Chapter 94: The Sentinels Who Fell Asleep on the Watch — Bank Liability, Security Duties, and Fraud Prevention

Banks are the fortresses of the modern era. We do not just deposit securities and currency with them, but our existential security, the pension we worked a lifetime for during our professional years, our children's home savings, and our peace of mind. The magnificent, marble-clad and glass-walled structures are intended to project power and stability. Their digital systems, protected by layers of encryption and multi-factor authentication, are supposed to be impregnable. But what happens when the crack in the wall comes not from a physical break-in to the vault, but from within the system itself, or from the negligence of those who were supposed to stand on guard?

In this chapter, we will dive into the legal depths of the complex relationship between a client and their bank. We will examine the boundaries of the financial institution's liability: is the bank merely a "conduit" for fund transfers, or is it a "sentinel" with an increased duty of care? We will understand when the bank's liability for damages caused to a client as a result of fraud might be scrutinized, even if the client was the one who performed the transaction under false pretenses, and how courts analyze the balance of power between the average citizen and the mega-corporation holding the keys to their economic kingdom.

The following scenario is an educational example based on common fraud patterns. The characters and events are for illustration purposes only.

Miriam (a pseudonym), a retired mathematics teacher, sat in her kitchen drinking her first cup of tea of the morning. Her mobile phone buzzed. On the screen appeared a number that appeared to be her bank's customer service hotline. With an authoritative, calm, yet urgent tone, the speaker introduced himself as a representative from the security department. He told Miriam that unusual activity had been detected in her account—an attempted massive withdrawal from a foreign country.

"Don't worry, Miriam," said the fake representative, "we are stopping it. But to protect the rest of the money, we may need to transfer it temporarily to a secure account under supervision, until we replace all your access credentials." Miriam, who had lived her entire life by the rules and feared losing her savings, felt her heart pounding wildly. She did not suspect for a moment. After all, the number on the screen looked like the bank's number. The speaker knew certain identifying details that were supposed to be confidential.

For a long time, the speaker guided her over the phone. He asked her to log into the app, add a new beneficiary, and transfer significant sums. "The system blocks transfers that are too large, so we will do it in installments," he explained naturally. Miriam transferred cumulative amounts that totaled her entire savings. At a certain stage, the app requested a phone verification from the bank. The speaker instructed her to provide a specific version of events to the bank representatives so as "not to delay the protection of the account."

The call from the bank arrived. A clerk asked: "Miriam, we see here a series of transfers to a new account. Is everything okay? Are you the one performing this?" Miriam, terrified and programmed by the speaker, replied that everything was fine and that the money was intended for family support. The clerk released the block. Within minutes, the money left the account. After some time, when Miriam tried to contact the "security department" again, the line was unavailable. When she arrived at the physical branch, she was told that the money had already been moved on and could not be tracked. At the bank, they argued that since she had authorized the transactions and provided an explanation to the clerk, the liability for the damage rested with her.

The Bank as Trustee: Much More Than a Place for Storage

Such cases are not rare, and they raise the central question: where does the client's responsibility end and the bank's liability begin? Legally, the relationship between a bank and a client is in many cases based on a fiduciary duty. The bank is perceived as a professional entity, possessing knowledge and technological tools, vis-a-vis a client who sometimes lacks the skills required to face complex cyber threats.

The bank's duty of care can be analyzed as a duty that is not limited solely to the technical execution of the client's instructions. Legal analysis of similar cases suggests that a bank may have an active duty to protect client funds, derived from the Banking Law (Service to Client), regulatory provisions, and general principles of tort law. When a bank encounters activity characterized by significant irregularity—such as a sudden and extreme change in the activity patterns of a conservative client—the question arises as to whether the verification procedure performed by the bank was sufficient under the circumstances.

In these situations, the bank's claim that "the client gave an explicit instruction" may face the legal perception that the client's will may be impaired as a result of deception or pressure. Legal examination will focus on whether the bank acted as a reasonable and skilled banking institution would have acted, and whether certain signs in the conversation or the pattern of transfers should have triggered warning bells in the bank's compliance and security departments.

The "Red Flag" Doctrine

Within the framework of analyzing bank duties, the concept of "red flags" often arises. When an instruction to perform an action accompanied by suspicious signs is presented to the bank, there is a legal position that the bank cannot settle for a superficial check. It may be required to conduct a deeper inquiry, and in certain circumstances, even to delay the operation. In scenarios of rapid changes in activity patterns, transfers to unknown destinations, and significant time pressure, it can be argued that the bank should have conducted a more rigorous verification process.

