Business email compromise (BEC) and other third-party fraud inducing funds transfers have generated a wave of litigation against banks: not just those where victims hold accounts, but also against the financial institutions where the funds were transferred, even when the victim is not a customer. A threshold question often arises as to whether the beneficiary bank receiving the funds via a wire transfer owes a noncustomer plaintiff any duty of care at all. Most courts uniformly hold that banks owe no duty of care to noncustomers. But in 2024, in Elkin Valley Baptist Church,the United States District Court for the Western District of Pennsylvania went against the weight of authority and answered that question in plaintiffs’ favor.

The Elkin Valley court, in the same decision, also ruled that privity is not necessary in all instances to state a claim under Uniform Commercial Code (UCC) § 4A-207. Again, the court’s ruling was a rare outlier, given that every federal circuit court to consider the issue and the vast majority of district courts have held that privity was an absolute requirement for such claims.

Two years later, courts across the country have declined to follow Elkin Valley, with good reason.

Background: The Elkin Valley Decision

In late 2024, the Western District of Pennsylvania issued its decision in Elkin Valley Baptist Church, (W.D. Pa. 2024), a case involving a BEC scheme in which a plaintiff allegedly was tricked into wiring nearly $800,000 into an account held at the defendant bank. The court held that under Pennsylvania law the bank might owe a duty of care to a noncustomer when the bank’s affirmative, risk-creating conduct—specifically, opening and administering a bank account in the face of “red flags” suggesting fraud—creates or increases the risk that noncustomers like the plaintiff could be harmed by fraud.

Courts Push Back on Any Purported Duty to Non Customers

The Elkin Valley decision remains a notable outlier. The prevailing rule across the country remains contrary and straightforward: banks do not owe a duty of care to noncustomers. Since being published, courts have regularly rejected Elkin Valley’s reasoning. Below are notable examples.

Gemstone Foods, LLC (5th Cir. 2026). The Fifth Circuit affirmed dismissal of negligence claims brought by a Mississippi food processor whose wire transfers were diverted by fraudsters into accounts opened at a defendant bank. The court held that Mississippi law does not impose a duty of reasonable care on a bank toward a noncustomer. The court rejected each of the plaintiff’s alternative theories: violations of industry standards and internal procedures cannot supply a duty where none otherwise exists; the Bank Secrecy Act creates no private right of action enforceable by noncustomers; and Elkin Valley, which the plaintiff urged the court to follow, was non-binding and wrongly decided, as the case is not even “consensus authority within its own circuit.”

Ontman (S.D. Fl. 2026). In a BEC case decided in August 2026, a plaintiff alleged he was tricked into wiring over $154,000 to an account held at the defendant bank. He argued that the bank negligently opened and maintained the account in violation of its own Know Your Customer (KYC) procedures and that, under Elkin Valley, the bank owed him a duty of care as a noncustomer. The court declined to follow Elkin Valley. Applying Florida and Eleventh Circuit law, the court instead reaffirmed that banks generally owe no duty of care to noncustomers (absent exceptions that did not apply to the facts alleged). The court also rejected the argument that the novelty of BEC fraud required a departure from settled precedent, finding that existing Florida and Eleventh Circuit authority was sufficient to resolve the question without looking elsewhere. The court further held that a bank’s alleged failure to follow its own internal policies and procedures does not create a cognizable duty under Florida law and dismissed the complaint with prejudice.

Voutsiotis (N.D. Ohio). In a September 2025 decision, investors who lost funds through an allegedly fraudulent investment scheme brought negligence claims against a defendant bank where their fiduciary had maintained accounts. The plaintiffs urged the court to follow Elkin Valley, arguing that the bank owed them a duty of care as noncustomers. The court declined. Applying Ohio law, which follows the near-universal rule that banks owe duties of care only to their customers, the court found that Elkin Valley involved a different state’s substantive law and was, in any event, inapplicable on its facts. The court dismissed the negligence claim, along with claims for fraud, aiding and abetting, and civil conspiracy, finding that plaintiffs had not alleged facts sufficient to support actual knowledge or bad faith on the part of the bank under the Ohio Uniform Fiduciary Act.

Frontline Fabrics, Inc. (E.D. Pa. 2026). Perhaps most significant is an August 2026 decision from the Eastern District of Pennsylvania, within Elkin Valley’s home circuit, in which a plaintiff lost $1.4 million after hackers infiltrated a foreign vendor’s email, opened a bank account in the vendor’s name at the defendant bank, and directed the plaintiff to route payments there. The plaintiff sued that bank for negligence, relying directly on Elkin Valley. The court acknowledged the split in authority but sided with the pre-Elkin Valley Eastern District decisions. The court held that opening and maintaining a bank account, even in the face of suspicious circumstances, does not constitute the type of “affirmative, risk-creating conduct” that gives rise to a duty to noncustomers.

The court also applied Pennsylvania’s five-factor Althaus test for recognizing a new duty and found that four of the five factors weighed against imposition of a duty, including the lack of any relationship between the parties, the speculative nature of the financial risk, the significant consequences of making banks guarantors of their customers’ trustworthiness, and the absence of public interest support in light of the prevailing nationwide caselaw. The court noted that the plaintiff, not the bank, was in the best position to prevent its own loss, for example by placing a simple phone call to verify the new account before wiring funds.

Takeaways

The growing body of post-Elkin Valley authority makes clear that the decision remains an outlier, even within the Third Circuit. Courts applying Florida, Ohio, Pennsylvania, and other states’ laws have consistently declined to impose a duty of care on banks toward noncustomers in BEC and similar fraud cases, finding that the near-universal rule against such liability reflects sound policy. Banks that process enormous volumes of transactions cannot be made guarantors of every party touched by their customers’ conduct. Financial institutions facing negligence claims brought by non-customers should continue to press the “no duty” issue at the pleading stage and highlight Elkin Valley’s lack of traction across the country.