Violence at ATMs: When is the Bank Liable?

Violence at ATMs: When is the Bank Liable?

(Originally appeared in Banking Law Journal, October 1997)
Over the past decade or so, there has been a dramatic increase in the number of lawsuits that have been filed against landowners, management companies, retail stores, and various other entities by customers and others who claim to have been injured on business property. The plaintiffs typically argue that the defendants failed to provide adequate security, resulting in their injuries. Banks have been a particularly significant target for plaintiffs in these "premises violence" cases, especially with respect to lawsuits following assaults at automated teller machines. In this article, the author analyzes the principal court decisions and the statutes that various legislatures across the country have enacted in this area.

At about 9:00 p.m. on July 21, 1993, Stephanie Boren drove to an out-door, drive-through type automated teller machine (ATM) at a branch of the Worthen National Bank on Baseline Road in Little Rock, Arkansas. After Boren made a cash withdrawal and began to drive away, two young men who had been hiding behind shrubs and foliage across the street from the ATM approached her car. One of the men began firing a pistol into the car, wounding both Boren and her passenger, Kimberly Vanbibber. At the direction of the gunman, one of the women dropped her wallet, and the other dropped her purse, out the car window; Boren then drove away.

Boren subsequently brought suit against Worthen in an Arkansas state court. She contended that the bank had been negligent in:

  • Failing to install the ATM in a secure manner with proper protective devices against robbers
  • Installing the ATM adjacent to a heavily shrubbed area and housing project
  • Failing to remove or to get permission to remove the nearby foliage
  • Failing to warn banking customers of the danger of robbery at night and during non-business hours
  • Failing to install adequate cameras to monitor the area
  • Failing to illuminate the area with proper lighting
  • Failing to provide a security guard
  • Operating an ATM in an area where the bank knew or should have known its ATM customers were vulnerable

The bank moved for summary judgment and contended that it owed no duty to protect its customers against criminal activity perpetrated by third parties. It conceded during discovery that it had experienced three incidents of theft, robbery, murder, or attempted murder involving its ATM units since January 1, 1986. It also admitted that one of the three incidents had taken place at the Baseline ATM on May 2, 1993 -- fewer than three months before Boren had been assaulted -- and that another incident had occurred on November 6, 1993, after the robbery involving Boren.

The trial court granted the bank's motion, declaring its reluctance "to reassign the duty of protecting our citizens from violent, non-foreseeable third-party criminal acts, from the government to the private sector" and the case reached the Supreme Court of Arkansas1

Reasonable Care

Banks are not "insurers" of the safety of their ATM customers; thus, under existing case law they cannot be held strictly liable for injuries that may occur there.2 The obligation a bank has to its customers is to exercise ordinary or reasonable care for their safety and protection. Although a bank will not be held as an insurer against all forms of risks, it must protect its customers from unreasonable risks of harm of which the bank knows or should have known.3

Put differently, this means that before a bank can be found liable for injuries suffered by a customer at an ATM machine, the customer generally will have to show that the bank had a duty to protect its customers. Whether such a duty exists in any particular case depends on the foreseeability of the harm, i.e., whether the bank should reasonably have known and anticipated the act of the person that resulted in the injuries sustained by the plaintiff.4

Generally speaking, there are three different tests5 that courts use to determine whether a bank may be held liable to an ATM user for criminal acts by third parties based on the forseeability of the criminal act.6

Specific Harm

The first approach is known as the specific harm test. Under this test, foreseeability is limited to situations where the bank is aware of the imminent probability of specific harm to its customer.7 This standard provides that there will be no duty on banks to guard against criminal acts of a third party unless they know or have reason to know that acts are occurring or are about to occur, on the premises that pose imminent probability of harm to a customer or other invitee.

The second test is known as the prior similar incidents test. Courts that have employed this approach have focused on the existence of prior similar incidents to determine whether a particular crime was foreseeable. The duty to police premises found in Section 344 of the Restatement (Second) of Torts,8 which duty requires banks (and other businesses) to take reasonable precautions to protect customers from foreseeable criminal acts, is the underpinning of this approach.9

Under the prior similar incidents standard, the similarity, frequency, location, and proximity in time of the prior incidents are the key elements that courts consider. Typically, courts that employ this approach require that the prior similar incidents be rather numerous. For instance, one court has ruled that two prior incidents were not sufficient to render a robbery at a night deposit box reasonably foreseeable.10 Indeed, the Supreme Court of Alabama has ruled that a bank's knowledge that there had been two prior armed robberies at the bank was insufficient to conclude that the armed robbery of a customer at the bank's ATM was foreseeable, notwithstanding the fact that one of the prior robberies had taken place fewer than ten days before the plaintiff had been assaulted.11

