Court Finds That Use of Single–factor Password Identification to Secure Online Accounts May Create Negligence Liability

Court finds that use of single–factor password identification to secure online accounts may create negligence liability

On 21 August 2009, in the case of Shames-Yeakel v. Citizens Financial Bank, No. 07 C 5387 (N.D. Ill.), the Northern District of Illinois denied, in part, a bank's motion for summary judgment regarding its customers' claims that they were damaged because of the bank's negligent use of single-factor password authentication for online transactions. Specifically, the plaintiffs, Marsha and Michael Shames-Yeakel, were customers of defendant Citizens Financial Bank (Citizens) and fell victim to identify theft when a hacker gained access to their online account and stole US$26,500 from a home equity credit line. When plaintiffs refused to pay Citizens for the loss, the bank reported their account as delinquent to the national credit bureaus and threatened to foreclose on the plaintiffs' residence. The bank in part relied upon its "Online Banking Application" which stated that the bank "will have no liability to you for any unauthorized payment or transfer including wire transfer made using your password that occurs before you have notified us of a possible unauthorized use and we have had a reasonable opportunity to act on that notice." In response, the plaintiffs brought an action alleging violations of the Truth in Lending Act, Fair Credit Reporting Act, and negligence. Regarding the plaintiffs' negligence claim, the Court noted that courts have recognized that fiduciary institutions have a common law duty to protect their customer's confidential information against identity theft. The bank had contracted with a third party "Fiserv" to provide its online banking services and the bank's online accounts were protected by means of a user name and password, or "single-factor identification." The plaintiffs argued that the bank was negligent in failing to implement "multifactor identification," which checks against multiple data points beyond user ID and password. Such multifactor identification, the plaintiffs argued, could have included the banks use of hardware tokens to generate single use passwords. To support their contentions, the plaintiffs relied upon, among other things, a 2005 document authored by the Federal Financial Institutions Council (FFIEC) entitled "Authentication in an Internet Banking Environment", which provides that "agencies consider single-factor authentication, as the only control mechanism, to be inadequate for high risk-transactions involving access to customer information or the movement of funds to other parties." Accordingly, the Court found that a reasonable finder of fact could conclude that the bank was negligent by breaching its duty to protect plaintiffs' account against fraudulent access.