Depositors' funds were moved without authorized permission. but the terms of services say it's legal.