Actually, I'd say it doesn't wash for other reasons: the staff making this kind of decision may very well have had reasonably unfettered internet access (I used to work for a bank, and your access varied according to your role and how high up you were), but they wouldn't be technologically savvy enough to know what sites found via Google could be trusted or not. It's also not something you can put in a SAR (Suspicious Activity Report) - something that's going to be read, potentially, by auditors, regulators, and the gods know who. You'd need something a bit more solid than 'Googled it, looks legit'.