THOMAS O. RICE, District Judge.
BEFORE THE COURT are Defendant Bank of America, N.A.'s Motion for Summary Judgment (ECF No. 37), Defendant Bank of America Corporation's Motion for Summary Judgment (ECF No. 44), Plaintiff's Motion to Strike Declaration of Lisa Stensgaard (ECF No. 47) and Defendants' Motions to Exclude Expert Testimony of Brian H. Kelley and Charisse Castagnoli (ECF Nos. 50; 52). These motions were submitted for consideration without oral argument. The Court has reviewed the record and the parties' completed briefing and is fully informed.
Plaintiff filed its Second Amended Complaint on July 21, 2014, alleging Defendants were liable for processing three fraudulent fund transfer requests in April 2013. ECF No. 18. Defendants moved the Court for summary judgment on April 24, 2015. ECF Nos. 37; 44. On April 29, 2015, Plaintiff moved the Court to strike the declaration of Lisa Stensgaard, submitted in support of Bank of America, N.A.'s motion for summary judgment. ECF No. 47. The same day, Defendants filed motions to exclude the testimony of Plaintiff's proffered experts, Brian H. Kelley and Charisse Castagnoli. ECF Nos. 50; 52.
Plaintiff concedes Defendant Bank of America Corporation's motion for summary judgment and does not oppose dismissal of all claims against Bank of America Corporation. ECF No. 70. The Court therefore grants the motion (ECF No. 44) and dismisses all claims against Bank of America Corporation. All further references to "Defendant" in this Order refer only to Bank of America, N.A.
Under Washington State law, county treasurers are required to hold and disburse funds for certain public entities. See RCW 36.29.010; see also ECF Nos. 38 at ¶ 3; 69 at ¶ 3. One such public entity in Chelan County, Washington, is the Chelan County Public Hospital District No. 1, also known as the Cascade Medical Center ("Cascade"). ECF Nos. 38 at ¶ 4; 69 at ¶ 4. This case involves three unauthorized payments from Plaintiff's bank account.
Plaintiff has held a number of accounts with Defendant since at least 2008. ECF Nos. 38 at ¶ 6; 69 at ¶ 6. Two of these accounts are relevant to the matter before the Court: Plaintiff's main operating account and Plaintiff's direct deposit account. ECF Nos. 38 at ¶ 9; 69 at ¶ 9. The main operating account held Plaintiff's tax receipts and other deposits, including deposits from county entities such as Cascade.
Prior to 2010, Defendant provided Plaintiff with online banking software called Bank of America Direct ("Direct"). ECF No. 68 at ¶ 6. In June 2010, Defendant informed Plaintiff that its software would be converted to a new online banking platform called CashPro. ECF No. 68 at ¶ 7. CashPro contains multiple "modules" for different banking activities. ECF No. 68 at ¶ 9. The module dedicated to ACH transactions was not upgraded in the process of converting to the CashPro platform. Id. Plaintiff and Cascade were still using the Direct ACH module to process ACH transactions when the fraudulent transactions occurred in April 2013. ECF Nos. 67-1 at 61; 68 at ¶ 14.
To process a payroll payment in April 2013, a Cascade employee would first login to the CashPro platform with a unique user ID, company ID, and password. ECF Nos. 38 at ¶¶ 11, 27; 69 at ¶¶ 11, 27. The platform created a digital fingerprint of each authorized computer and issued a challenge question for login attempts from computers the platform did not recognize. ECF No. 38 at ¶ 29; 69 at ¶ 29. The platform would also validate a digital certificate installed on each authorized computer; unauthorized computers were not granted access. ECF No. 38 at ¶ 30; 69 at ¶ 30. Finally, the CashPro platform would run an automatic fraud scoring process, analyzing login patterns and behaviors, which would identify high-risk logins for manual review. ECF No. 38 at ¶ 28; 69 at ¶ 28.
Upon login, a Cascade employee with the proper authorization or "entitlement" could select the Direct ACH transfer module to create a payroll payment order. ECF Nos. 38 at ¶ 11; 68 at ¶ 21; 69 at ¶ 11. Once the payroll was initiated and approved in the Direct ACH module, Cascade's employee would then email or fax the total dollar amount of the payroll payment to the County Treasurer's office. ECF Nos. 38 at ¶ 22; 68 at ¶ 22; 69 at ¶ 22. A County Treasurer employee would then "approve" the payroll by manually transferring a corresponding amount from the main operating account to the direct deposit account. ECF Nos. 38 at ¶ 22; 68 at ¶ 23; 69 at ¶ 22. As discussed in detail below, the parties dispute whether Defendant had knowledge of this manual transfer procedure. ECF No. 38 at ¶ 24; 68 at ¶ 27; 69 at ¶ 24.
