Our office have represented multiple clients that have been victims of financial crimes. We offer some helpful advice. In today’s digital financial environment, the risk of bank fraud—especially through online platforms—continues to grow. And your bank may not be your best friend in helping recover your stolen funds or reimbursing you when their actions don’t comport with industry best practices. While financial institutions are legally required to implement reasonable security measures, clients cannot assume that those measures are always sufficient or properly deployed. One of the most critical safeguards available is multi-factor authentication (MFA)—but not all MFA is created equal.

Many banks offer email or SMS-based verification, but these methods are increasingly vulnerable to cyberattacks, including phishing and SIM-swapping. Instead, clients should insist on true MFA, which requires two or more of the following:

• Something you know (password or PIN)
• Something you have (e.g., a smartphone app like Google Authenticator or a hardware key)
• Something you are (e.g., fingerprint or facial recognition)

Best practices for businesses and professionals:

• Demand robust MFA for all online banking activity—especially wire transfers, ACH payments, and account modifications. True MFA is utilizing a separate device such as your mobile phone. It is NOT enough to have a bank email you banking confirmations as many times emails are hacked.
• Use authenticator apps or physical security keys instead of relying solely on email or text message codes.
• Regularly audit your bank’s security offerings and do not hesitate to escalate concerns or switch providers if your institution cannot meet basic cybersecurity expectations.
• Educate your team about phishing, credential theft, and how to recognize fraudulent activity.

While financial institutions carry responsibility for securing accounts, courts may consider whether the client took reasonable steps to protect access. By requiring banks to implement industry-standard MFA and maintaining vigilant internal controls, you significantly reduce the risk of unauthorized transactions—and strengthen your legal position should fraud occur.

Additional protections for consumers: Unlike businesses, consumers enjoy broader protections under federal law—most notably the Electronic Fund Transfer Act (EFTA) and Regulation E. These laws require banks to investigate and reimburse unauthorized electronic transfers when reported timely—often limiting the consumer’s liability to $50 or less if the bank is promptly notified. However, even with these protections, the best defense is prevention. Consumers should enable strong MFA, monitor accounts regularly, and report suspicious activity without delay to preserve their legal rights.

By demanding true multi-factor authentication and remaining vigilant, both businesses and individuals can significantly reduce their exposure to fraud and ensure they are positioned to assert their rights if a breach occurs.

THIS IS NOT LEGAL ADVICE. PLEASE CONSULT YOUR ATTORNEY TO UNDERSTAND YOUR RIGHTS AND OPTIONS.