First Horizon faces lawsuits over token resets and $24 million in wire transfers

Two lawsuits against First Horizon Bank allege that callers posing as business customers used a story about getting a new iPhone to persuade bank staff to reissue security tokens, then sent more than $24 million in wire transfers. Some of the money has not been recovered. The cases raise questions about how the bank verified callers, how business accounts were secured and whether it recognized a similar fraud pattern after an earlier incident.

Two companies lost about $6.5 million over two days

K&A Rosario Holdings and MJR Fund, businesses in the Orlando area, sued First Horizon in federal court in Orlando in May. Their complaint says a caller on March 3 claimed to be Misael Rosario, who managed K&A and was responsible for MJR. He said he had “changed to an iPhone 14” and needed a new security token to access the companies’ accounts.

A First Horizon customer-service representative reissued the token. The bank’s business account guide says a token loaded into a mobile app generates a new code every 60 seconds. Business customers need both that code and a password to initiate payments.

About 80 minutes later, one account sent six wire transfers totaling $4.85 million. By March 5, the two companies’ accounts had sent 12 transfers worth about $6.5 million. More than $4.5 million remains unrecovered, the complaint says.

The companies’ attorney, Victor Velarde, said they do not know how the caller obtained their online banking credentials. The complaint says the call came from California, while the companies’ managers live in Florida and had only provided Florida phone numbers to the bank. It also says the caller pronounced Rosario’s name in two different ways.

Law firm reports $17.3 million in transfers

About five weeks earlier, Rabideau Klein, a law firm in Palm Beach, Florida, experienced a similar incident. A separate complaint says a caller used the same “new iPhone” explanation to request a replacement security token. Within hours, 13 wire transfers totaling about $17.3 million left the firm’s escrow account.

The account held funds for real estate transactions. The firm has recovered about $10.7 million, leaving roughly $6.55 million unrecovered, the complaint says.

The incident began on January 27, when a phishing email gave an attacker access to one of the firm’s Microsoft 365 email accounts. The next day, the attacker persuaded the firm’s phone provider to forward its calls to a number under the attacker’s control. That evening, the attacker used First Horizon’s online banking “Forgot User ID or Password” feature to reset Guy Rabideau’s password and obtain his user ID.

The attacker then called the bank, claiming to be Rabideau and asking for a new token. When asked for the account number, he first said he was looking for “their” account number, then provided the relevant information. He also gave a business name that did not exactly match the bank’s records, the last four digits of Rabideau’s Social Security number and the user ID the bank’s website had just displayed.

After the call was transferred to the bank’s treasury management department, another representative asked for the user ID, full name, email address and last four digits of the account number. The representative offered to send a verification code to the law firm’s registered phone number. The caller asked to receive it by voice call instead, and the representative agreed. The call carrying the code was forwarded to the attacker. The bank then emailed a token-activation link, which the attacker also intercepted.

Bank logs recorded logins from Chicago over the following hours, the complaint says. The attacker also created a second user ID in Rabideau’s name, linked it to the attacker’s own email and phone number, and cut off online banking access for four other firm employees.

Wire transfers in both cases included payments to the same business, Shaoxing Fanshun Import and Export. K&A’s complaint says four transfers totaling $2.29 million went from its account to the company. The court filings do not explain whether the two businesses had any other connection.

First Horizon says its controls worked as intended

First Horizon, headquartered in Memphis, Tennessee, denies failing to manage risk effectively in the Rabideau Klein case and is defending both lawsuits. A bank spokesperson said its “systems, controls and safeguards operated as intended.” The bank said it would vigorously defend itself against the claims by K&A and MJR.

In the Rabideau Klein case, First Horizon has attributed the loss to security issues at the law firm. The bank says the phishing email started the incident and that the firm had declined a wire-transfer control the bank had recommended. The control requires a second user to approve each wire before it is sent. Documents filed by the firm show it signed a form declining the feature.

Velarde said K&A and MJR did not actively waive any security procedures, but did not say whether the companies used dual approval. First Horizon has not publicly detailed how it verifies callers requesting replacement security tokens or whether it changed its procedures after the January incident.

Lawsuit questions what the bank knew about similar fraud

K&A and MJR argue that First Horizon may have known about a similar method before the March transfers. Their complaint says that after Rabideau Klein reported fraud on January 29, the bank had “actual knowledge” that someone had accessed customer accounts by claiming to have changed iPhones, and that wire transfers to Shaoxing Fanshun were suspected of being fraudulent.

K&A argues that those facts could affect whether the bank’s security procedures were “commercially reasonable” under Article 4A of the Uniform Commercial Code. The provision generally governs allocation of liability for wire transfers: a bank may bear the loss from an unauthorized transfer, but the outcome can differ if it acted in good faith and followed commercially reasonable security procedures agreed to by the customer.

First Horizon has asked the court to strike those allegations from K&A’s complaint, arguing that the plaintiffs’ lawyers borrowed them from unrelated lawsuits and that they are irrelevant and improper. K&A cites a 2012 court ruling in support of its argument that a bank’s failure to act on fraud warnings in its possession may affect whether its security procedures were reasonable.

Federal guidance highlights registered numbers and verification

Guidance issued by the Federal Financial Institutions Examination Council in 2021 warned banks about social engineering attacks targeting customer-service and IT help desks. Suggested controls included sending one-time codes to pre-registered devices, calling customers back on numbers already on file, flagging unrecognized caller IDs and establishing procedures for changes to phone numbers or carriers.

In the Rabideau Klein case, the bank did send a code to the firm’s registered number, but the attacker had already persuaded the phone provider to forward calls from that number. The case illustrates that sending a code to a registered number may not establish that the customer is the person receiving it.

Jim Mortensen, a strategic adviser in fraud and anti-money laundering at Datos Insights, said knowledge-based checks such as spelling a name or providing the last four digits of a Social Security number are no longer enough to meet best practices. For business customers requesting replacement security tokens, he recommends calling a registered number and requiring confirmation from a second administrator.

Mortensen said social engineering is more likely to succeed when approval for a reset depends mainly on a customer-service representative’s judgment rather than system-based identity verification. The lawsuits will turn on how the court assesses First Horizon’s verification steps, the customers’ account-security settings and what the bank knew about the alleged pattern of fraud.