Patco Construction Co. v. People's United Bank is the 2012 First Circuit decision that held a bank's online banking security procedures were not commercially reasonable under UCC Article 4A. Over seven days in May 2009, fraudsters used a small construction company's stolen credentials to take $588,851.26; the bank's own risk system flagged every withdrawal as unusually high-risk, and the payments went through anyway. The court reversed summary judgment for the bank. Two cases decided around it, Experi-Metal v. Comerica and Choice Escrow v. BancorpSouth, show the other ways these disputes turn: a bank that followed a reasonable procedure but could not prove good faith, and a bank that won because its client had refused a stronger procedure in writing. The thread through all three is evidence, and it is why Botminds' Treasury Management Agreement Search answers every disputed payment with two sides: the procedure the client signed, from the version in force that day, and what the payments hub shows happened.
Every fact below is from the courts' own opinions, linked where it is used. The sample screens come from a fictional bank running the solution.
Three cases side by side: what happened, what turned it, who carried the loss
Patco Construction v. People's United Bank
1st Cir., July 3, 2012
What happenedSix withdrawals over seven days in May 2009, $588,851.26, made with the client's stolen credentials and challenge answers; $345,444.43 not recovered.
What turned itThe bank's system flagged every transfer as high-risk and nobody looked. Challenge questions on every transaction from $1 up.
ResultProcedures commercially unreasonable; summary judgment for the bank reversed.
Experi-Metal v. Comerica Bank
E.D. Mich., June 13, 2011
What happened93 wires totalling $1,901,269 in about six and a half hours on January 22, 2009 after an employee answered a phishing email; $561,399 not recovered.
What turned itReasonable procedure, followed. But the bank offered no evidence of the standards of fair dealing for responding to an attack like this one.
ResultBank failed the good-faith test; judgment for the client with interest from the day of the orders.
Choice Escrow v. BancorpSouth Bank
8th Cir., June 11, 2014
What happenedOne $440,000 wire to Cyprus on March 17, 2010, sent with an employee's compromised credentials.
What turned itThe client had declined dual control and signed a waiver, then declined it again by email four months before the fraud.
ResultProcedures commercially reasonable; loss on the client, and the bank may pursue its attorney's fees.
What happened in Patco Construction v. People's United Bank?
Patco, a construction company in Sanford, Maine, added online banking to its commercial account at Ocean Bank, a division of People's United, in 2003, and used it mainly for weekly payroll. Its payments had a pattern the court spelled out: always Fridays, always from a computer in Patco's offices, from a single static IP address, and never larger than $36,634.74. In May 2009 someone with Patco's user ID, password and the answers to its challenge questions began withdrawing money to accounts the company had never paid (Patco, 1st Cir. 2012).
The bank's system scored each transfer as high-risk because it was "inconsistent with the timing, value, and geographic location of Patco's regular payment orders," but it "did not notify its commercial customers of this information and allowed the payments to go through." Six withdrawals took $588,851.26. The bank blocked or recovered $243,406.83, "leaving a residual loss to Patco of $345,444.43." The district court granted summary judgment to the bank; the First Circuit reversed.
How one setting change put Patco's challenge answers on every payment
- Challenge questions above $100,00010 mo
- Challenge questions above $1: every transaction11 mo
- Before January 20085 mo
- People's United using tokens; Ocean Bank not16 mo
What did the First Circuit decide in Patco, and why?
It held that the bank's security procedures were not commercially reasonable, and it was explicit that no single failure did it. When the bank lowered the trigger for challenge questions from $100,000 to $1, every Patco payment prompted the same answers. Patco argued that this "increased the risk that such answers would be compromised by keyloggers or other malware," and the court found the argument "supported both by evidence and by common sense." The bank added no other control in tandem, did not monitor the risk reports its system produced, did not call the customer, and had not adopted tokens, although its parent had used them since at least January 2008. The court called the bank's approach a "generic 'one-size-fits-all' approach to customers" that "violates Article 4A's instruction to take the customer's circumstances into account."
"The transactions generated unprecedentedly high risk scores ranging from 563 to 790, well above Patco's regular risk scores which ranged from 10 to 214. These collective failures, taken as a whole, rendered Ocean Bank's security procedures commercially unreasonable."
