the perpetrators provided Patco’s login credentials and answers to security challenge questions. The funds were sent to numerous persons to whom Patco had not previously sent money, were for larger amounts than Patco’s normal withdrawals, and were sent from computers and Internet Protocol addresses not recognized by Ocean Bank’s security system, which flagged the transactions as high risk. Ocean Bank nevertheless failed to manually review or notify Patco of these transactions. Ocean Bank was able to recover approximately $244,000 of the stolen funds, leaving Patco with a loss of approximately $345,000. Patco sued People’s United, alleging that People’s United was responsible for the loss because Ocean Bank’s security system was not commercially reasonable under Article 4A of the Uniform Commercial Code (UCC). The district court granted summary judgment for People’s Bank, and Patco appealed. Patco argued that Ocean Bank greatly increased the risk of fraud when, about one year prior to the theft from Patco’s account, Ocean Bank lowered the transaction threshold that triggered challenge questions under Ocean Bank’s security system from $100,000 to $1. The new threshold applied to all the bank’s customers, regardless of each customer’s circumstances. This effectively meant that Patco’s answers to the challenge questions had to be provided for every one of its online banking transactions, which created far more opportunities for malware to capture that information. Ocean Bank did not add any new security measures in conjunction with lowering the dollar threshold for the security challenge questions despite the prevalence of such measures within the banking industry and the relative ease with which they could have been implemented.