Diaz v. Intuit, Inc.

CHRISTINE DIAZ, et al., Plaintiffs, v. INTUIT, INC., Defendant.

Case No. 5:15-cv-01778-EJD

UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA SAN JOSE DIVISION

May 15, 2018

ORDER GRANTING DEFENDANT'S MOTION TO DISMISS SECOND AND THIRD CLAIMS IN THIRD CONSOLIDATED AMENDED COMPLAINT

Re: Dkt. No. 140

I. INTRODUCTION

In the Third Consolidated Amended Complaint ("Complaint") Plaintiffs Christine Diaz ("Diaz") and Richard Brown ("Brown") allege that Defendant Intuit, Inc. ("Intuit"), knowingly allowed fraudsters to open fake accounts and file fraudulent federal and state tax returns through Intuit's TurboTax tax preparation software. Pursuant to Rule 12(b)(6), Fed.R.Civ.P., Intuit moves to dismiss the second claim for negligence brought by Brown and the third claim for aiding and abetting fraud brought by Brown and Diaz. The Court finds it appropriate to take the motion under submission for decision without oral argument pursuant to Civil Local Rule 7-1(b). For the reasons set forth below, Intuit's motion is granted.

II. BACKGROUND¹

Intuit develops and offers various financial and tax preparation software and related services, including TurboTax, a tax preparation software program. TurboTax can be utilized online or it can be downloaded and installed on a customer's personal computer. Inuit charges persons who file tax returns through TurboTax a "tax preparation fee" generally between approximately $50 and $150, in addition to other fees.

Plaintiffs allege that Intuit has known for years that fraudsters exploit Intuit's lax security in order to open fraudulent accounts with Intuit and file numerous fraudulent tax returns through TurboTax in other peoples' names. Intuit allegedly allows the fraud to occur through TurboTax in two ways: (a) Stolen Identity Refund Fraud ("SIRF"), where a fraudster gathers data about a taxpayer from outside means (such as the black market or "phishing"), creates a fraudulent, new TurboTax account in the victim's name, and files a fraudulent tax return in the victim's name through TurboTax; and (b) Account Takeover Refund Fraud ("ATO"), where a fraudster hacks into an existing TurboTax account and files a fraudulent return in the victim's name through TurboTax.

Intuit allegedly knew that it was allowing SIRF and ATO fraud to occur through TurboTax and that its allegedly lax security protocols were enabling and assisting the fraud. A document circulated among members of Inuit's Consumer Tax Group noted that as many as 10% of TurboTax's tens of millions of annual users were "malicious." Complaint, ¶28. An internal Intuit strategy presentation showed that the number of "suspicious" customers who successfully filed a return using TurboTax grew to approximately 2.5 million by 2012. Id., ¶29.

Intuit allegedly knew that the risk of fraud perpetrated through TurboTax was continuing to increase as the number of major external data breaches increased, exposing the personal identifying information of millions of Americans to would-be fraudsters. Despite knowledge of widely reported data breaches involving identify theft, and knowledge of SIRF and ATO fraud, Intuit allegedly maintained lax security policies. Intuit allegedly chose not to implement basic, fundamental security measures that were suggested by its own experts and by others. Moreover, Intuit eliminated one important protection it previously had in place—a multi-step authentication—in order to make it more convenient to open new accounts and to file returns (fraudulent and otherwise) through TurboTax and thereby generate more revenue for Intuit. The allegedly lax policies also included:

• allowing the re-use of the same Social Security number across numerous TurboTax accounts;

• failing to apply reasonable limits on the number of returns that could be filed from the same account and/or the same mailing address;

• permitting state returns to be filed without a corresponding federal return (an option which allegedly is recognized in the industry as facilitating the filing of fraudulent state returns and is not offered by Intuit's competitors);

• allowing TurboTax "tax preparation fees" to be paid from tax refund proceeds;

• permitting multiple tax refund payments to be delivered to the same bank account;

• allowing filers to receive tax refunds in non-traceable forms;

• providing a service that allows tax refunds to be directed to Intuit's affiliate Santa Barbara Tax Products Group (alternatively referred to as Santa Barbara Bank & Trust) which, after deducting tax preparation fees, sends the balance of the refund by non-traceable means and in non-traceable forms to fraudsters;

• failing to notify or timely notify consumers when fraudulent tax returns and/or tax returns that Intuit deemed "suspicious" were filed in their names;

• failing to timely notify tax authorities of returns Intuit deemed suspicious; and

• keeping open TurboTax accounts that were known to be used entirely for fraud and declining to flag as suspicious returns filed through such accounts.

