Court: Passwords + Secret Questions = ‘Reasonable’ eBanking Security
Summary: A Maine magistrate recommended that a U.S. district court rule against Patco Construction in its suit against Ocean Bank, finding the bank's user name, password and challenge-question login was 'commercially reasonable' security. Patco had sued to recover a net loss of $345,445 after the ZeuS trojan stole its online banking credentials and the thieves pushed $588,000 in fraudulent ACH transfers over seven days, of which the bank blocked or clawed back $243,406.
Why it matters: The magistrate accepted a device ID as satisfying the FFIEC's 'something the user has' factor and was unswayed by evidence that ZeuS can rewrite browser content and tunnel through the victim's own machine, so a small business's recovery may now turn on whether its bank's controls clear a bar set by 2005 guidance.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026