Impostors got past First Horizon's help desk, suits allege

• Key insight: Both suits describe a caller with the same "new iPhone" story, and both sets of wires included payments to the same company.
• Expert quote: "The risk occurs when reset approval depends on agent judgment rather than system-driven verification," said Jim Mortensen of Datos Insights.

Overview bullets generated by AI with editorial review.

Processing Content

A caller told First Horizon's support staff on March 3 that he had a new phone and needed a new security token to access his Florida businesses' accounts. Within about 80 minutes, someone requested six wire transfers totaling $4.85 million out of one of those accounts.

Those details come from a lawsuit that two Orlando-area companies, K&A Rosario Holdings and MJR Fund, filed against First Horizon in May of this year. The case is in federal court in Orlando, where the two sides have been arguing in recent weeks over the scope of the issues.

The March caller claimed to be Misael Rosario, who manages K&A and leads MJR, and he said he "got a new iPhone 14," according to the lawsuit.

The token is a security credential, and the bank's support staff reissued it at the caller's request. Loaded into a smartphone app, the token generates a fresh code every 60 seconds, according to First Horizon's setup guide. The bank's business customers need that code plus a password to send payments.

By March 5, a dozen wires totaling $6.5 million had left the two companies' accounts. More than $4.5 million of it is still missing, according to the lawsuit.

Five weeks earlier, a caller used the same "new iPhone" story to get a token reissued for Rabideau Klein, a law firm in Palm Beach, Florida, according to a separate lawsuit. Within hours, $17.3 million left the firm's escrow account.

The wires in both lawsuits included payments to the same company, Shaoxing Fanshun Import and Export, according to the K&A filings.

First Horizon, which is based in Memphis, Tennessee, disputes that its defenses failed in the Rabideau Klein case, and it is fighting both lawsuits.

"Our systems, controls and protections functioned appropriately," a First Horizon spokesperson told American Banker when asked about the Rabideau Klein case. When asked about the K&A case, the spokesperson said First Horizon intends to "defend the case vigorously."

So far, First Horizon has blamed Rabideau Klein for the firm's losses; the bank said in a court filing that the firm had declined an additional security control the bank recommended for its wire transfers: having a second person approve each one.

Call center and help desk staff who reset customers' passwords and other login credentials have long been a weak point for banks.

Criminals "frequently have used social engineering and other techniques to deceive customer call center and IT help desk representatives into resetting passwords and other credentials," federal bank regulators warned in 2021 guidance.

The lawsuits against First Horizon describe criminals aiming that tactic at a bank's business customers, through the kind of support line banks run for customers of their treasury management services (the cash management and payment tools banks offer businesses).

The fraudsters called the bank prepared

In the Rabideau Klein case, the attacker didn't start with First Horizon's call center; he prepared for it.

On Jan. 27, a phishing email gave the attacker access to one of the law firm's Microsoft 365 email accounts, according to the complaint. Although the complaint does not say it directly, this appears to mean that someone at the law firm fell for a phishing attack.

The next day, the attacker called the firm's phone service provider and persuaded it to forward the firm's phone lines to his own number.

That evening, the attacker used First Horizon's online "Forgot User ID or Password" tool to reset the password of Guy Rabideau, whose name the firm carries. Along the way, the tool showed the attacker Rabideau's user ID.

Minutes later, he called the bank, said he was Rabideau, said he had a new iPhone and asked for a new token.

When the bank's representative asked for an account number, the caller responded that he was looking for "their" account number, then provided it.

The caller then gave a business name that did not match the bank's records ("Rabideau Klein" rather than "Rabideau Law P.A.").

He also provided the last four digits of Rabideau's Social Security number and the user ID that the bank's own website had just shown him.

After the caller was transferred to the bank's treasury management department, another agent asked the caller for the user ID, a full name, an email address and the last four digits of the account number.

She offered to text a verification code to the firm's phone number. The caller requested a voice call instead. The agent obliged, and the call carrying the code rang through to the attacker.

The bank then emailed the token's activation link, which the attacker intercepted.

Over the next several hours, the bank's own logs recorded logins from Chicago, according to the complaint. The attacker also created a second user ID in Rabideau's name, tied to the attacker's own email address and phone number, and cut off online banking access for four of the firm's other employees.