Intuit allegedly made a deliberate and knowing decision to maintain the protocols described above to generate revenue and market share. Plaintiffs also allege that Intuit's desire to maximize fee revenue caused it to ignore the recommendations of its own security experts, Robert Lee and Shane MacDougall.

Plaintiff Brown was never a TurboTax customer; he never used TurboTax or purchased Turbo Tax software. Brown alleges that Intuit allowed fraudulent tax return(s) to be filed in his name through TurboTax. The first time Brown learned that anything was wrong was when his accountant informed him that he could not e-file his 2014 federal tax return because a fraudulent 2014 tax return had already been filed using his Social Security number. Brown also received a bill from Intuit.

Plaintiff Diaz purchased the desktop version of TurboTax and used it to e-file her tax year 2010 Ohio state and federal tax returns. Since then, Diaz has not used TurboTax. Diaz alleges that Intuit allowed fraudulent tax return(s) to be filed in her name through TurboTax. Diaz learned about the fraudulent tax returns when she received a bill from Intuit for e-filings in her name for Tax Year 2014 for state tax returns in Michigan, Missouri, Ohio and Oklahoma and for a Tax Year 2014 federal home and business tax return. Both Plaintiffs allege that they were the victims of SIRF fraud.

III. STANDARDS

A motion to dismiss under Rule 12(b)(6) tests the legal sufficiency of claims alleged in the complaint. Fed.R.Civ.P. 12(b)(6); Parks School of Business, Inc. v. Symington, 51 F.3d 1480, 1484 (9th Cir. 1995). Dismissal "is proper only where there is no cognizable legal theory or an absence of sufficient facts alleged to support a cognizable legal theory." Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 2001). The complaint "must contain sufficient factual matter, accepted as true, to 'state a claim to relief that is plausible on its face.'" Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)).

IV. DISCUSSION

A. Defendant's Request for Judicial Notice

Intuit requests that the Court take judicial notice of eighteen documents. Plaintiffs oppose the request to the extent Intuit is "improperly trying to use it . . . to challenge the merits, as opposed to the sufficiency, of Plaintiffs' allegations." Plaintiffs' Opposition, p.1. Plaintiffs also disagree with the inferences Intuit seeks to draw from several of the documents. Further, Plaintiffs contend that several documents are not the proper subject of judicial notice and/or are not relevant.

Pursuant to Federal Rule of Evidence 201, a court may judicially notice a fact that is not subject to reasonable dispute because it is generally known or can be accurately and readily determined from sources whose accuracy cannot reasonably be questioned. Defendant's request is granted as to (1) a copy of internal Intuit records related to tax returns associated with a taxpayer whose name and Social Security number match Plaintiff Brown because these records are quoted and incorporated by reference in the Complaint. Tellabs, Inc. v. Makor Issues & Rights, Ltd., 551 U.S. 308, 322 (2007) ("[C]ourts must consider the complaint in its entirety, as well as other sources courts ordinarily examine when ruling on Rule 12(b)(6) motions to dismiss, in particular, documents incorporated into the complaint by reference, and matters of which a court may take judicial notice."); see also Branch v. Tunnell, 14 F.3d 449, 454 (9th Cir. 1994) ("[D]ocuments whose contents are alleged in a complaint and whose authenticity no party questions, but which are not physically attached to the pleading, may be considered in ruling on a Rule 12(b)(6) motion to dismiss"), overruled on other grounds by Galbraith v. Cty. Of Santa Clara, 307 F.3d 1119 (9th Cir. 2002).

Intuit's request is also granted as to the following IRS documents: (2) a copy of IRS Publication 1345 ("Handbook for Authorized IRS e-file Providers of Individual Income Tax Returns"); (3) a copy of IRS Publication 3112 ("IRS e-file Application and Participation"); and (4) a copy of IRS Publication 3415 ("Electronic Tax Administration Advisory Committee's Annual Report to Congress"). A court may take judicial notice of records and reports of administrative bodies. See United States v. 14.02 Acres, 547 F.3d 943, 955 (9th Cir. 2008) (judicial notice is appropriate for records and reports of administrative bodies); Pasillas v. Deutsche Bank Nat'l Trust Co., No. 12-04123 LHK, 2014 WL 1006300, at *3 n.6 (N.D. Cal. Mar. 12, 2014) (taking judicial notice of IRS publication). Intuit's request is also granted as to (5) a copy of IRS Commissioner John Koskinen's October 20, 2015 Remarks at a Security Summit Press Briefing, and a copy of Commissioner Koskinen's June 11, 2015 Press Remarks regarding the Security Summit; (6) a copy of an IRS press release dated April 3, 2014, entitled "As efile Grows, IRS Receives Fewer...