The allegations
In one case, two Orlando-area companies, K&A Rosario Holdings and MJR Fund, say a caller claiming to be an account holder with a new iPhone got a reissued security token on March 3, 2026. Six wires totaling $4.85 million left one account within about 80 minutes, and by March 5 a dozen wires totaling $6.5 million had left both companies' accounts; more than $4.5 million is still missing, according to the lawsuit as reported by American Banker [1]. The case was filed in Florida state court in May and moved to federal court in Orlando in June [2].
In the other case, Palm Beach law firm Rabideau Klein says a phishing email on January 27 gave an attacker access to a firm email account. The attacker then had the firm's phone lines forwarded, reset a partner's online banking password and called the bank for a new token. Thirteen wires totaling $17.3 million left an attorney trust account; about $10.7 million has been recovered and about $6.55 million is missing, according to American Banker [1].
The bank's response
A First Horizon spokesperson said the bank's "systems, controls and protections functioned appropriately" in the Rabideau Klein matter and that those wires resulted from security failures at the firm, which the bank says declined a recommended dual-approval control. The bank said it intends to defend the K&A case vigorously [1].
Under the Uniform Commercial Code rules for wire transfers, a bank generally bears the loss on an unauthorized wire unless it followed a commercially reasonable security procedure the customer agreed to and acted in good faith. The K&A plaintiffs argue the bank knew of the pattern by late January; First Horizon has asked the court to strike those allegations [1].
What remains uncertain
These are allegations in civil lawsuits and have not been proven. Details come from the complaints as reported by American Banker; the court has not ruled on liability.