B eaman v. Bank of Am.

1

CASSANDRA VALERIE BEAMAN, STEFAN BROOKS, and LAURA ROSELLI, individually and on behalf of others similarly situated, Plaintiffs, v. BANK OF AMERICA, N.A., Defendant.

No. 2:21-cv-20561 (BRM) (LDW)

United States District Court, D. New Jersey

June 28, 2024

OPINION

HON BRIAN R. MARTINOTTI, UNITED STATES DISTRICT JUDGE

Before the Court is Defendant Bank of America, N.A.'s (“BOA”) Motion to Dismiss (ECF No. 55) the Third Amended Class Action Complaint (“TAC”) (ECF No 52), filed by Plaintiffs Cassandra Valerie Beaman (“Beaman”), Stefan Brooks (“Brooks”) and Laura Roselli (“Roselli”) (collectively “Plaintiffs” or “Class Representatives”), individually and on behalf of all others similarly situated. Plaintiffs filed an Opposition. (ECF No. 56.) BOA filed a Reply. (ECF No. 57.) Having reviewed the parties' submissions filed in connection with the Motion and having declined to hold oral argument pursuant to Federal Rule of Civil Procedure 78(b), for the reasons set forth below and for good cause having been shown, BOA's Motion to Dismiss (ECF No. 55) is GRANTED IN PART and DENIED IN PART.

I. Background^[1]

For the purpose of this Motion to Dismiss, the Court accepts the factual allegations in the TAC as true and draws all inferences in the light most favorable to Plaintiffs. See Phillips v. Cnty. of Allegheny, 515 F.3d 224, 228 (3d Cir. 2008). The Court also considers any “document integral to or explicitly relied upon in the [TAC].” In re Burlington Coat Factory Sec. Litig., 114 F.3d 1410, 1426 (3d Cir. 1997) (quoting Shaw v. Digit. Equip. Corp., 82 F.3d 1194, 1220 (1st Cir. 1996)).

A. Factual Background

Plaintiffs are residents of the State of New Jersey, who lost their jobs during the COVID-19 pandemic (the “Pandemic”), and who received and relied upon New Jersey Department of Labor & Workforce Development^[2] (“LWD”) unemployment and other public benefits, administered through their respective BOA accounts, and accessible by a BOA LWD debit card. (ECF No. 52 ¶¶ 1, 9-11.) BOA is a Delaware corporation and financial institution with an exclusive contract to administer unemployment benefits and other payments through LWD debit cards and accounts (the “Contract”). (Id. ¶ 12.) Pursuant to the Contract, Plaintiffs and Class Members, which include all others similarly situated to Plaintiffs, received periodic payments through the BOA-issued prepaid debit cards, which are linked to individual BOA depository accounts, to access their benefits. (Id. ¶ 2.)

Plaintiffs submit, upon information and belief, BOA and LWD entered into the Contract some time prior to 2020. (Id. ¶ 15.) At all relevant times thereafter, LWD distributed benefits pursuant to the Contract, through BOA-issued and administered debit cards. (Id. ¶ 17.) Under the terms of the Contract, BOA would disperse to each claimant the entire amount authorized by LWD, without commingling the benefits with any other funds, and without any alteration or adjustment. (Id. ¶ 20.) In exchange, BOA agreed to fully protect LWD debit cardholders in the event they became victims of fraud. (Id. ¶ 18.) Specifically, BOA agreed to comply with all Electronic Fund Transfers Act (“EFTA”) requirements and timelines with respect to error resolution, and BOA extended their “Zero Liability protection on disputed claims” to the transactions. (Id. ¶ 18.) The Contract between LWD and BOA was contingent on BOA's description of their error resolution process. (Id. ¶ 19.)

However, Plaintiffs allege BOA failed to secure Plaintiffs' and Class Members' personally identifiable information and other sensitive debit card and account information in a reasonably secure manner. (Id. ¶ 21.) Specifically, BOA issued LWD cards without industry-standard, fraudpreventing Europay, Mastercard, and Visa (“EMV”) chips, which BOA has used on all of its regular consumer debit cards since 2014. (Id. ¶ 2.) Further, BOA failed to take reasonable steps to ensure that the Plaintiffs' and Class Members' personably identifiable information was appropriately handled by BOA's subcontractors, employees, and agents with access to said information. (Id.) As a result, both Plaintiffs' and Class Members' cardholder information has been obtained by unauthorized third parties in a series of security breaches, resulting in unauthorized transactions on their accounts and access to their personal information. (Id. ¶¶ 22-23.)

