Fourth Circuit Limited Bank Liability in Business Email Fraud

In 2024, the US Court of Appeals for the Fourth Circuit reversed a district court’s decision regarding email fraud in Studco Building Systems, US v. 1st Advantage Federal Credit Union.

In a recent blog, Troutman Pepper Locke notes that the ruling reinforces the chain-of-loss principle in funds transfer litigation, guiding future claims toward the originator’s own bank.

The Fourth Circuit held 1st Advantage liable for losses stemming from a business email compromise scam. The lower court had awarded more than $550,000 in damages to Studco after fraudulent automatic clearing house (ACH) transfers were sent to an incorrect account.

However, the Fourth Circuit concluded that 1st Advantage lacked “actual knowledge” of the mismatch between the beneficiary name and account number, and thus could not be held liable under the Uniform Commercial Code (UCC).

The case arose when Studco received a fraudulent email requesting that ACH payments be redirected to a new account at 1st Advantage. Unaware of the scam, Studco initiated multiple transfers to that account.

1st Advantage’s system flagged name/account mismatches but generated these alerts at a high volume without review. Studco sued under UCC § 4A-207, negligence, and bailment theories.

The district court sided with Studco, finding 1st Advantage commercially unreasonable for failing to detect the fraud.

The Fourth Circuit reversed, holding that under UCC § 4A-207, liability attaches only if the beneficiary’s bank has “actual knowledge” of a mismatch between the name and account number. Internal automated alerts did not meet this threshold.

The court emphasized the impracticality of requiring banks to verify every mismatch and dismissed the bailment claim, noting that electronic funds transfers do not create a custodial relationship under Virginia law.

This decision limits the liability of receiving banks in email fraud cases involving payment misdirection, unless actual knowledge can be proven. Lawyers should instruct their clients to maintain rigorous internal controls, verify payment instructions independently, and understand the limitations of redress under the UCC.