Lawsuit Provides Instructive Advice on Escrow Trust Account Security
|August 28, 2014|
Title professionals that operate escrow trust accounts can glean some instructive advice from a recent lawsuit involving the fraudulent transfers of more than $440,000 from a trust account in 2010.
In June, a panel of Eighth Circuit judges ruled that Choice Escrow Land Title in Missouri was responsible for the losses it suffered from the fraudulent transfer. The panel found that the liability for account takeover losses shifted when the escrow company declined to use a two-person authorization security feature offered by the bank. The court also ordered Choice Escrow pay to pay all the bank’s legal fees associated with the lawsuit.
Choice Escrow opened a trust account with BancorpSouth in 2009. The bank, at the time, encouraged customers to utilize Dual Control, which mandated that two individuals use separate user IDs and passwords to complete an electronic wire transfer. According to court documents, the title company twice declined this safety measure, citing a preference for convenience and that the employee who handled wire transfers was in the office by herself. In March 2010, hackers stole the title company’s online banking ID and password and made the unauthorized wire transfers to a corporate bank account in Cyprus.
This ruling is important to title professionals with escrow trust accounts because unlike consumer accounts, banks have the ability to shift liability for fraudulent transfers out of a business account, according to Steve Gottheim, ALTA’s legislative and regulatory counsel.
The Eighth Circuit ruling highlights the importance of implementing ALTA’s “Title Insurance and Settlement Company Best Practices.” The second pillar of the Best Practices encourages appropriate and effective escrow controls and staff training to help title and settlement companies meet client and legal requirements for the safeguarding of client funds. These procedures help ensure accuracy and minimize the exposure to loss of client funds. The pillar encourages the use of positive pay or reverse positive pay, automated clearing house blocks and international wire blocks, if available.
In addition, the third pillar offers guidance to implement a written privacy and information security program.
“This is why proper network security is important, but also utilizing all the security processes offered by the bank and to encourage them to offer processes not currently available,” Gottheim said. “While international wire transfer blocks are included in the Best Practices, they are not universally available by all commercial banks. Interestingly, in this case there is a discussion of an email conversation between the escrow company and bank about the possibility of foreign wire blocks which were not available. Rather than press the issue with the bank, the escrow company dropped it. Part of the courts holding is that by dropping the issue, the email cannot be considered an instruction to the bank. If it had been an instruction then the bank would be liable.”
Choice Escrow said that it sent an email in November 2009 to BancorpSouth instructing the bank to limit transfers to foreign banks. Attached to the email was a bulletin from Choice Escrow’s underwriter warning of the threat of foreign cyber-criminals stealing funds from escrow/trust accounts and advising that all wiring capabilities to foreign banks be disabled. Choice Escrow contends that BancorpSouth's verification procedures for wire transfers were not commercially reasonable under the Uniform Commercial Code's Article 4A, which is adopted by the state. It also contends the procedures failed to meet the good faith standard outlined by the Federal Financial Institutions Examination Council in its 2005 guidance for Internet banking transactions by not meeting the multifactor authentication requirement. In its 92-page appeal, Choice Escrow claimed that:
Jim Payne, co-owner of Choice Escrow, said his company is considering options and may seek a writ of certiorari from the U.S. Supreme Court. A writ of certiorari is a decision by the Supreme Court to hear an appeal from a lower court. Payne said he’s considering an appeal because the ruling conflicts with a decision by the First Circuit Court of Appeals in PATCO Construction Inc. vs. People's United Bank.
In PATCO, the appeals court held the bank liable for fraudulent ACH transfers. In this situation, however, the commercial client used every security system the bank made available, unlike Choice Escrow, which declined dual control verification procedures for wire transfers. The First Circuit held that under article 4 of the UCC the community bank could not shift the liability of loss to the commercial customer because the online banking security program was not commercially reasonably. Additionally, the court suggested that a bank’s security system should compare in sophistication to other similarly situated banks.
“This is another good reason for commercial clients such as title companies to push banks to adopt stronger security programs like international wire blocks, variants of positive pay and voice authentication,” Gottheim said.