Court: Banks have some fraud liability — but security is still the SMB’s responsibility