As explained by one court that adopted this test, the fact that a person using an ATM might be subject to robbery is conceivable, but "conceivability is not the equivalent of foreseeability." The court added that to hold a bank liable for a plaintiff's injuries in such a case would be "to stretch the concept of foreseeability beyond acceptable limits."12

Totality of Circumstances

The third test is known as the totality of the circumstances test. This approach to foreseeability also is based on Section 344 of the Restatement (Second) of Torts; however, it expands the determination of foreseeability beyond the prior similar incidents standard to a consideration of all of the circumstances surrounding the event. This standard emphasizes the "place or character of [the] business" language found in comment f to Section 344.13

The analysis thus includes the nature, condition, and location of the property, in addition to any prior similar incidents. Courts that employ this standard have found an inherent risk involved in transacting after-hours banking and have painted foreseeability with especially broad strokes, in at least one instance holding that the robbery of a person using the services of a bank, including an automatic money machine, was clearly foreseeable even where no prior robberies had occurred at that branch.14

Tests Applied

In its decision on Boren's appeal in her suit against Worthen National Bank,15 the Arkansas Supreme Court noted that Boren could not succeed under the specific harm test, because it would be virtually impossible ever to hold a financial institution liable for a criminal act occurring at an ATM: Given that ATMs are almost always unmanned, a bank would never be aware of a specific "imminent probability of harm" to a customer.

Similarly, the court noted that Boren could not succeed under the prior similar incidents test. The court stated that, even if the prior similar incidents test was appropriate, it was not persuaded that one prior incident at the Baseline ATM was sufficient to establish foreseeability. The court added that "[f]or a duty to protect invitees from criminal acts by third persons to arise from prior criminal conduct, the prior crimes must be violent and sufficiently numerous and recent to put the landowner on notice that there is a likelihood of danger."16 Indeed, the court emphasized, the foreseeability of criminal activity on a business property "cannot be predicated on a single previous act of violence."

The court stated that only under the third approach -- the totality of the circumstances test -- would Boren be able to establish that the bank owed her a duty of care. Significantly, however, the court declined to adopt this approach, emphasizing that the majority of jurisdictions that have considered it also have refused to adopt it.

In the court's view, the totality of the circumstances test "would result in the imposition of a duty to guard against random criminal acts by third parties, a duty we have heretofore not imposed on any other businesses." The court added that there were other policy reasons that argued against this standard, including the reluctance of the courts to shift responsibility for violent, nonforeseeable, third-party criminal conduct from the government to the private sector and their unwillingness as a matter of policy to impose a higher duty on banks and other businesses who provide their services in "high crime areas" or "near a housing project," which the court said were the areas in which low- and moderate-income residents commonly are found.

Accordingly, the court held that the bank had no duty to Boren to guard against the criminal acts of a third party, and it affirmed the dismissal of Boren's complaint.

Superior Knowledge

Of course, this decision does not suggest that banks need not be concerned with liability for criminal assaults on customers at ATMS. For one thing, not all courts have rejected the totality of the circumstances approach. There also may be situations where a plaintiff can establish foreseeability under the other tests. Just recently, for example, an appellate court in Georgia concluded that a jury question existed regarding a bank's superior knowledge of the danger at an ATM even in the absence of its knowledge of any similar crimes at that location.17

In addition, a growing number of state and local legislatures have adopted, or are adopting, legislation regulating banks' actions at ATMS.

For instance, California requires that banks consider safety issues relating to the locations of their ATMS, in particular:

  • The presence of landscaping and other obstructions near the ATM
  • The access and parking areas
  • The incidence of violent crimes in the area
  • The law also imposes minimum lighting standards and requires that banks notify customers of the precautions they should take to help to ensure their safety when they use an ATM.18 Similar statutes have been adopted in other states, including Oregonl9 and Washington.20
New York Law

Effective June 1, 1997, a comprehensive New York law took effect. This law also requires that banks take certain precautions with respect to their customers' safety at ATMS.

Under the New York law,21 every bank is required to maintain the following security measures with respect to each of its ATM machines:

