Well, you’ve come to the right place.

When someone tricks a bank in a way that harms you, the legal question governing your recovery from the bank is, “Did the bank act negligently, and did that negligence cause you harm?”

Unlike normal life, where “negligent” means “I didn’t enjoy it,” under the law there are several required elements that constitute negligence. One required element of negligence is that for a party’s negligence create liability, the alleged negligent party must have owed the harmed party a duty at the time of the breach of that duty.

Duty can arise in several ways according to state common and statutory law. For example, a doctor owes the duty of the standard of care to his patient. A driver owes the duty to drive the speed limit to other motorists. The question of whether duty exists in any situation is a complex question of law.

One thing that isn’t complicated, though: in every jurisdiction I’ve researched, a bank owes no duty to a non-customer.

This is why victims of identity fraud don’t sue the bank that granted fraudulent accounts: there is no negligence and will this be no recovery. (With the caveat that I’ve seen people who were harmed by a bank where they randomly happened to have an account… in this circumstance, duty can be ascribed to the bank because a banker-customer relationship in which duty is rooted exists).

Corollary: open an account at every major bank to establish a duty-relationship everywhere.

Poor startup idea of the day: Accounts-at-every-bank-as-a-Service.

Read Ross Anderson book Security Eng., it deals a lot with these types of issues. In short, banks try not do anything about as long they do not have to pay for it.

I suspect the issue is similar here with the multi stakeholder problem here. The college needs as many paying students as possible, the workload of the staff should be as low as possible, the office giving out loans wants to have a low workload... All in all good scammers will serve all these needs and happily take the money in the process.