Studco Building Systems US, LLC v. 1st Advantage Federal Credit Union

Metal fabricator Studco Building Systems US, LLC (Studco) (plaintiff) frequently purchased steel from Olympic Steel (Olympic). An unknown overseas actor hacked into Olympic’s email system and sent Studco an email claiming that Olympic had changed banks. Despite numerous errors and red flags in the email, Studco requested the new bank information without questioning the change. The hacker gave Studco information for an account at 1st Advantage Federal Credit Union (First Advantage) (defendant). The account was in the name of Lesa Taylor, an individual who had been duped into unknowingly participating in the fraud. Studco sent four automated-clearing-house (ACH) payments totaling $558,868.71 before it discovered the fraud. Each payment order from Studco’s bank to First Advantage listed Olympic Steel as the beneficiary but provided Taylor’s account number. First Advantage’s automated system detected the name mismatch. However, this system flagged hundreds to thousands of similar discrepancies daily, and no employee reviewed them. By the time Studco realized it had been tricked, the unknown criminals had withdrawn the money from Taylor’s account. The criminals were never caught, and the money was never recovered. Studco sued First Advantage in federal district court, alleging, among other claims, that the credit union had violated Virginia’s version of UCC § 4A-207 by negligently failing to notify ACH senders about name mismatches on payment orders. First Advantage argued that unless it had actual knowledge of a name mismatch, the statutory language allowed it to rely solely on the account number. Following a bench trial, the district court found that First Advantage had negligently failed to monitor name mismatches on ACH transfers and entered judgment for Studco. First Advantage appealed.