Violence at ATMs: When is the Bank Liable?

Steven R. Merican, P.C.

(Originally appeared in Banking Law Journal, October 1997)

Over the past decade or so, there has been a dramatic increase in the number of lawsuits that have been filed against landowners, management companies, retail stores, and various other entities by customers and others who claim to have been injured on business property. The plaintiffs typically argue that the defendants failed to provide adequate security, resulting in their injuries. Banks have been a particularly significant target for plaintiffs in these "premises violence" cases, especially with respect to lawsuits following assaults at automated teller machines. In this article, the author analyzes the principal court decisions and the statutes that various legislatures across the country have enacted in this area.

At about 9:00 p.m. on July 21, 1993, Stephanie Boren drove to an out-door, drive-through type automated teller machine (ATM) at a branch of the Worthen National Bank on Baseline Road in Little Rock, Arkansas. After Boren made a cash withdrawal and began to drive away, two young men who had been hiding behind shrubs and foliage across the street from the ATM approached her car. One of the men began firing a pistol into the car, wounding both Boren and her passenger, Kimberly Vanbibber. At the direction of the gunman, one of the women dropped her wallet, and the other dropped her purse, out the car window; Boren then drove away.

Boren subsequently brought suit against Worthen in an Arkansas state court. She contended that the bank had been negligent in:

The bank moved for summary judgment and contended that it owed no duty to protect its customers against criminal activity perpetrated by third parties. It conceded during discovery that it had experienced three incidents of theft, robbery, murder, or attempted murder involving its ATM units since January 1, 1986. It also admitted that one of the three incidents had taken place at the Baseline ATM on May 2, 1993 -- fewer than three months before Boren had been assaulted -- and that another incident had occurred on November 6, 1993, after the robbery involving Boren.

The trial court granted the bank's motion, declaring its reluctance "to reassign the duty of protecting our citizens from violent, non-foreseeable third-party criminal acts, from the government to the private sector" and the case reached the Supreme Court of Arkansas1

Reasonable Care
Banks are not "insurers" of the safety of their ATM customers; thus, under existing case law they cannot be held strictly liable for injuries that may occur there.2 The obligation a bank has to its customers is to exercise ordinary or reasonable care for their safety and protection. Although a bank will not be held as an insurer against all forms of risks, it must protect its customers from unreasonable risks of harm of which the bank knows or should have known.3

Put differently, this means that before a bank can be found liable for injuries suffered by a customer at an ATM machine, the customer generally will have to show that the bank had a duty to protect its customers. Whether such a duty exists in any particular case depends on the foreseeability of the harm, i.e., whether the bank should reasonably have known and anticipated the act of the person that resulted in the injuries sustained by the plaintiff.4

Generally speaking, there are three different tests5 that courts use to determine whether a bank may be held liable to an ATM user for criminal acts by third parties based on the forseeability of the criminal act.6

Specific Harm
The first approach is known as the specific harm test. Under this test, foreseeability is limited to situations where the bank is aware of the imminent probability of specific harm to its customer.7 This standard provides that there will be no duty on banks to guard against criminal acts of a third party unless they know or have reason to know that acts are occurring or are about to occur, on the premises that pose imminent probability of harm to a customer or other invitee.

The second test is known as the prior similar incidents test. Courts that have employed this approach have focused on the existence of prior similar incidents to determine whether a particular crime was foreseeable. The duty to police premises found in Section 344 of the Restatement (Second) of Torts,8 which duty requires banks (and other businesses) to take reasonable precautions to protect customers from foreseeable criminal acts, is the underpinning of this approach.9

Under the prior similar incidents standard, the similarity, frequency, location, and proximity in time of the prior incidents are the key elements that courts consider. Typically, courts that employ this approach require that the prior similar incidents be rather numerous. For instance, one court has ruled that two prior incidents were not sufficient to render a robbery at a night deposit box reasonably foreseeable.10 Indeed, the Supreme Court of Alabama has ruled that a bank's knowledge that there had been two prior armed robberies at the bank was insufficient to conclude that the armed robbery of a customer at the bank's ATM was foreseeable, notwithstanding the fact that one of the prior robberies had taken place fewer than ten days before the plaintiff had been assaulted.11