Patco Construction Co. v. People's United Bank, 1st Cir., July 3, 2012
The court made the same point a second time, stressing that it was the failures together, not any one of them, that decided the case; that passage, and what it means for a bank's own policy, is in the corporate account takeover policy guide.
Two parts of the decision are often missed. The court did not decide Patco's own duties: it left open "what, if any, obligations or responsibilities Article 4A imposes on Patco" and sent that question back to the district court. And the agreement itself was in play. Patco argued that the security procedures in "Schedule A" of the ACH agreement it signed did not, by their express terms, apply to its online banking transfers, and it disputed whether a modified online agreement shifting monitoring duties to it had been published before the fraud. Both are document questions; how the version in force is established deals with the second.
What is a commercially reasonable security procedure after Patco?
One that fits the particular customer and is actually operated, not one that is merely state of the art. The First Circuit quoted the official commentary to the uniform act: "[t]he standard is not whether the security procedure is the best available. Rather it is whether the procedure is reasonable for the particular customer and the particular bank." Article 4A's text lists what a court weighs: the customer's expressed wishes, its circumstances as the bank knew them, including the size, type and frequency of its usual payment orders, the alternatives offered, and the procedures in general use by similar customers and banks (UCC §4A-202(c)).
Patco turned on the second factor. The bank knew Patco's pattern, its system measured departures from it, and it built nothing that acted on the measurement. The commercially reasonable test, factor by factor sets out how each element is read.
Experi-Metal v. Comerica: good faith as a separate test
A reasonable procedure, followed to the letter, is not the end of the bank's burden. On January 22, 2009, an Experi-Metal employee answered a phishing email; between 7:30 a.m. and 2:02 p.m., ninety-three fraudulent payment orders totalling $1,901,269 went out on his credentials, most to banks in Russia and Estonia, and Comerica recovered all but $561,399 (Experi-Metal, E.D. Mich. 2011). The court had already found the bank's procedure commercially reasonable, and after trial it found the bank complied with it. The remaining question was good faith, defined as "honesty in fact and the observance of reasonable commercial standards of fair dealing."
Comerica lost on the second half of that definition. The court noted that the criminal had created $5 million in overdrafts in an account "that usually has a zero balance," with ten transactions entered "repetitively (many in less than a minute of each other)." It held that the bank had to present evidence of what reasonable commercial standards of fair dealing required in responding to an attack like this one, and it "presented no such evidence." Judgment followed for $561,399 plus costs and statutory interest running from the day of the orders (judgment, July 7, 2011). The bank carried a burden of proof about its own conduct and had nothing to carry it with.
Choice Escrow v. BancorpSouth: the waiver that decided the case
Choice Escrow is the case banks cite when they win, and it was won on paper. BancorpSouth offered passwords, device authentication, daily transfer limits and dual control. Choice declined the limits and declined dual control, and "BancorpSouth required that customer to sign a waiver acknowledging that it was waiving dual control." In November 2009 Choice forwarded a phishing warning and asked whether foreign wires could be blocked; the bank replied that it could not block only foreign wires, that "the solution is dual control," and asked again whether Choice wanted it. Choice declined again (Choice Escrow, 8th Cir. 2014).
On March 17, 2010, a $440,000 order to Cyprus passed the procedures Choice had kept. The Eighth Circuit held the bank's procedures commercially reasonable; found that the November email was an "inquir[y]," not an instruction the bank had to follow; found the bank accepted the order in good faith; and left the loss on Choice. It also rejected Choice's argument that the bank should have screened each payment by its size and type: Article 4A "instructs the court to consider these factors in determining if a bank's security procedure is commercially reasonable," not the bank to apply them order by order. And it let the bank pursue its attorney's fees under the indemnity in the agreement.
Patco and Choice Escrow: the same question, opposite evidence
Patco (bank lost): Challenge questions on every transaction; e-mail alerts the court found "not readily visible."
Choice Escrow (bank won): Passwords, device authentication, daily limits and dual control, each explained.
