US Appeals Court Ruling: Receiving Banks Not Liable to Scam Victims

Bank can rest easy with the Studco 1st Advantage Federal Credit Union district court case overturned by the United States Court of Appeals for the Fourth Circuit.

The good news for banks is that on March 26, 2025, the Fourth Circuit Court of Appeals reversed the previous District Court opinion.  The receiving bank, in Studco Vs 1st Advantage Federal Credit Union, was found not liable for the Business Email Compromise funds transfer. 

This case involves a company, Studco Building Systems, who was a victim of a Business Email Compromise.  Studco directed its bank, JPM Chase to send ACH transactions to an account at 1st Advantage Federal Credit Union. In the initial lawsuit, Studco sued 1st Advantage Federal Credit Union alleging they made mistakes in processing the ACH transaction and the credit union should reimburse Studco for the loss.  The appeals court overturned the original district court decision in favor of Studco by saying:

The privity requirement applies “only between the parties to a particular payment order and not to the parties to the funds transfer as a whole”. “So, a sender of a payment may “seek refund only from the receiving* bank (JPM Chase Bank) it paid” and may not “skip over the bank with which it dealt directly, and go to the next bank (1st Advantage Federal Credit Union) in the chain.”

*UCC 4A term for the sending bank (the customer’s bank).

So, this means that Studco cannot sue 1st Advantage Federal Credit Union, the bank with the money mule account.  The appeal court decision is based on the Uniform Commercial Code (UCC) 4A. 

Let’s now get into the details so the reader can understand why the appeals court made its decision and specifically what the ‘privity requirement’ is in UCC 4A.  This article will include key language from the appeals court decision to help the reader better understand why the decision was made and what this means to financial institutions that deploy controls (e.g. ACH controls, money mule controls) on the receiving bank side of bank operations.

The Case Details

Note: as I describe the remainder of this decision, I will use Uniform Commercial Code (UCC) 4A definitions for Studco Building Systems, the victim and customer of JPM Chase Bank, JPM Chase Bank and for 1st Advantage Federal Credit Union.  In UCC 4A, the receiving bank is the bank of the customer initiating the transaction.  In general banking terminology, the receiving bank is the bank that receives the transaction from a sending bank and posts it to the account at the receiving bank as directed by the transaction instructions from the customer of the sending bank.

UCC 4A Definitions

Studco Building Systems (“Studco)- the sender of the financial transaction and the customer of the receiving bank (the bank that ‘received’ the transaction request from the sender)

JPM Chase Bank- The receiving bank. Studco was a customer of JPM Chase.

1st Advantage Federal Credit Union- The beneficiary bank (where the transaction was received from the receiving bank and posted to the account at the beneficiary bank).

The Facts

• Article 4A of the UCC defines the exclusive rights and duties of financial institutions with respect to commercial ACH funds transfers.

• In October 2018, Studco received an email purported from Olympic Steel advising Olympic Steel was changing banks to a credit union.

• Studco did not verify the emails or the bank changes to confirm instructions.

• Shortly thereafter, Studco sent commercial ACH transaction to the credit union, with the name of Olympic Steel as the account name on the ACH transactions.

• The credit union is located in Virginia and Olympic Steel is located in Ohio.

• The amounts totaled over $550,000.

• It turned out the email purportedly from Olympic Steel was fraudulent and Studco lost the money.

• “According to the unrebutted testimony of 1st Advantage and the district court’s finding, the (1st Advantage)” DataSafe system generated hundreds to thousands of warnings related to mismatched names on a daily basis, but the system did not notify anyone when a warning was generated, nor did 1st Advantage review the reports as a matter of course.”

• The four (Studco) ACH funds transfers were automatically deposited into the account associated with the number specified on Studco’s ACH funds transfer order, the xxx4713 account at 1st Advantage. The reports generated for those deposits automatically included a warning of the mismatch: “Tape name does not contain file (account) last name TAYLOR.” The evidence at trial showed that no one at 1st Advantage read any of these DataSafe deposit reports or the warnings on them before 1st Advantage first learned of the scam from the president of Studco on November 21, 2018.

• Two attempted wire transfers by the owner of the account at the beneficiary bank caused an Office of Foreign Asset Control (OFAC) alert to be created.

The Initial Lawsuit

Studco sued 1st Advantage Federal Credit Union.  Studco claimed “that if 1st Advantage had handled the transfers in a commercially reasonable manner, the loss would have been avoided”.  Studco alleged:

• that 1st Advantage was liable for failing to refuse the ACH deposits directed to Lesa Taylor’s account (account at the beneficiary bank where the funds were deposited) because the payment orders were to deposit them into the account of “Olympic Steel Inc,” not Lesa Taylor (a ‘misdescription’ claim).

