## Facts

- Experi-Metal, Inc. (a Michigan manufacturer) maintained commercial deposit accounts at Comerica Bank and used Comerica’s online wire-transfer platform.
- Comerica transitioned from digital-certificate authentication to a “secure token” system requiring a user ID/WebID, PIN, and token-generated code.
- Experi-Metal authorized an employee, Keith Maslowski, to use the wire system and later did not notify Comerica that his authorization should be removed.
- On January 22, 2009, Maslowski received a phishing email appearing to be from Comerica, followed a link to a fraudulent webpage, and entered his credentials.
- Using the compromised credentials, criminals initiated 93 wire transfers over about six and a half hours, totaling roughly $1.9 million, largely to foreign beneficiaries; some wires created major overdrafts, including an overdraft approaching $5 million in one account.
- A third-party bank alerted Comerica about suspicious wires; Comerica contacted Experi-Metal, confirmed the wires were unauthorized, placed a hold on online banking access, and attempted to terminate the session.
- Comerica recovered most transferred funds, but approximately $560,000 remained unrecovered and was charged to Experi-Metal’s account.
- Experi-Metal sued under Michigan’s enactment of UCC Article 4A, alleging Comerica should bear the loss for unauthorized payment orders; Comerica moved for summary judgment, asserting commercially reasonable security procedures and good-faith acceptance.

## Issues

1. Whether the parties’ agreed online wire-transfer security procedure was “commercially reasonable” under Michigan Compiled Laws § 440.4702.
2. Whether Comerica accepted the disputed payment orders in “good faith,” including observance of reasonable commercial standards of fair dealing, as required by § 440.4702.
3. Whether Comerica accepted the orders in compliance with the agreed security procedure and any relevant written agreement or customer instruction.

## Decision

- The court denied Comerica’s motion for summary judgment.
- The court held that genuine disputes of material fact existed on whether Comerica’s security procedures were commercially reasonable.
- The court held that genuine disputes of material fact existed on whether Comerica acted in good faith and in compliance with the agreed procedures when processing the high-volume, atypical wire activity.
- The case was permitted to proceed to trial on the Article 4A loss-allocation claim.

## Legal Principles

- Under Mich. Comp. Laws § 440.4702, an unauthorized payment order may be treated as effective as the customer’s order only if: (1) the bank and customer agreed to a security procedure to verify authenticity; (2) the procedure was commercially reasonable; and (3) the bank accepted the order in good faith and in compliance with the procedure and applicable written agreements or instructions.
- “Commercial reasonableness” is a fact-dependent inquiry that may consider the customer’s characteristics, the service used, available security options, and industry practices.
- Article 4A “good faith” requires honesty in fact and observance of reasonable commercial standards of fair dealing; technical satisfaction of authentication steps may not resolve good faith when transaction patterns create strong indicia of fraud.
- Customer negligence (such as credential disclosure through phishing) may be relevant to loss allocation, but it does not automatically establish the bank’s entitlement to judgment as a matter of law when the bank’s good faith and fair dealing remain disputed.

## Conclusion

The court refused to shift the loss from the fraudulent wires to Experi-Metal at the summary-judgment stage because the record permitted competing findings on the commercial reasonableness of Comerica’s security program and whether Comerica accepted the unusually patterned wire orders in good faith and consistent with reasonable banking standards.


Experi-Metal, Inc. v. Comerica Bank, No. 09-14890, 2010 WL 2720914 (E.D. Mich. July 8, 2010)