Appeals Court to Hear Oral Arguments of Closely-Watched Credit Union Business Email Compromise Case

CUNA and NAFCU, now America’s Credit Unions, and the Virginia Credit Union League (VACUL) jointly filed an amicus brief or “friend of the court” document with the appeals court arguing that while credit unions support their members there must be a limit to liability for fraud that is out of the credit union’s control.

“We maintain that the judge got it wrong in this case. Financial institutions rely on automation to sort through billions of ACH transactions each year,” the jointly field court document read. “For perspective, some 30 billion payments moved through the ACH network operators in 2022. While the ACH system is designed to flag transactions that warrant closer scrutiny, it is unrealistic to think any financial institution handling a significant volume of ACH transactions can manually monitor fraud. While fraud is on the rise and unfortunate, credit unions cannot be held accountable for events out of their control. Our financial system would collapse if that were the case.”

The event that led to this credit union lawsuit began on Aug. 9, 2018, when an eight-year member identified as L.T. opened a personal account. The member, identified as a merchant coordinator, told 1st Advantage the personal account would be used for real estate transactions.

On Oct. 1, 2018, SBS received a spoofed email from an unknown third party purporting to be Olympic Steel, a client of SBS. The spoofed email fraudulently instructed SBS to change its banking remittance information to L.T.’s personal account.

From Oct. 1 to Nov. 13, 2018, SBS made four ACH deposits totaling $558,868 to L.T.’s account. By the end of November, the account balance was $11.12 following a series of in-branch cashier’s check withdrawals, several domestic wires and two attempted international wire transfers.

The international wires were cancelled by the credit union after it received an alert from the Office of Foreign Assets Control. Even though the credit union launched an investigation after getting that alert, the domestic wire transfers were not cancelled, according to court documents. When a 1st Advantage compliance manager questioned L.T. about the ACH transfers on Nov. 23, the member said it was part of a job with another person who was doing real estate transactions and that the member was conducting those ACH transactions based on that job, court documents showed.

The Virginia Commercial Code required 1st Advantage to reject ACH deposits if it knew that there was a misdescription between the intended beneficiary, Olympic Steel and the purported owner of the account, L.T., receiving the ACH.

According to Virginia law, an organization has actual knowledge for a particular transaction from the time it would have been brought to the individual’s attention if the organization had exercised due diligence. An organization exercises due diligence if it maintains reasonable routines for communicating significant information to the person conducting the transaction and there is reasonable compliance with the routines.

“While it is true that 1st Advantage had no duty to proactively discover a misdescription of the account information, the evidence at trial illustrated that 1st Advantage did not maintain reasonable routines for communicating significant information to the person conducting the transaction,” Judge Jackson wrote in his ruling. “If 1st Advantage had exercised due diligence, the misdescription would have been discovered during the first ACH transfer.”

The Appeals Court is not expected to make a ruling on this case until next year.