  • A surveillance camera or cameras to view and record all people entering a facility containing an ATM or near an outdoor ATM
  • Adequate lighting, which is defined for indoor ATMs as lighting that permits a person inside to readily and easily see all people at the entry door and for outdoor ATMs in terms of minimum candlefoot power
  • Locking doors for indoor ATMs that allow entry only with a magnetic-strip plastic card or similar access device
  • At least one exterior wall that provides an unobstructed view of the interior of an indoor ATM facility, to the extent practical
  • A reflective mirror or mirrors placed in such a manner as to permit a person entering an indoor ATM facility to view areas within that facility that are otherwise concealed to plain view
  • A clearly visible sign that explains that the activity of the ATM facility is being recorded by a surveillance camera or cameras, that customers should close the entry door completely on entering and exiting and should not permit any unknown people to enter after regular banking hours, and that customers place withdrawn cash securely on their person before exiting.
  • Statutory Guidance
  • Of course, banks that are subject to these kinds of statutes must comply with their requirements. However, these laws, as well as the decisions of the courts in cases brought by people who have been harmed at ATM locations, also suggest the kinds of steps that banks in other locations should consider adopting. They may learn that their attempts to prevent harm to customers will make it more difficult for customers who are injured to bring successful lawsuits. In addition, they may discover that the standard of care required of banks ultimately will be deemed to include these steps. At the least, banks may find that customers are more likely to be drawn to their institutions, rather than to banks that do not attempt to protect their customers' safety, after they are made aware of these security measures.

  1. Boren v. Worthen Nat'l Bank, 921 SW2d 934 (Ark. 1996).
  2. Cf. Howard v. Rogers, 249 NE2d 804 (Ohio 1969).
  3. Cf. Cornell v. Aquamarine Lodge, 467 NE2d 896 (Ohio Ct. App. 1983).
  4. Kuhn v. Youlten, 1997 Ohio App. LEXIS 320 (Ohio Ct. App. 1997).
  5. At least two state supreme courts, the Supreme Courts of California and Tennessee, have adopted a somewhat distinct fourth approach -- a balancing test -- in certain cases. The courts issued these decisions in cases that did not involve violence at ATMs. See Ann M. v. Pacific Plaza Shopping Ctr., 6 Cal. 4th 666 (Cal. 1993); McClung v. Delta Square Ltd. Partnership, 937 SW2d 891 (Tenn. 1996).
  6. Of course, in a negligence action, a plaintiff not only has to prove that there was a duty of care owed by the defendant to the plaintiff; the plaintiff also must show conduct falling below the applicable standard of care that amounts to a breach of that duty; an injury or loss; cause in fact; and proximate, or legal, cause. See, e.g., McClung v. Delta Square Ltd. Partnership, 937 SW2d 891 (Tenn. 1996).
  7. See, e.g., Fuga v. Comerica Bank-Detroit, 509 NW2d 778 (Mich. Ct. App. 1993).
  8. Restatement (Second) of Torts § 344 states: "a possessor of land who holds it open to the public for entry for his business purposes is subject to liability to members of the public while they are upon the land for such a purpose, for physical harm caused by the accidental, negligent, or intentionally harmful acts of third persons or animals, and by the failure of the possessor to exercise reasonable care to (1) discover that such acts are being done or are likely to be done, or (2) give a warning adequate to enable the visitors to avoid the harm, or otherwise to protect them against it."
  9. See Dyer v. Norstar Bank, NA, 588 NYS2d 499 (NY App. Div. 1992).
  10. See Golombek v. Marine Midland Bank, NA, 598 NY2d 891 (1993).
  11. Williams v. First Ala. Bank, 545 So. 2d 26 (Ala. 1989). Cf. Taco Bell v. Lannon, 744 P2d 43 (Colo. 1987) (ten armed robberies in three years preceding incident involving plaintiff established that harm to customers was reasonably foreseeable).
  12. Dyer v. Norstar Bank, NA, supra note 9.
  13. Comment f to Section 344 states: "Since the possessor is not an insurer of the visitor's safety, he is ordinarily under no duty to exercise any care until he knows or has reason to know that the acts of the third person are occurring, or are about to occur. He may, however, know or have reason to know, from past experience, that there is a likelihood of conduct on the part of third persons in general which is likely to endanger the safety of the visitor, even though he has no reason to expect it on the part of any particular individual. If the place or character of his business, or his past experience, is such that he should reasonably anticipate careless or criminal conduct on the part of third persons, either generally or at some particular time, he may be under a duty to take precautions against it, and to provide a reasonably sufficient number of servants to afford a reasonable protection."
  14. See Torres v. United States Nat'l Bank, 670 P2d 230 (Or. Ct. App. 1983).
  15. Boren v. Worthen Nat'l Bank, supra note 1.
  16. Id., quoting 3 Premises Liability, Second Edition, § 49 (1995).
  17. Killebrew v. Sun Trust Banks, Inc., 472 SE2d 504 (Ga. Ct. App. 1996).
  18. See Cal. Fin. Code §§ 13000-13070 (West Supp. 1995).
  19. See Or. Rev. Stat. §&$167 714.280-714.315 (1993).
  20. See Wash. Rev. Code §§ 19.174.010-19.174.900 (Supp. 1993).
  21. Banking Law Article 11-AA.