• It also alleged that 1st Advantage accepted the ACH deposits as a bailment and failed, as a bailee, to act with reasonable care.

• it alleged six additional counts, including claims for conversion, fraud, and a civil RICO violation under 18 U.S.C. § 1961

The District Court Decision January 2023

The District Court “entered judgment in favor of Studco, awarding it $558,868.71, plus attorney’s fees and costs. The court grounded the relief on Studco’s UCC 4A § 8.4A-207 misdescription claim and its breach of bailment claim. The court found that 1st Advantage failed to act “in a commercially reasonable manner or exercise ordinary care in allowing [the withdrawal of] six-figures over the course of a month”.

The District Court:

• ruled in favor of Studco on the misdescription and bailment claims and ruled in favor of 1st Advantage on the fraud claim.  On the misdescription claim the court said:

  • It is clear from the evidence presented that 1st Advantage did not maintain any routines, let alone reasonable routines, for communicating significant information to the person conducting the transaction.

  • If 1st Advantage implemented reasonable routines for communicating information, the identification discrepancy recognized at the opening of the Account, the numerous alerts generated by the ACH transfers describing the misdescription of the Account, and the fact that Olympic Steel could not open an account at 1st Advantage would have alerted 1st Advantage to the misdescription and possible fraud upon the posting of the first ACH transfer.

  • The district court correctly recognized that 1st Advantage could only be held liable for deposits into misdescribed accounts if it had actual knowledge of the misdescription, and it ruled in favor of Studco, finding that 1st Advantage had actual knowledge because it should have, with “due diligence,” had such knowledge.

  • as to the bailment claim, the court ruled that “1st Advantage did not act in a commercially reasonable manner or exercise ordinary care in allowing Taylor to withdraw six-figures over the course of a month.”

  • 1st Advantage Federal Credit Union immediately appealed.  A key point in the appeal from The Clearing House and NACHA, as friends of the court:

• (The decision) flouts Article 4A’s liability regime, under which the duties of a beneficiary’s bank run only to those with whom it is in privity through the receipt of a payment order; the beneficiary’s bank has no duties to the sender of a prior payment order (as Studco was here). Further, under Article 4A, a beneficiary’s bank is potentially liable only when it has actual knowledge that a payment order misdescribes a beneficiary and such liability runs only to the party that sent the payment order to the beneficiary’s bank, which generally is not, and in this case was not, the originator (the sender).

The Fourth Court of Appeals Reversal March 2025

1st Advantage Federal Credit Union argued “that it is not liable under § 8.4A-207(b), because it lacked actual knowledge of the difference between the beneficiary’s name of the account and the account number at the time the deposit was made.”

The Appeals Court commented:

• “When the payment order provides an account name that does not match the account number, as in this case, there is a ‘misdescription of beneficiary’ as to which § 8.4A-207 specifies the rights and duties of the parties.”

• “Section 8.4A-207(b)(1) provides, as applicable here, that, “if a payment order received by the beneficiary’s bank identifies the beneficiary both by name and by an identifying or bank account number and the name and number identify different persons” and if “the beneficiary’s bank does not know that the name and number refer to different persons,” the beneficiary’s bank “may rely on the number as the proper identification of the beneficiary of the order.””

• “Thus, the provision protects the beneficiary’s bank from any liability when it deposits funds into the account for which a number was provided in the payment order, even if the name does not match, so long as it “does not know that the name and number refer to different persons.””

• “And in this context, “‘knowledge’ means actual knowledge,” not imputed knowledge or constructive knowledge”

• “The beneficiary’s bank therefore has no duty to adopt reasonable routines to check for conflicting names.”

• The Court also said: “Allowing the beneficiary bank to deposit transferred funds automatically, based only on account number, promotes efficiency and certainty to the system.”

The Fourth Court of Appeals reversed the district court decision saying: “1st Advantage deposited the ACH payments into the account with the number specified in Studco’s ACH payment order, even though that account was not in fact held by Olympic. Under those circumstances, a bank such as 1st Advantage has no liability under § 8.4A-207 unless it had actual knowledge of the misdescription. Because there was no evidence of actual knowledge presented in this case, it was an error for the court to have held 1st Advantage liable on a finding of negligence or commercial unreasonableness. It was also error for the court to have concluded that Studco’s ACH deposit of funds into the 1st Advantage account was a bailment, subjecting 1st Advantage to bailment liability.”

