Not really. Most banks I've asked would not refund if the victim did not take proper security measures, and the OP in this case most certainly did not.
Banks are required to make users whole, even if the user's password is compromised. At least for individual accounts. (For businesses the situation is different.)
http://research.microsoft.com/apps/pubs/default.aspx?id=1618...