Ohio bank joins credit unions suing Fiserv over security

• Key insight: Across the security suits, Fiserv's court filings say stronger login protections are available on many of its systems, and each client decides whether to use them.
• What's at stake: Fiserv serves about 10,000 financial institutions, and its position puts the job of turning on stronger authentication on those clients.

Overview bullets generated by AI with editorial review.

Processing Content

A small Ohio bank has become the 10th financial institution represented by the same lawyer to sue Fiserv over its cybersecurity practices. But so far, the suits have made little headway in court.

The suits accuse Fiserv of failing to provide the security it promised, in particular multifactor authentication (a second proof of identity beyond a password) on systems that hold customers' account data. Some also challenge the fees Fiserv charges clients that leave.

The Antwerp Exchange Bank Co. filed the suit Oct. 8 in federal court in Toledo, accusing the core processor of misrepresenting its security to win business from the bank, which has $161 million in assets.

Some of the credit unions asked judges for emergency orders that would force Fiserv to change its practices while their cases proceeded. Courts have denied both such requests a judge has ruled on, but Fiserv has not won outright dismissal of any of the 10 cases.

Fiserv has argued that the lawsuits are about money. By December, it had received 22 demand letters from the same lawyer, Charles Nerko, which it described as substantively identical, according to a filing in Self-Help Credit Union's case.

Self-Help's termination fees "exceed $1.2 million, and Self-Help does not want to pay them," Fiserv said in the same filing.

"Cencap's counsel has sued Fiserv multiple times. Fiserv is familiar with this playbook," the company's lawyers wrote in a June 2025 brief opposing an emergency bid from Cencap Federal Credit Union.

Nerko's clients "openly challenge exit fees, but the security allegations are specific and independently important," he told American Banker.

Nerko has represented financial institutions in all 10 suits since 2018. Antwerp's is the first brought by a bank; credit unions brought the other nine, most recently Marshall Community Credit Union in Michigan, which sued three days before Antwerp did.

Fiserv serves about 10,000 financial institutions, according to its website. Across Nerko's earlier cases, Fiserv has presented courts a consistent position on who is responsible for stronger login protections: Fiserv offers them on many of its systems, and each client decides whether to use them.

"Ultimately, however, the client determines its risk tolerance," Fiserv's lawyers wrote in an Oct. 5 brief opposing an emergency motion from FiCare Federal Credit Union over whether Fiserv's automated call center can lift fraud holds on the credit union's cards.

"We continue to support our clients by implementing security and authentication tools that take into account each of our client's unique needs and preferences," a Fiserv spokesperson told American Banker in a statement Thursday.

Neither Antwerp's complaint nor Marshall's "alleges a specific security incident impacting their customers or data," the spokesperson said. "As with the other suits filed by the same counsel, we believe these claims lack merit and we intend to defend them vigorously in court."

What the bank alleges

Antwerp's complaint rests entirely on trade-secret law: the federal Defend Trade Secrets Act and Ohio's version of the same law.

The bank argued that its records of customer identities and accounts are a trade secret. Fiserv got them by misrepresenting its security in the contract and in compliance materials, according to the complaint.

It's a new legal route to the goal all 10 suits share: getting a judge to rule against Fiserv's security practices. Marshall's complaint, filed three days earlier, pairs a trade-secret claim with breach-of-contract and fraud claims. Antwerp's drops those and rests on trade secrets alone.

Fiserv said at a January hearing in Self-Help's case that "nothing in our contract requires us" to adopt NIST's standards.

Indeed, NIST's main catalog of security controls is "mandatory for federal information systems," while private companies are only "encouraged to consider using" it, according to NIST.

Even so, compliance materials Fiserv sends banks say its security practices follow NIST's standards, according to Antwerp's complaint.

Antwerp turned these statements back on Fiserv. If the contract doesn't require Fiserv to follow NIST, then its claims that its security did were "non-contractual statements of fact," the bank argued. "Misrepresentation is an improper means of acquiring a trade secret," the bank said.

The Antwerp complaint lists Fiserv systems that the bank said lack multifactor authentication. Among them is Premier, the core system that holds the bank's customer accounts.

Bank staff log in to Premier with a username, a password and, "periodically," an emailed one-time passcode, or OTP, "with an option to use OTP through an authenticator app," according to the complaint.

The complaint argues that a code sent by email doesn't count as a second factor, citing NIST guidelines that bar email for that purpose. It does not say whether the bank uses the authenticator-app option, and Nerko declined to say.

"We do not comment on individual clients' security settings," Nerko said.

Of the nine Fiserv systems the complaint lists, Premier is the only one it describes as offering an authenticator app.

The second factor matters because a bank staff login grants access to customers' account numbers, addresses and Social Security numbers, the complaint said.

The complaint does not describe a specific security incident or fraud loss at the bank. Neither Antwerp's case nor Marshall's depends on showing that one occurred, according to Nerko.

