well, note that the keylogger in question was 2 years old roughly, at least a year old at the time of the event anyway.
I'm with the bank there, if there has been a definition for it for a year its negligence. If its new, its unlucky but probably still could have been avoided.