Court Rules Bank's Security Procedures Were Not Commercially Reasonable

In an important decision last week, the U.S. Court of Appeals for the First Circuit held, as a matter of law, that People's United Bank's online banking security procedures were not commercially reasonable, even though its selected authentication technology fully complied with the Federal Financial Institutions Examination Council (FFIEC) guidelines for Authentication in an Internet Banking Environment.¹ A detailed review of this cautionary case offers some useful lessons for all financial institutions that offer online services to retail or corporate customers.

In Patco Construction Company v. People's United Bank,² Patco Construction Co. (Patco) brought suit alleging that People's United Bank should bear the loss resulting from fraudulent withdrawals totaling almost $350,000³ from Patco's electronic banking account at Ocean Bank, a southern Maine community bank that was acquired by People's United Bank. After the district court granted summary judgment in favor of