As explained by one court that adopted this test, the fact that a person using an ATM might be subject to robbery is conceivable, but "conceivability is not the equivalent of foreseeability." The court added that to hold a bank liable for a plaintiff's injuries in such a case would be "to stretch the concept of foreseeability beyond acceptable limits."12


Totality of Circumstances
The third test is known as the totality of the circumstances test. This approach to foreseeability also is based on Section 344 of the Restatement (Second) of Torts; however, it expands the determination of foreseeability beyond the prior similar incidents standard to a consideration of all of the circumstances surrounding the event. This standard emphasizes the "place or character of [the] business" language found in comment f to Section 344.13

The analysis thus includes the nature, condition, and location of the property, in addition to any prior similar incidents. Courts that employ this standard have found an inherent risk involved in transacting after-hours banking and have painted foreseeability with especially broad strokes, in at least one instance holding that the robbery of a person using the services of a bank, including an automatic money machine, was clearly foreseeable even where no prior robberies had occurred at that branch.14

Tests Applied
In its decision on Boren's appeal in her suit against Worthen National Bank,15 the Arkansas Supreme Court noted that Boren could not succeed under the specific harm test, because it would be virtually impossible ever to hold a financial institution liable for a criminal act occurring at an ATM: Given that ATMs are almost always unmanned, a bank would never be aware of a specific "imminent probability of harm" to a customer.

Similarly, the court noted that Boren could not succeed under the prior similar incidents test. The court stated that, even if the prior similar incidents test was appropriate, it was not persuaded that one prior incident at the Baseline ATM was sufficient to establish foreseeability. The court added that "[f]or a duty to protect invitees from criminal acts by third persons to arise from prior criminal conduct, the prior crimes must be violent and sufficiently numerous and recent to put the landowner on notice that there is a likelihood of danger."16 Indeed, the court emphasized, the foreseeability of criminal activity on a business property "cannot be predicated on a single previous act of violence."

The court stated that only under the third approach -- the totality of the circumstances test -- would Boren be able to establish that the bank owed her a duty of care. Significantly, however, the court declined to adopt this approach, emphasizing that the majority of jurisdictions that have considered it also have refused to adopt it.

In the court's view, the totality of the circumstances test "would result in the imposition of a duty to guard against random criminal acts by third parties, a duty we have heretofore not imposed on any other businesses." The court added that there were other policy reasons that argued against this standard, including the reluctance of the courts to shift responsibility for violent, nonforeseeable, third-party criminal conduct from the government to the private sector and their unwillingness as a matter of policy to impose a higher duty on banks and other businesses who provide their services in "high crime areas" or "near a housing project," which the court said were the areas in which low- and moderate-income residents commonly are found.

Accordingly, the court held that the bank had no duty to Boren to guard against the criminal acts of a third party, and it affirmed the dismissal of Boren's complaint.

Superior Knowledge
Of course, this decision does not suggest that banks need not be concerned with liability for criminal assaults on customers at ATMS. For one thing, not all courts have rejected the totality of the circumstances approach. There also may be situations where a plaintiff can establish foreseeability under the other tests. Just recently, for example, an appellate court in Georgia concluded that a jury question existed regarding a bank's superior knowledge of the danger at an ATM even in the absence of its knowledge of any similar crimes at that location.17

In addition, a growing number of state and local legislatures have adopted, or are adopting, legislation regulating banks' actions at ATMS.

For instance, California requires that banks consider safety issues relating to the locations of their ATMS, in particular:

The law also imposes minimum lighting standards and requires that banks notify customers of the precautions they should take to help to ensure their safety when they use an ATM.18 Similar statutes have been adopted in other states, including Oregonl9 and Washington.20

New York Law
Effective June 1, 1997, a comprehensive New York law took effect. This law also requires that banks take certain precautions with respect to their customers' safety at ATMS.