1. Evolution of Fraud-Combatant Technology Standards

Plaintiffs assert that from the 1960s until approximately ten years ago, banks used magnetic stripes to store consumer information on debit and credits cards in the United States. (Id. ¶ 25.) However, because the stripes are static and easily readable, they are also highly susceptible to fraud. (Id. ¶ 26.) Through a process called “skimming,” third parties can access and use information from the card to clone it and conduct unauthorized transactions. (Id.) Skimming has resulted in hackers capturing the personal data of over tens of millions of people. (Id. ¶ 27.)

To combat the fraud enabled by magnetic stripes, banks have adopted EMV chip technology as the industry standard. (Id. ¶ 28.) EMV chips are “dynamic” and create a unique signature for every transaction, rendering debit card data from past purchases useless to hackers. (Id.) BOA, specifically, began using EMV chips in corporate credit cards for customers who regularly traveled outside of the United States in 2011. (Id. ¶ 29.) In 2014, BOA announced it would use chip technology on all new and reissued consumer debit cards to “increas[e] card security.” (Id. ¶ 30.) By 2015, banks, generally, began a shift toward EMV chip cards, and by 2017, the cards became the industry norm. (Id. ¶ 31.) On BOA's website, BOA acknowledges that EMV chip technology is the security standard, is more secure, and makes a card more difficult to counterfeit or copy. (Id. ¶ 33.) Still, BOA issued LWD debit cards without EMV chips to hundreds of thousands of New Jerseyans-Plaintiffs and Class Members-which Plaintiffs allege resulted in predictable and rampant fraud. (Id. ¶ 34.)

2. BOA's Representations to Cardholders

In a Cardholder Agreement on BOA's website, BOA represented they would be responsible for unauthorized transactions on their LWD debit cards or accounts because of the bank's “zero liability” policy. (Id. ¶ 35.) BOA also represented they were available twenty-four hours a day, seven days per week, to receive reports of any unauthorized transactions, and would promptly investigate the transaction to determine whether it was unauthorized within ten business days. (Id.) If the bank took longer than ten business days to investigate, BOA would credit the account for the amount believed to be in error. (Id.) Plaintiffs allege this agreement was in effect at the time Plaintiffs received their benefits and has been effective over the duration relevant to this case. (Id. ¶ 36.)

3. Third-Party Fraud of LWD Debit Card Accounts

In the spring of 2020, the Pandemic resulted in hundreds of thousands of workers losing their jobs, and the state's unemployment rate skyrocketed to record heights. (Id. ¶ 37.) Since the start of the Pandemic in 2020, LWD received over 200,000 claims for unemployment benefits, and BOA issued thousands of LWD debit cards to New Jersey residents. (Id. ¶ 38.) Tens of thousands of those debit cardholders have been victims of fraud during the Pandemic, and tens of millions of dollars have been stolen from their accounts. (Id. ¶ 39.) The reported fraud has occurred in various forms, including massive ATM withdrawals, thousand-dollar charges at luxury vendors, and repeated transactions with food delivery services. (Id. ¶ 40.) Criminals have also exploited the security vulnerabilities to misappropriate cardholder information. (Id. ¶ 41.) Plaintiffs claim the increase in fraud during the Pandemic was foreseeable, but BOA nonetheless failed to take reasonable measures to prepare for and prevent the fraud. (Id. ¶ 42.)

4. BOA's Pre-Suit Response to Fraud

After the increase in fraudulent activity, BOA failed to employ reasonable procedures for monitoring, detecting, stopping, and notifying Plaintiffs and Class Members about suspicious transactions; failed to answer customer service phone lines it advised LWD cardholders to call; established “customer service” procedures that frustrated Plaintiffs' and Class Members' efforts to file fraud claims; closed fraud claims without a reasonable and good faith investigation; reversed “permanent” credits previously granted for unauthorized transitions without good faith basis and without notice to LWD cardholders; failed to extend provisional credit to LWD cardholders; and indefinitely froze and blocked accounts of the cardholders who reported third-party fraud on their accounts. (Id. ¶ 43.) This is due, in part, to BOA's failure to adequately staff its call centers and provide reasonable levels of assistance to the predictably large number of cardholders seeking assistance during the pandemic. (Id. ¶ 44.)

Since October 2020, BOA had a policy and practice of automatically and summarily denying fraud claims of LWD debit cardholders without adequate investigation or explanation, using the bank's automated fraud filter (“Claim Fraud Filter”). (Id. ¶ 45.) When a LWD debit cardholder reported an unauthorized transaction, the Claim Fraud Filter flagged the report and, within a day or two of the complaint, sent a form letter closing the cardholder's claim before investigating the claim. (Id.) LWD debit cardholders who have called the bank for further information have been given erroneous instructions or told they could not be helped, even after providing detailed documentation in support of their claims. (Id. ¶ 46.) Even those whose claims were reopened for investigation...