Fourth Circuit: No Bank Liability For Accepting ACH Transfer Unless Actual Knowledge of Account Misdescription

Introduction 

This month we review a critical recent victory for banks and other depository institutions regarding liability for fraudulent account activity.  In Studco Bldg. Sys v. 1st Advantage Federal Credit Union,[1] the Fourth Circuit Court of Appeals, which hears appeals from federal courts in Virginia, ruled that a credit union was not liable for accepting ACH transfers in which the name of the payment beneficiary and the account number included therein did not identify the same person, because the account number was valid and the bank did not have “actual knowledge” of the discrepancy.  The ruling overturned a judgment of over $558,000.00 against the credit union that accepted multiple ACH transfers that were part of a scheme orchestrated by scammers.  The Fourth Circuit’s ruling concerns only Virginia law and as of this writing is still subject to being appealed to the U.S. Supreme Court.

The Facts

Scammers hacked into the email system of Studco Building Systems (“Studco”), a metal fabricating business located in New York. The scammers sent emails to Studco in which they posed as Olympic Steel (“Olympic”), a supplier to Studco located in northern Ohio.  Those emails told Studco that Olympic was changing banks, directed that future ACH payments to Olympic be sent to its new account at 1st Advantage Federal Credit Union in Newport News, Virginia (the “Credit Union”), and provided the number of the new account.

The emails had telltale signs of fraud.  For example, (a) they originated from the domain name “Olysteel.net” even though Olympic’s domain name was “Olysteel.com”, (b) the “sender” email address did not match the email address in the signature block of the email, and (c) they were full of grammatical errors.  Further, as the Fourth Circuit noted, there was the oddity of a business located in northern Ohio having its account at a credit union in Newport News.

Nonetheless, Studco did not try to verify the authenticity of the emails and began processing Olympic’s invoices by making ACH transfers to the account at the Credit Union.  Those transfers referenced “Olympic Steel Inc” and the account number the scammers had provided.  

The ACH transfers were automatically and electronically deposited into the account at the Credit Union with the referenced account number.  That account number was valid, but it did not belong to Olympic.  Rather, it belonged to a woman named Lesa Taylor, a longtime customer of the Credit Union who had also been duped by the scammers. Ms. Taylor had answered an advertisement for employment as an assistant to real estate professionals.  As part of her employment, she had agreed to use her account at the Credit Union for real estate transactions, and she believed the deposits and withdrawals from her account were for legitimate business.

The Credit Union had a “DataSafe” system that monitored ACH transfers and generated a warning if the name on a transfer did not match the name on the receiving account, but the system was not designed to notify any person at the Credit Union of a warning, and the Credit Union did not regularly review the reports the system generated.

Eventually, Studco realized that it had been scammed, but only after it had made ACH transfers totaling over $558,000.00 to the Credit Union.  The scammers had already made off with the money, and the FBI was not able to identify them, concluding only that the scam had probably originated in the United Arab Emirates, Nigeria, or Dubai.

The Court Rulings

Studco sued the Credit Union in federal district court, asserting that the Credit Union, in the Fourth Circuit’s words, “could have prevented the loss by adopting ‘basic security standards’ and otherwise acting in a commercially reasonable manner.” Studco pointed to the fact that the ACH payment orders directed deposit of the transfers into the account of “Olympic Steel Inc”, not the account of Lesa Taylor.      

The district court ruled in favor of Studco, awarding it judgment against the Credit Union for over $558,000.00, plus attorney fees and costs.  The district court wrote, in part, that –

“It is clear from the evidence presented that 1st Advantage did not maintain any routines, let alone reasonable routines, for communicating significant information to the person conducting the transaction. If 1st Advantage implemented reasonable routines for communicating information, the identification discrepancy recognized at the opening of the Account, the numerous alerts generated by the ACH transfers describing the misdescription of the Account, and the fact that Olympic Steel could not open an account at 1st Advantage would have alerted 1st Advantage to the misdescription and possible fraud upon the posting of the first ACH transfer.”

On appeal, the Fourth Circuit saw things differently. In the Fourth Circuit’s view, Virginia Code section 8.4A-207(b), which is part of Virginia’s version of the Uniform Commercial Code (“UCC”), definitively resolved the case in favor of the Credit Union.  Under that section, as the Fourth Circuit explained, if an ACH payment order identifies the payment beneficiary by name and by an account number or identifying number but the name and number identify different persons, then the bank can rely on the number as the proper identifier of the payment beneficiary so long as the bank does not know that the name and number identify different persons.

