Choice Escrow & Land Title, LLC v. BancorpSouth Bank

Majority - Wollman, Circuit Judge

Yes, UCC Article 4A allocates the risk of loss for a fraudulent wire transfer to Choice, the customer, because BancorpSouth's security procedures were commercially reasonable, and the bank accepted the payment order in good faith and in compliance with those procedures and Choice's instructions. Furthermore, yes, the indemnification agreement for attorney's fees is enforceable as it does not conflict with Article 4A. The court first addressed the allocation of the $440,000 loss under Article 4A, which generally places the risk of fraudulent payment orders on the bank unless specific conditions are met: (1) the security procedure is commercially reasonable, and (2) the bank accepted the order in good faith and in compliance with the procedure and customer instructions (Miss. Code Ann. § 75-4A-202(b)). The court found BancorpSouth's security procedures (password, PassMark, optional daily limits, optional dual control) commercially reasonable. It clarified that "security procedures" include measures agreed upon and those offered but declined by the customer if a waiver is signed. The court determined that PassMark, though not explicitly in written contracts, was established by agreement through its mandatory use and inclusion in online manuals. In assessing commercial reasonableness, the court considered factors like customer wishes, circumstances, alternative procedures, and general industry use (Miss. Code Ann. § 75-4A-202). It rejected Choice's argument for "transactional analysis" as a mandatory part of a commercially reasonable procedure, noting Article 4A's flexibility. The court relied on the 2005 FFIEC Guidance recommending multifactor authentication (something known, something possessed) and found BancorpSouth’s password and PassMark system met this. Crucially, BancorpSouth's offer of dual control, which addressed evolving cyber threats, further supported commercial reasonableness, especially since Choice declined it and signed a waiver. The court dismissed Choice's claim that dual control was unsuitable, noting that simultaneous approval wasn't required and Choice could have authorized more users. Next, the court found BancorpSouth acted in good faith, which requires "honesty in fact and the observance of reasonable commercial standards of fair dealing" (Miss. Code Ann. § 75-1-201(b)(20)). While Choice conceded BancorpSouth's honesty, it challenged the observance of commercial standards. The court stated this inquiry focuses on the bank's discretionary aspects and its adherence to established procedures consistent with reasonable expectations. It found BancorpSouth's employees routing orders after security clearance, without further manual review for suspicious activity, was normal banking practice, especially given the high volume of transfers. The fraudulent memo line ("invoice:equipment") was not sufficiently suspicious to indicate bad faith. Finally, the court concluded BancorpSouth complied with Choice's instructions. It rejected Choice's argument that BancorpSouth admitted violating an instruction to limit foreign transfers, interpreting Jim Payne's email as an inquiry, not a binding instruction, which Choice did not press after BancorpSouth stated it was "unable to stop just foreign wires." Regarding attorney's fees, the court reversed the district court's dismissal. It held that Article 4A does not preempt all common law claims but only those creating rights or liabilities inconsistent with its provisions or specifically covered by it. Article 4A contains no provisions allocating attorney's fees. An indemnification provision for attorney's fees, distinct from "damages, losses, and liabilities" directly related to the fraudulent transfer, is not inconsistent with Article 4A's risk allocation and is therefore enforceable.