Payment Services Law: Analyzing the Legal Landscape

The Payment Services Law, 5779-2019, constitutes a central pillar in regulating liability in cases of unauthorized use of payment methods. The law establishes principles regarding the liability of the client and the payment service provider in cases of unauthorized transactions.

However, there is legal complexity in distinguishing between an "unauthorized transaction" (such as a direct hack into the account) and a "transaction authorized under deception" (social engineering). In cases of social engineering, banks tend to argue that since the client performed the action, the increased liability under the law does not apply in the same way.

Conversely, one can examine the legal concept of consent given under undue influence or deception. If technologies allowing impersonation of bank systems were used, the bank's liability for securing its communication channels may be scrutinized. The law imposes on the payment service provider a duty to take reasonable measures to prevent misuse, and if it is proven that accepted risk monitoring systems were not activated or that alerts were ignored, this may affect the apportionment of liability for the damage.

Apportionment of Liability: The Battle Over Contributory Negligence

In legal proceedings in this field, the issue of "contributory negligence" constitutes a central focus. Financial institutions may argue for negligence on the part of the client who provided details or acted against warnings. On the other hand, it can be argued that clients may be victims of sophisticated psychological manipulations, and that a professional body should anticipate such attacks and build appropriate security barriers.

Legal examination may lead to an apportionment of liability between the parties, determined according to the circumstances of the case and the extent of each party's ability to prevent the damage. In cases where it emerges that there was a deviation from internal procedures or the Bank of Israel's directives, it is possible that the court will tend to attribute greater weight to the financial institution's liability.

Furthermore, there is a trend in case law to examine an increased duty of inquiry toward populations that may be more vulnerable, such as senior citizens. In these cases, the professional expectation may include exercising human judgment and increased alertness on the part of bank employees when distress or extreme unusual activity is identified.

Technological Duties in a Changing World

The duty of care of a financial institution also includes the aspect of technological updates. One can examine whether the bank implements artificial intelligence-based systems for identifying unusual patterns and whether it acts to limit transfers to destinations known to be high-risk without appropriate inquiry.

Another issue is liability for security failures that allow impersonation (such as SMS messages appearing to be from the bank). As technology advances, the expectation of banks to provide a safe environment and to act to reduce the opportunities for hostile actors to exploit the official communication channels of the institution increases.

The Legal Path to Examining Liability

Investigating claims against a bank for liability for fraud requires a rigorous examination of the evidence. This process may include demanding documentation of calls, login logs for the account, and examining the warning messages sent to the client.

Within the framework of a legal proceeding, it is possible to examine whether the bank complied with disclosure duties and explained the risks, and whether the warnings presented were effective. The chances of success in examining these cases depend to a large extent on the ability to show that the damage could have been prevented by reasonable measures or that there were prior indications that the institution did not act upon.

Warning Signs for Conduct That May Be Considered Negligent

• Approving a series of unusual, high-amount transfers to a new destination without performing proactive verification with the client.
• Performing actions despite the existence of clear signs of distress on the part of the client when communicating with the bank.
• Existence of breaches in communication systems that allow external parties to send messages identified as official bank messages.
• Lack of mechanisms for a "cooling-off period" or delaying transfers in especially suspicious circumstances.
• Settling for general responses from the client without performing a deeper inquiry in cases of extreme deviation from normal operating patterns.

Initial Steps in Case of Suspicion of Banking Failure

1. Demand for Freezing: Immediate and documented contact with the bank demanding a stop to the transfer of funds. In some cases, there is an option to stop funds in intermediary banks in the transfer chain.
2. Documentation of Communication: Maintaining documentation and recordings of all calls with bank representatives from the moment the incident is discovered.
3. Gathering Technical Information: Requesting a breakdown of security logs relevant to the account during the times of the incident.
4. Contacting Public Appeals Bodies: Investigating the case with the bank's Public Complaints Commissioner as a preliminary step.
5. Professional Advice: Examining the legal situation with an attorney specializing in the field, before signing waiver documents or accepting offers for partial settlement.

Legal Aspect: Summary of the Liability Issue

The legal approach regarding bank liability in Israel is in a trend of development, placing emphasis on their role as sentinels. There is an expectation for banks to use their resources to protect clients from sophisticated fraud.

However, the possibility of recovering funds from the bank involves a case-by-case examination of the circumstances and proving a failure in the institution's conduct. The bank does not bear automatic liability for every action of the client, but its professional and tortious liability can be examined in cases where it failed to act in the face of clear "red flags." In the balance between the client's autonomy and the bank's duty of protection, the emerging tendency is a more rigorous examination of the liability imposed on financial institutions.