On March 26, the U.S. Court of Appeals for the Fourth Circuit reversed and remanded a lower court’s decision in a case involving a fraudulent email scam that caused a financial loss of over $550,000. The plaintiff, a metal fabricator, received an email, purportedly from its steel supplier, advising of a bank change and providing new account details for ACH payments. The plaintiff redirected four payments totaling over $550,000 to the “new account” at a credit union, only to discover the email was fraudulent and the funds were redirected to an account controlled by scammers. The plaintiff claimed the credit union (the defendant) was liable under § 4A-207 of the UCC for completing the funds transfers to an account for which the name did not match the account number.

The district court initially ruled in favor of the plaintiff, awarding $558,868.71 plus attorney fees and costs, finding the credit union failed to act in a commercially reasonable manner or exercise ordinary care in allowing the withdrawal of significant funds over a month. The court noted that reasonable routines could have alerted the credit union to the misdescription and possible fraud upon the posting of the first ACH transfer.

The 4th Circuit reversed the decision, however, concluding the credit union deposited the ACH payments into the account specified in the plaintiff’s ACH payment order, even though the account was not held by the intended beneficiary. Under UCC § 4A-207, “[t]he beneficiary’s bank need not determine whether the name and number refer to the same person” and can deposit funds into an account so long as the credit union “does not know that the name and number refer to different persons.” Based upon this language and the overall purpose of the UCC in promoting efficiency, the 4th Circuit held that the credit union had no actual knowledge of the misdescription at the time the deposits were made, and thus had no liability for making the deposits.