Moreover, as the Fourth Circuit pointed out, (a) section 8.4A-207(b) states that “[t]he beneficiary's bank need not determine whether the name and number refer to the same person”, and (b) “knowledge” by the bank means “actual knowledge, not imputed knowledge or constructive knowledge.”  Regarding the meaning of “knowledge”, the Fourth Circuit relied on the UCC definition of the term, as well as prior court precedent defining actual knowledge to mean subjective recognition of a fact.

In sum, the Fourth Circuit held that the Credit Union (a) had no duty to confirm that the name of the payment beneficiaries in Studco’s ACH payment orders (i.e., “Olympic Steel Inc”) and the owner of the account number in the orders (i.e., “Lesa Taylor”) were the same person, and (b) did not have knowledge that they were not the same, notwithstanding the “DataSafe” system reports, because there was no evidence that anyone at the Credit Union actually knew it.[2] 

In a concurring opinion, one of the Fourth Circuit judges pointed out that the evidence indicated that the Credit Union might have received actual knowledge that the name and account number on Studco’s payment orders did not identify the same person.  The concurring judge noted that Lesa Taylor’s attempts to make some overseas wire transfers had generated an alert from the federal Office of Foreign Assets Control, resulting in the Credit Union’s compliance manager opening an investigation into Taylor’s account focused on wire activity and the account’s history.  The judge wrote that “[i]n my view, a factfinder could infer that [the] investigation led to a 1st Advantage employee obtaining actual knowledge” prior to some of Studco’s deposits. 

A Recent Sequel

On June 13, 2025, a Massachusetts state court dismissed a lawsuit against Truist Bank that resulted from another scam.  In that case, a credit union approved a $475,000.00 mortgage loan for a Mr. Bower, who was under time pressure in connection with buying his ex-wife’s interest in their marital home.  The credit union hired attorney Weinstein to close the loan. Mr. Bower’s lawyer asked Weinstein to issue a check payable to Mr. Bower’s ex-wife.  But someone impersonating Mr. Bower’s lawyer changed the funds-disbursement instructions, resulting in Weinstein wiring funds to an account at Truist that Weinstein believed was the account of Mr. Bower’s lawyer. Then, a person impersonating Weinstein communicated with Mr. Bower’s lawyer to delay his discovery of the fraud. Most of the loan proceeds were gone by the time the fraud was discovered.

Weinstein sued Truist, with the crux of his complaint being that “Truist failed to reject the wire transfer because the name and account number provided by Weinstein were mismatched.”  The court, citing the Studco case, ruled for Truist, writing that UCC section 4A-207(b)(1) –

“explicitly declines to impose a duty on a beneficiary bank to verify that the account name and number on a payment order refer to the same person or business.  The UCC protects the beneficiary bank from liability unless it gains ‘actual knowledge’ of the conflict prior to payment of the beneficiary and nonetheless makes the payment.”[3]

In other words, Weinstein made the same argument that Studco had made in the Fourth Circuit case – that the bank should have noticed that the payment beneficiary name and the account number on the wire transfer did not identify the same person and, therefore, rejected the transfer – and lost, just as Studco had.

Takeaway

The Fourth Circuit believed that Virginia’s UCC mandates an “actual knowledge” standard – that is, that a bank that receives an ACH transfer can rely on the account number or identifying number stated therein as the proper identifier of the payment beneficiary so long as the bank does not have actual knowledge that the number and the name on the transfer do not identify the same person – and that such standard is consistent with the requirements of the ACH system.  In this regard, the court noted that the ACH system handles over 33 billion transfers each year and therefore must function electronically and automatically.  The court wrote that “if those transfers were conducted manually, commerce would virtually grind to a halt.”  Nonetheless, as the concurring opinion makes clear, the “actual knowledge” standard might not protect a bank from liability if, for whatever reason, a bank employee learns of a discrepancy between the name and number.

Neil E. McCullagh is an attorney with Spotts Fain who works with banks on a wide variety of issues, including lending, insolvency, workouts, creditors' rights, bankruptcy, and collections.

* Mr. McCullagh gratefully acknowledges the assistance of Harry Shaia, Jr., an intern with Spotts Fain and a rising senior at the University of Notre Dame, in preparing this article. 

Spotts Fain publications are provided as an educational service and are not meant to be and should not be construed as legal advice. Readers with particular needs on specific issues should retain the services of competent counsel.
 

[1] The case cite is 133 F.4th 264 (4th Cir. March 26, 2025).

[2] Studco also claimed that its deposits with the Credit Union created a bailment relationship that imposed a duty of care on the Credit Union, and it won on that claim in the district court, but the Fourth Circuit also overturned that ruling, holding that an ACH transfer is not a “good” that creates a bailment arrangement.

[3] The case is Bower v. Merrimack Valley Credit Union, 2025 Mass. Super. Lexis 62 (Mass. Super. Ct. June 13, 2025).