Fiserv answers 10 lawsuits over missing multifactor authentication by saying each client sets its own login security

Fiserv's lawyers wrote that "Ultimately, however, the client determines its risk tolerance" ^[8]. Antwerp's complaint gives that sentence something to test. Premier is the core system holding the bank's customer accounts, and staff log in with a username, a password and "periodically" an emailed one-time passcode, "with an option to use OTP through an authenticator app," according to the complaint ^[9]. The complaint argues that an emailed code is not a real second factor, pointing to NIST guidelines that rule out email for that use ^[10]. The complaint is silent on whether the bank uses the authenticator-app option, and Nerko would not say ^[11]. If the option exists and is switched off, Fiserv has a concrete example of the client choice it describes.

Antwerp's trade-secret theory aims at what Fiserv said about its security. The compliance materials Fiserv sends banks say its practices follow NIST standards, according to the complaint ^[12]. American Banker reported that NIST's main catalog of controls is "mandatory for federal information systems," while private companies are only "encouraged to consider using" it ^[13]. So Antwerp argues that if the contract does not require Fiserv to follow NIST, then Fiserv's claims that it did were "non-contractual statements of fact" ^[14]. A client-chooses defense answers who configures a login screen, and Antwerp's claim turns on whether the compliance materials were accurate. We think a court could treat those as separate questions, and could just as easily fold them into one.

The 10 plaintiffs are about 0.1% of the roughly 10,000 institutions Fiserv serves ^{[16] [4]}. A ruling on who sets login controls would matter mostly to clients who have not sued.

Fiserv says the plaintiffs are motivated by fees. It said Self-Help's termination fees "exceed $1.2 million, and Self-Help does not want to pay them" ^[18]. Nerko told American Banker that his clients "openly challenge exit fees, but the security allegations are specific and independently important" ^[19]. Both can be true at once, and the filings described so far do not separate them.

A judge adopts the client-chooses argument, and configuration risk sits with the institution. A judge accepts the misrepresentation theory, and an unused authenticator option matters less. Or the cases settle as fee disputes, as Fiserv says they are, and no ruling allocates anything. We think the shift onto banks and credit unions is so far only a position in Fiserv's filings, since no case has been dismissed ^[2]. A ruling that adopts the argument, even in a denied motion, would show we have that wrong.