It says Fiserv would demand "seven-figure" fees if the bank left, without giving a figure. Much of its language matches (often word for word) the complaints Marshall and Self-Help filed.

"Banks should not have to pay a vendor's termination-related fees when the vendor does not hold up its end of the bargain," Jeff Mumma, Antwerp's CEO, told American Banker.

Fiserv's answer: The client chose

Fiserv has not yet filed an answer in the Antwerp case, but its defenses in the nine other Nerko cases preview what it is likely to say.

Midwest Family Federal Credit Union "chose not to implement additional security features before or after initiating this action," Fiserv wrote Tuesday in its answer to that Indiana credit union's suit. Nerko represents Midwest in the lawsuit.

Midwest "has refused to migrate to the upgraded authentication method offered by Fiserv, SecureNow," Fiserv said in its answer.

SecureNow adds multifactor authentication to Fiserv's Virtual Branch online banking and Mobiliti mobile banking, according to a July motion Fiserv filed in FiCare's case. Fiserv is replacing its older Enhanced Authentication product with it, according to its answer in the Midwest Family lawsuit.

A Fiserv operations executive took the same position that the bank chooses the security features it uses, under oath in FiCare's case in Florida.

"The financial institution client, not Fiserv, determines whether the client uses OTP" when the call center verifies a cardholder, according to the executive's declaration.

Fiserv's own documents show that it started offering several stronger options only recently.

Authenticator-app passcodes arrived on Portico, a Fiserv core system for credit unions, in June 2025, according to a letter earlier this year from a Fiserv lawyer that Marshall filed as an exhibit.

Multifactor authentication for online-banking enrollment on that core system "became available in April 2025," a Fiserv executive said in a June 2025 declaration in Cencap's case.

CUSA, another Fiserv credit union core, "does not currently support such authentication processes, nor has it ever," the executive said in the same declaration.

The filings do not say when Premier, the core Antwerp uses, gained its authenticator-app option.

The credit unions suing Fiserv object to being pushed onto SecureNow.

Fiserv has said that switching costs extra. Cencap "presumably" decided "the extra security protection was not worth the additional cost of the SecureNow product," Fiserv wrote in the June 2025 brief.

The push to move clients onto SecureNow is "a mid-contract shake-down," according to Midwest's amended complaint.

Fiserv denied that in its answer and said SecureNow "provides additional security capabilities."

The emergency bids

Courts have denied both emergency requests a judge has ruled on in these cases. Neither ruling makes a judgment on whether Fiserv's cybersecurity is adequate; rather, they deny requests asking the judge to order Fiserv to do something, or stop doing something, while the case proceeds.

A federal judge in Connecticut denied an emergency request by Cencap in June 2025, citing the credit union's "years-long unexplained delay in bringing suit," according to the court's order. Cencap had asked the court to bar Fiserv from storing the credit union's information "on any internet accessible system without multi-factor authentication," according to the order.

Self-Help asked a court to make Fiserv cut its Client360 support portal off from the internet and work out a plan for the credit union to leave. A federal judge in North Carolina denied that request in January.

The judge in the Self-Help case noted evidence that the credit union had declined SecureNow "three or more years ago" and said it "has been on notice of the potential problem for a period of time," according to the hearing transcript. Self-Help's emergency bid then fell apart later in the lawsuit.

On April 30, as a penalty for evasive answers, a judge ordered that the credit union be treated as having admitted (among other things) that it could have used authenticator-app passcodes on Portico, the Fiserv core it used, since June 2025.

Its answers to Fiserv's questions were "gamesmanship," the judge said, according to the hearing transcript. The judge ordered Self-Help to pay Fiserv's legal fees for the motion.

The next day, Self-Help withdrew its request for a preliminary injunction, the longer-lasting version of the emergency order it had sought.

It accepted an offer Fiserv had made in January, which let it leave Fiserv later that year without paying termination fees up front. Self-Help withdrew the request based on Fiserv's concessions, according to Nerko.

Bessemer System Federal Credit Union's 2019 request ended in a compromise. Bessemer, which had already left Fiserv, asked the court to stop the company from storing the credit union's records on internet-accessible systems and to hand over records the credit union still needed.

Only FiCare's emergency motion is still pending. It asks the court to stop Fiserv's automated call-center system from lifting fraud holds on FiCare's cards.

Where the cases stand

Fiserv has gotten some procedural wins, but it has not gotten a judge to outright dismiss any of Nerko's 10 lawsuits.

A federal judge in California denied its motion to dismiss Polam Federal Credit Union's suit in June. The issues were better resolved at a later stage of the case, once both sides had gathered evidence, the judge wrote in a two-page order.

In 2020, a federal judge in Pennsylvania let Bessemer's breach-of-contract claim proceed. In 2024, Fiserv and Bessemer agreed to dismiss the case.

A lawsuit by two New York credit unions also settled in 2023, and Cencap's case got dismissed in April after the parties reported a settlement, according to its docket.

Nerko's other seven lawsuits against Fiserv are pending.