Presumably the victim's credentials (likely just a password or PIN, and possibly the proper response to a "secret question") were obtained with a trojan keylogger or some other means.  The question is who's fault is that?  Not really the bank's.  The bank's claim that they honored a properly authenticated transaction is not completely unreasonable.<p>What the court is really being asked to decide is whether simple password authentication is "reasonably secure."  What are the alternatives?  Seems that they'd have to use a physical smart card or fob device to generate one-time passwords, or use an alternate communication channel (email?  SMS?) to verify that the authorized user is attempting to authenticate.  Any of which substantially decreases the perceived usability of the system by a typical business customer.