Carter Pape

| Key insight : Financial institutions appear in this case in two roles, as breached customers whose data got stolen and as card issuers absorbing the cost of a merchant's breach.

Key insight : A month after the cyberattack, TruStage still cannot say whether anyone's data was taken, and it would not say whether it will meet its own mid-August target to restore most key processes.

Key insight : New York named a commercial software product, conceded the flaw probably isn't at the banks receiving the alert, and made their boards answerable for it anyway.

Key insight: Banks and credit unions filed about 3% of the suspected human smuggling reports FinCEN counted but accounted for about 61% of the suspicious dollars.

Key insight : New York's regulator says the N-central flaw reached firms it supervises, and American Banker identified Sawyer Savings Bank as possibly among them.

Key insight : Two of the ring's three methods produced authentic state records rather than forged ones, so a bank pulling the registry would have found a real filing behind the name.

Key insight : The SEC is pursuing as securities fraud the same Tricolor conduct that federal prosecutors charged as a fraud against the company's bank lenders.

Key insight : The indictment names 16 federally insured banks as victims of a single borrower, from rural community banks in Oklahoma and Kansas to Texas Capital Bank and BOKF.

Key insight : The scheme did not defeat account opening so much as what comes after it.

The stolen checks drew on accounts at five banks: JPMorganChase, Citibank, BMO, Stellar Bank and Amegy Bank (a division of Zions Bancorporation).