Under the New York law,21 every bank is required to maintain the following security measures with respect to each of its ATM machines:

Statutory Guidance
Of course, banks that are subject to these kinds of statutes must comply with their requirements. However, these laws, as well as the decisions of the courts in cases brought by people who have been harmed at ATM locations, also suggest the kinds of steps that banks in other locations should consider adopting. They may learn that their attempts to prevent harm to customers will make it more difficult for customers who are injured to bring successful lawsuits. In addition, they may discover that the standard of care required of banks ultimately will be deemed to include these steps. At the least, banks may find that customers are more likely to be drawn to their institutions, rather than to banks that do not attempt to protect their customers' safety, after they are made aware of these security measures.

1Boren v. Worthen Nat'l Bank, 921 SW2d 934 (Ark. 1996).
2Cf. Howard v. Rogers, 249 NE2d 804 (Ohio 1969).
3Cf. Cornell v. Aquamarine Lodge, 467 NE2d 896 (Ohio Ct. App. 1983).
4Kuhn v. Youlten, 1997 Ohio App. LEXIS 320 (Ohio Ct. App. 1997).
5At least two state supreme courts, the Supreme Courts of California and Tennessee, have adopted a somewhat distinct fourth approach -- a balancing test -- in certain cases. The courts issued these decisions in cases that did not involve violence at ATMs. See Ann M. v. Pacific Plaza Shopping Ctr., 6 Cal. 4th 666 (Cal. 1993); McClung v. Delta Square Ltd. Partnership, 937 SW2d 891 (Tenn. 1996).
6Of course, in a negligence action, a plaintiff not only has to prove that there was a duty of care owed by the defendant to the plaintiff; the plaintiff also must show conduct falling below the applicable standard of care that amounts to a breach of that duty; an injury or loss; cause in fact; and proximate, or legal, cause. See, e.g., McClung v. Delta Square Ltd. Partnership, 937 SW2d 891 (Tenn. 1996).
7See, e.g., Fuga v. Comerica Bank-Detroit, 509 NW2d 778 (Mich. Ct. App. 1993).
8Restatement (Second) of Torts § 344 states: "a possessor of land who holds it open to the public for entry for his business purposes is subject to liability to members of the public while they are upon the land for such a purpose, for physical harm caused by the accidental, negligent, or intentionally harmful acts of third persons or animals, and by the failure of the possessor to exercise reasonable care to (1) discover that such acts are being done or are likely to be done, or (2) give a warning adequate to enable the visitors to avoid the harm, or otherwise to protect them against it."
9See Dyer v. Norstar Bank, NA, 588 NYS2d 499 (NY App. Div. 1992).
10See Golombek v. Marine Midland Bank, NA, 598 NY2d 891 (1993).
11Williams v. First Ala. Bank, 545 So. 2d 26 (Ala. 1989). Cf. Taco Bell v. Lannon, 744 P2d 43 (Colo. 1987) (ten armed robberies in three years preceding incident involving plaintiff established that harm to customers was reasonably foreseeable).
12Dyer v. Norstar Bank, NA, supra note 9.
13Comment f to Section 344 states: "Since the possessor is not an insurer of the visitor's safety, he is ordinarily under no duty to exercise any care until he knows or has reason to know that the acts of the third person are occurring, or are about to occur. He may, however, know or have reason to know, from past experience, that there is a likelihood of conduct on the part of third persons in general which is likely to endanger the safety of the visitor, even though he has no reason to expect it on the part of any particular individual. If the place or character of his business, or his past experience, is such that he should reasonably anticipate careless or criminal conduct on the part of third persons, either generally or at some particular time, he may be under a duty to take precautions against it, and to provide a reasonably sufficient number of servants to afford a reasonable protection."
14See Torres v. United States Nat'l Bank, 670 P2d 230 (Or. Ct. App. 1983).
15Boren v. Worthen Nat'l Bank, supra note 1.
16Id., quoting 3 Premises Liability, Second Edition, § 49 (1995).
17Killebrew v. Sun Trust Banks, Inc., 472 SE2d 504 (Ga. Ct. App. 1996).
18See Cal. Fin. Code §§ 13000-13070 (West Supp. 1995).
19See Or. Rev. Stat. §&$167 714.280-714.315 (1993).
20See Wash. Rev. Code §§ 19.174.010-19.174.900 (Supp. 1993).
21Banking Law Article 11-AA.