Since when it's the client's fault for the poor security of the bank? She never checked it but so what? You shouldn't have let someone withdraw all that money with a fake proxy letter （/TДT)/