The Courts reasons:

• “Studco did not verify the emails or the bank change to confirm the instructions, even though the communications contained several indicators of the emails’ inauthenticity.”

• “According to the unrebutted testimony of 1st Advantage and the district court’s finding, the (1st Advantage” DataSafe system generated hundreds to thousands of warnings related to mismatched names on a daily basis, but the system did not notify anyone when a warning was generated, nor did 1st Advantage review the reports as a matter of course.”

• “Thus, if the beneficiary’s bank deposits the funds into the account associated with the number designated in the payment order and it has no knowledge of any misdescription at the time of the deposit, it has no further liability. In these circumstances, the Uniform Commercial Code places the “risk of loss” on the person who dealt with the thief — in this case Studco — “whose remedy is against” the recipient of the funds (at the beneficiary bank) (Lesa Taylor), the thieves (the unidentified scammers), or potentially the receiving bank (JPMorgan Chase).”

• “Because the evidence showed that no individual at 1st Advantage had actual knowledge of the mismatch of name and account number when the ACH deposits were correctly made into the account numbered xxx4713, as directed by the payment order, we reverse the district court’s judgment on Studco’s misdescription claim under Virginia Code § 8.4A-207.”   The actual knowledge requirement means that an “individual” employee at the bank must have actual knowledge of the misdescription at the time of deposit.

• “There are sound policy reasons for limiting the right to seek a refund to the sender who directly paid the receiving bank.”

• Under Virginia law, “a general deposit in a bank is ‘not a bailment.’” So, no bailment was created.  

• There was one additional comment by a second appeal judge around 1st Advantage having created an OFAC alert:

• “The evidence indicates that 1st Advantage may have received actual knowledge of a misdescription prior to Studco’s final two deposits. On October 25, 2018, Lesa Taylor’s two attempted overseas wire transfers triggered a federal Office of Foreign Assets Control alert, so 1st Advantage cancelled those transfers and (apparently unsuccessfully) suspended future wire transactions.

• In the second circuit judge’s opinion, a factfinder could infer that (the OFAC) investigation led to a 1st Advantage employee obtaining actual knowledge of a misdescription between account name and number prior to Studco’s (final) two November deposits. Nonetheless, I (the second judge) agree with reversing the district court’s judgment and granting summary judgment to 1st Advantage because the UCC’s misdescription provision imposes a privity requirement. The privity requirement applies “only between the parties to a particular payment order and not to the parties to the funds transfer as a whole”. “So, a sender of a payment may “seek refund only from the receiving bank it paid” and may not “skip over the bank with which it dealt directly, and go to the next bank in the chain.””

• The second judge went on to say: (according to UCC 4A Section 402)” if a payment order was improper—as Studco alleges here—the bank receiving payment is obliged to refund the payment to the sender (here, Studco).  The catch is that the UCC defines the receiving bank (i.e. the bank receiving payment) as “the bank to which the sender’s instruction is addressed”—which, from Studco’s perspective, is Studco’s bank, JPMorgan Chase, and not 1st Advantage.”

What This Means for Banks

In this case, 1st Advantage Federal Credit Union as the beneficiary bank, is not liable for Studco’s loss.  Two key points were:

• 1st Advantage had no actual knowledge of the misdescription of the ACH transaction.

• 1st Advantage was not in the chain of any potential recovery (the privity requirement)—JPM Chase Bank was in the chain.

Based on the court’s assessment, the “privity requirement” appears to trump all else.  This is probably the best news of this reversal opinion.  This effectively mean that beneficiary banks cannot be liable for losses in the situation described in this paper.  The decision around privity is so key and possibly removes any future issues around “actual knowledge”, given the second appeal judge’s comments when they said a factfinder could infer there was “actual knowledge” of a misdescription by the beneficiary bank because of the OFAC investigation, but the “privity requirement” applies and, in effect, overrides the ‘actual knowledge” issue.

This ruling will also be good confirming news for NACHA, given its new requirements for beneficiary banks (receiving banks in NACHA’s terms) to add controls to prevent money mule activity.

As mentioned at the beginning, the reader must use their own attorney to opine on this ruling and decide how this affects your financial institution.

Note: the author is not an attorney and the paper should not be construed as a legal opinion.  The reader should use their own attorney for a legal assessment of this discussion.

This article was commissioned by Biocatch as part of a new series on receiving bank fraud and money mule controls. To see previous articles and blogs by Biocatch, go to https://www.biocatch.com/blog