The attacker sent out 13 wires, totaling $17.3 million, from an attorney trust account holding escrowed real estate money.

The firm has recovered about $10.7 million; the other $6.55 million is still missing, according to the complaint.

The call in the K&A and MJR case, five weeks later, followed nearly identical beats. Beyond the bank, the "new iPhone" story and the shared payee, the lawsuits describe no tie between Rabideau Klein and the two Rosario companies.

There were a few differences. The caller in the K&A and MJR case phoned from a California number, even though the companies' officers live in Florida and had registered only Florida numbers with the bank. He also pronounced Rosario's first name two different ways.

The name, email address and phone number the bank asked about over the phone are publicly available, according to the complaint.

The bank also asked for a login ID and the last four digits of an account number, according to an unofficial transcript of the call that the companies' lawyer provided to American Banker.

The caller also apparently had the password to the account because, according to First Horizon's setup guide for business account security tokens, activating a reissued token requires the customer to provide their username and password.

K&A and MJR do not know how the caller got the online banking credentials, Victor Velarde, a shareholder at Fowler White Burnett and counsel for the two companies, told American Banker.

First Horizon's response

First Horizon blamed Rabideau Klein for the losses the firm suffered. The wires "resulted from security failures at Rabideau Klein," starting with the phishing email, the bank's spokesperson said.

The firm's "security failure was exacerbated by the fact that Rabideau Klein declined the bank's earlier recommendation to utilize dual-approval control for wire transfers," the spokesperson said.

Dual approval requires a second user to sign off on each wire. Rabideau Klein signed a form declining it "despite the recommendation of Bank," according to part of the firm's own court filings.

For their part, neither K&A nor MJR opted out of any security procedures, according to Velarde, although he did not say whether they used dual approval.

First Horizon did not say how it verifies callers who ask for a new token, nor whether it changed that process after January.

Under Article 4A of the Uniform Commercial Code (the law that governs wire transfers), a bank generally bears the loss on an unauthorized wire unless the bank acted in good faith and followed a commercially reasonable security procedure that the customer agreed to.

First Horizon's contracts with business customers put much of the risk on the customer. A customer that uses the bank's security procedures accepts them "as a commercially reasonable means of preventing unauthorized activity," according to First Horizon's treasury management master agreement.

Did the bank know?

First Horizon should have been on guard by March, according to the K&A lawsuit.

By Jan. 29, when Rabideau Klein reported the fraud, the bank had "actual knowledge" that a caller had gotten into an account by claiming a new iPhone and that wires to Shaoxing Fanshun were fraudulent, according to the lawsuit.

Four of the wires from K&A's account, totaling $2.29 million, went to the same company, according to the lawsuit.

First Horizon has asked the court to strike those allegations. K&A's lawyers "lifted these allegations from separate, unrelated lawsuits," which are "immaterial and impertinent," according to the bank's motion.

This prior knowledge by the bank implicates whether its security procedures were commercially reasonable, K&A's lawyers argued to the court. They cited a 2012 ruling that found a bank's procedures commercially unreasonable in part because it had not acted on its own fraud warnings.

What the guidance says

The 2021 guidance that warned about help desks came from the Federal Financial Institutions Examination Council, which sets common examination standards for the federal bank regulators. It lists controls for this situation.

The controls include sending one-time codes to "a pre-established communication device," "call-backs to a pre-established phone number," flagging calls from "an unidentifiable phone number" and having a process for "changes to established phone numbers or carriers," according to the guidance.

In the Rabideau Klein case, the bank did send the code to the firm's number on file. The problem was that the attacker had gotten the phone service company to redirect calls to that number to himself.

Knowledge-based checks alone, such as spelling a name or giving the last four digits of a Social Security number, "are now considered insufficient under current best practice," Jim Mortensen, a strategic advisor in the fraud and anti-money-laundering practice at Datos Insights, told American Banker.

Banks should reissue a business customer's token only after calling back the number on file and getting approval from a second administrator at the customer, Mortensen said.

"The risk occurs when reset approval depends on agent judgment rather than system-driven verification," Mortensen said. "In those moments, social engineering works reliably."