## Facts

- Patco Construction Company, Inc., a Maine construction firm, used Ocean Bank’s commercial online banking platform for payroll and other payments.
- In May 2009, cybercriminals initiated six unauthorized ACH withdrawals over seven days totaling $588,851.26 from Patco’s account.
- The fraudsters correctly supplied Patco’s challenge-question answers, and the bank authorized the transfers.
- Ocean Bank’s automated risk-scoring system flagged each transaction as unusually high risk due to timing, amount, and geographic anomalies, but the bank did not notify Patco or intervene before releasing the payments.
- Ocean Bank recovered or blocked $243,406.83, leaving Patco with a $345,444.43 residual loss.
- Prior to the fraud, Ocean Bank reduced the dollar threshold for triggering challenge questions from $100,000 to $1, requiring challenge-question answers on nearly every transaction.
- Patco alleged the low challenge-question threshold increased exposure to malware capture and that the bank failed to use risk scores for monitoring, escalation, or blocking.
- Patco sued under Maine’s enactment of UCC Article 4A and related theories; the district court held the bank’s security procedures were commercially reasonable and granted summary judgment for the bank on all counts.
- Patco appealed.

## Issues

1. Whether the bank’s agreed authentication/security procedures for online payment orders were “commercially reasonable” under UCC Article 4A (UCC § 4A-202 as enacted in relevant states).
2. If the procedures were not commercially reasonable, what additional Article 4A questions remained regarding allocation of loss, including the bank’s good faith/compliance and any customer obligations.
3. Whether summary judgment dismissing Patco’s other claims as dependent on or displaced by Article 4A was proper.

## Decision

- The First Circuit reversed summary judgment for the bank on the Article 4A claim, holding the bank’s security procedures, as configured and implemented for Patco, were not commercially reasonable.
- The court affirmed denial of Patco’s motion for summary judgment on the Article 4A claim, leaving unresolved whether Article 4A imposed relevant duties on Patco and how losses should be allocated.
- The court reinstated certain non-Article-4A claims previously dismissed and remanded for further proceedings.

## Legal Principles

- Under UCC Article 4A, a bank may shift loss from an unauthorized payment order to a commercial customer only if: (1) the parties agreed to a security procedure, (2) the procedure was commercially reasonable, and (3) the bank accepted the order in good faith and in compliance with the procedure and any written instructions.
- “Commercial reasonableness” is evaluated functionally and contextually; it depends on how security tools are configured and used in practice, not merely on their nominal existence.
- A bank’s failure to act on high-risk indicators generated by its own risk-scoring system can support a finding that its security procedures were not commercially reasonable.
- Uniform security settings that increase credential exposure (e.g., requiring challenge-question answers on nearly every transaction) may undermine commercial reasonableness when not paired with compensating controls.
- A finding that the bank’s security procedures were not commercially reasonable does not itself resolve final loss allocation; further analysis may be required regarding good faith, compliance, and any customer responsibilities.
- Reversal of the commercial-reasonableness determination may require reconsideration of other claims previously dismissed as displaced or derivative.

## Conclusion

The First Circuit held that the bank’s online security procedures, viewed as actually configured and operated—particularly the $1 challenge-question threshold and the failure to respond to extreme risk scores—were not commercially reasonable under UCC Article 4A, reversed summary judgment for the bank, reinstated certain related claims, and remanded for further proceedings on remaining Article 4A and other issues.


Patco Constr. Co. v. People's United Bank, 684 F.3d 197 (1st Cir. 2012)