Bank Account Asset Protection: Why Your Bank Is Not Your Fiduciary

Most clients assume their bank must protect the money in their account. It does not. Here is what the law actually provides, how account takeovers happen to sophisticated people, and why some clients move accounts into a trust whose trustee owes them a duty the bank never did.

The attack that fools smart people

The call comes from the bank’s number. The agent knows your name, the last four digits of your account, your most recent transactions, sometimes the last four of your Social Security number. There is a suspicious charge, and they need to secure the account now.

This is the pattern the FBI describes in its November 2025 alert on account takeover fraud: criminals impersonate bank staff by text, call or email, talk the customer into revealing login credentials or a one-time passcode, then log in, reset the password and lock the owner out [5]. Funds are wired out within minutes, often to accounts linked to cryptocurrency wallets [5].

In our practice, the victims are physicians, founders, executives and family offices. They are not careless; the caller simply knew too much to doubt. Sometimes there is no call at all: a personal Gmail account is compromised, and the attacker resets the bank password from inside it.

FBI Internet Crime Complaint Center, 2025 Annual Report. Tech and customer support impersonation added another $2.1 billion; SIM swap complaints held near 1,000 [1].

What your bank actually owes you

Start with the belief most people hold: the FDIC will make me whole. It will not. “FDIC deposit insurance does not protect against losses due to theft or fraud” [2].

A personal account has a statutory floor. Under Regulation E, your liability for an unauthorized electronic transfer is capped at $50 if you report within two business days and $500 after that, with greater exposure if you miss a statement for 60 days [6]. The CFPB treats a transfer made with credentials obtained by fraud as unauthorized [7], though banks contest this in practice.

A business account has no such floor. Regulation E covers only accounts “established primarily for personal, family, or household purposes” [3]. For wires, New York’s commercial code lets the bank keep the loss on the customer, “whether or not authorized,” so long as its security procedure was commercially reasonable and it acted in good faith [8].

Read the account agreement of any major bank and you will find the same message in different words: you are responsible for your credentials, your devices and your people. Nothing in that agreement makes the bank a fiduciary or promises to protect you from a foreseeable attack.

Why suing the bank rarely works

Clients ask whether they can hold the bank liable for negligence. Sometimes, but the economics are brutal: account agreements usually require arbitration, and proving the bank’s security procedure was unreasonable takes expert testimony on authentication systems and fraud monitoring.

In our experience, expert fees alone in a negligence arbitration against a bank can exceed $100,000 before counsel fees. For a loss under a few million dollars, the case is often uneconomic even when the facts are good. That is the problem a trust is designed to solve in advance.

The shift is not in where the money sits but in who owes a duty to protect it.

Moving the account into a trust

Here is what we increasingly see clients do. Part of their liquidity moves into an account held by a trust, with the trustee as the only authorized signatory. The client no longer logs in, no longer receives the fake support call, and is no longer the person whose credentials open the vault.

The legal difference is the point. A New York trustee “has a duty to invest and manage property held in a fiduciary capacity” and must act with “reasonable care, skill and caution,” judged “in light of facts and circumstances prevailing at the time” [4]. In 2026, the prevailing circumstances include account takeover as a daily event.

That duty is also hard to write away. New York treats an attempt to exonerate a fiduciary from liability for failing to exercise “reasonable care, diligence and prudence” as contrary to public policy [9]. Compare that with the bank agreement, which disclaims as much as the law allows.

Three terms the trust must contain

A trust helps only if the document does the work. Standard prudence language was written for market risk, not for a deepfake call to the trust officer.

First, an express duty to safeguard the trust’s bank accounts and other assets against foreseeable cyber attacks, account takeovers and impersonation, with named procedures: callback verification, dual approval above a threshold, and a waiting period on new payees.

Second, allocation of loss. The document should say who bears a cyber loss when the procedures were not followed, so the question is answered before the money is gone rather than argued afterward.

Third, insurance. The trustee should carry cyber and fiduciary coverage with limits that match the balances, and the trust should require proof of it annually. A trustee with a fiduciary duty and no insurance is a lawsuit, not a protection.

Questions to ask before you move anything

Who at the trustee can move money, and what authentication does the trustee’s bank require? What does the trustee’s cyber policy cover, exclude and cap?

If the trustee is a family member, does that person understand they now carry the duty the bank never had? The answers decide whether a trust is a safeguard or just another account with a different name on it.

This article is for general information only and is not legal advice. Reading it does not create an attorney-client relationship. Whether a trust structure, trustee or insurance program is appropriate depends on your facts and the governing law. Attorney Advertising. Prior results do not guarantee a similar outcome.