Patco (bank lost): Disputed: Patco argued it was never offered, and never declined, an e-mail notice system.
Choice Escrow (bank won): Dual control, refused with a signed waiver, then refused again in writing in November 2009.
Patco (bank lost): Flagged every fraudulent transfer as high-risk; nobody reviewed the reports.
Choice Escrow (bank won): Executed an order that passed the procedures the client kept, with no independent reason to suspect it.
Patco (bank lost): A schedule whose scope was disputed, and a modified online agreement whose publication was disputed.
Choice Escrow (bank won): A signed waiver and an email trail the court could quote word for word.
Who wins unauthorized wire cases?
In these three, the side whose evidence matched what Article 4A asks. Article 4A starts by putting the risk of an unauthorized order on the bank and lets the bank shift it only by proving a commercially reasonable procedure, agreed with the client, followed in good faith (UCC §4A-202(b)). Patco's bank could not show a procedure that fitted the customer it knew; Comerica could not show what fair dealing required of it; BancorpSouth could show exactly what it offered, what Choice refused and when.
What was taken, and what each loser carried
What the three files had in common
Each case was decided on documents and logs that existed before the fraud. In Patco: the dollar-amount setting and its history, the risk reports nobody read, the scope of Schedule A, the website's version of the online agreement. In Experi-Metal: the declarations and implementation forms that made an employee an authorized user, and the overdraft history that showed what was normal for the account. In Choice Escrow: the waiver and two emails. None of those cases needed new facts; each needed someone to put the agreed procedure beside what actually happened.
That comparison is also how a bank finds its own Patco before a client does. In the sample bank running the solution, the same question asked of every client overnight finds 148 of 21,400 clients whose payments do not move the way their agreements say: 61 need a second approver above a limit but entitle only one, 44 were released above a limit their schedule never raised, and 43 require a verification call the hub has never recorded.
When the two sides do not match, the answer says so
What a bank should be able to produce tomorrow
For any business client, on any date: the security procedure in force and the signed page it sits on; every alternative the bank offered and any written refusal; the authorized users and the tokens issued to them; and for any disputed payment order, the entry, release, token and limit events from the payments hub, with any override and its reason. The courts asked for exactly those things in all three cases. Banks that had them in a folder still had to find them, date them and compare them under a deadline.
The same question asked of every client, every night
What Treasury Management Agreement Search adds to the casebook
The solution does not decide whether a procedure is commercially reasonable or whether a bank acted in good faith; those are questions of law and fact for Legal and, if it comes to it, a court. What it does is assemble the evidence those questions turn on, from the version of the agreement in force on the payment date and the payments hub's record of the order, and say in one line whether they match. The full product is at Treasury Management Agreement Search, and what a slow answer on a disputed wire costs prices the alternative.
Questions people ask
What was the Patco decision?
On July 3, 2012 the First Circuit held that Ocean Bank's security procedures were not commercially reasonable under Article 4A as Maine enacted it, reversed summary judgment for the bank and remanded. It left open what duties, if any, Article 4A places on a commercial customer like Patco.
Did Patco get its money back?
The First Circuit's opinion does not say; it sent the case back to the district court for further proceedings, including on Patco's own obligations and on mitigation. What the opinion does record is that the residual loss at issue was $345,444.43 after the bank blocked or recovered $243,406.83.
Why did the bank lose in Experi-Metal if its procedure was reasonable?
Because Article 4A also requires the bank to prove it accepted the orders in good faith, which includes observing reasonable commercial standards of fair dealing. The court found Comerica presented no evidence of what those standards required in responding to the attack, so it could not carry that burden.
Why did the client lose in Choice Escrow?
Choice had been offered dual control, refused it, signed a waiver and refused it again in writing four months before the fraud. The Eighth Circuit held the bank's procedures commercially reasonable and found the bank followed them in good faith, so the $440,000 loss stayed with Choice.
Is Patco binding outside Maine?
Patco is a First Circuit decision applying Maine's enactment of Article 4A, so it binds federal courts in that circuit on Maine law. Because Article 4A is a uniform act, other courts read it, as the Eighth Circuit did when it cited Patco in Choice Escrow.