Experi-Metal, Inc., v. Comerica Bank (docket number: 2:2009cv14890) is a decision by the United States District Court for the Eastern District of Michigan in a case of a phishing attack that resulted in unauthorized wire transfers of US$1.9 million through Experi-Metal's online banking accounts. The court held Comerica liable for losses of US$560,000 that could not be recovered from the phishing attack, on the ground that the bank had not acted in good faith when it failed to recognize the transfers as fraudulent.
Background
Experi-Metal, a Macomb, Michigan-based company, held accounts with Comerica, headquartered in Dallas, Texas. Experi-Metal had signed up for a NetVision Wire Transfer service allowing it to send and receive payments and incoming fund transfers through the Internet.
Phishing attack
At approximately 7:35 am on January 22, 2009, an Experi-Metal employee opened a phishing email containing a link to a web page purporting to be a "Comerica Business Connect Customer Form". Following the email's link, the employee then proceeded to provide his security token identification, WebID and login information to a phony site. As a result, the fraudulent third parties gained access to Experi-Metal's accounts held with Comerica.
In a six-and-a-half-hour period between 7:30 am and 2:02 pm, 93 fraudulent transfers were made from Experi-Metal's accounts totaling US$1,901,269.00. The majority of the transfers were directed to bank accounts in Russia, Estonia and China.
Between 7:40 am and 1:59 pm, transfers totaling US$5.6 million were executed among accounts using the information obtained from the phishing attack. In one account, the transfers resulted in an overdraft of US$5 million.
At 11:30 am, Comerica was alerted to the potential fraud by a telephone call from a JP Morgan Chase employee who had noticed suspicious wire transfers sent from an Experi-Metal account to a bank in Moscow, Russia. Sometime between 11:47 am and 11:59 am, Comerica alerted Experi-Metal to the transfers and confirmed that the legitimate account holder had not made any transactions during the course of the day. By 12:25 pm, Comerica put a hold on Experi-Metal's online banking transactions and began to "kill" its user session in an attempt to forcefully remove the people making the transfers from the Comerica online service.
Comerica was successful in recovering a portion of the transfers. In total, US$561,399 was lost in the fraudulent transfers arising out of the phishing scheme.
Opinion of the US District Court in Michigan
The court considered two main issues in its decision. The first issue was whether the Experi-Metal employee whose confidential information was used to initiate the fraudulent transfers was authorized to initiate transfers on behalf of the company, and in turn, whether Comerica complied with its own security procedures in accepting the orders. The second issue was whether Comerica acted in "good faith" in accepting the orders on Experi-Metal's account.
User information initiating fraudulent transfers
There was some question as to whether the Experi-Metal employee who fell victim to the phishing incident was authorized to make wire transfers on behalf of the company. The issue was raised in the context of whether Comerica was complying with its security procedures when it accepted the wire transfers that were made using his account user information on January 22, 2009.
After considering several contextual factors, the court concluded that the employee who had provided his account user information was authorized to initiate transfers with Comerica on behalf of Experi-Metal. As a result, Comerica was found to be in compliance with its own security protocols when it accepted the orders.
Good faith
A second issue in the case concerned the issue of 'good faith' on Comerica's part in accepting the wire transfers initiated by the fraudulent third parties.
Under Michigan law, wire transfer orders are effective as orders of the customer even if they are not actually ordered by the customer, provided certain criteria are met. The issue in this case was whether the orders were accepted in good faith and in compliance with the security procedures, written agreements or instructions of the customer. If the orders made to Comerica on Experi-Metal's account were not received in "good faith", they would not be effective.