On Thursday, April 18, 2013, at 12:28 p.m.,
A second batch payment order for seventeen recipients was then initiated and also set to be settled on April 19. ECF Nos. 38 at ¶¶ 61-62; 69 at ¶¶ 61-62. This second order was approved in the ACH module at 2:12 p.m. and picked up by Defendant's internal transfer routing system at 2:36 p.m. ECF Nos. 38 at ¶¶ 61-62; 69 at ¶¶ 61-62. The total amount of the batch order was $111,300.00. ECF Nos. 38 at ¶ 62; 69 at ¶ 62.
The next day, Friday, April 19, 2013, at 3:22 p.m., the same login information was again used to access CashPro, which again validated the digital certificate and fingerprint. ECF Nos. 38 at ¶ 64; 69 at ¶ 64. A third batch payment order was created for fifty-six recipients with an effective date of Monday, April 22, 2013 (the next business day). ECF Nos. 38 at ¶ 64; 69 at ¶ 64. The order was approved in the ACH module at 4:13 p.m. and picked up by Defendant's internal transfer system at 4:33 p.m. ECF Nos. 38 at ¶¶ 64-65; 40-2 at 6; 69 at ¶¶ 64-65. The total amount of this order was $603,575.00. ECF Nos. 38 at ¶ 65; 69 at ¶ 65.
The three payment orders were created by a third party, or third parties, who gained access to Adams' computer via a computer virus or other malware. ECF Nos. 38 at ¶ 67; 69 at ¶ 67. Adams initially reported strange behavior on her computer to Cascade's information technology department on April 18. ECF No. 38 at ¶ 74; 39-1 at 84; 69 at ¶ 74. Several scans were run on the computer on April 18 and 19 that discovered a virus which was removed on April 19. ECF Nos. 38 at ¶ 75; 69 at ¶ 75. The computer itself remained in service until after the unauthorized transactions were discovered on April 22. ECF Nos. 38 at ¶¶ 75-76; 69 at ¶¶ 75-76.
Theresa Foltz, an accountant in the County Treasurer's office, discovered the fraudulent transfers while reviewing an activity report for the direct deposit account early Monday morning, April 22, 2013. ECF No. 39-1 at 55.
By the morning of April 22, all of the requested payment orders had been made available to the receiving accounts. ECF Nos. 38 at ¶ 71; 69 at ¶ 71. As a result, the direct deposit account held a negative balance of $1,003,069.00. ECF Nos. 38 at ¶ 66; 68 at ¶ 43; 69 at ¶ 66. When informed that the transfers were unauthorized, Defendant issued reversals to the receiving banks, but was only able to recover a portion of the transferred funds. ECF Nos. 38 at ¶ 72; 68 at ¶ 46; 69 at ¶ 72.
This case involves application of Article 4A of the Uniform Commercial Code as codified in Washington State, RCW 62A.4A-101 et seq.
To establish standing, a "plaintiff must have suffered or be imminently threatened with a concrete and particularized `injury in fact' that is fairly traceable to the challenged action of the defendant and likely to be redressed by a favorable judicial decision." Lexmark Int'l, Inc. v. Static Control Components, Inc., 134 S.Ct. 1377, 1386 (2014). In diversity actions such as this one, a state statute which creates a concrete legal interest may satisfy the injury-in-fact requirement for federal standing, provided the interest is related to the plaintiff's actual injury. See Vt. Agency of Nat'l Res. v. U.S. ex rel. Stevens, 529 U.S. 765, 772-773 (2000) ("The interest must consist of obtaining compensation for, or preventing, the violation of a legally protected right."); Cantrell v. City of Long Beach, 241 F.3d 674, 684 (9th Cir. 2001) (holding that a state statute which creates purely prospective relief does not establish Article III standing).
It is undisputed that the funds at issue were disbursed from an account Plaintiff held with Defendant. It is also undisputed that the loss is allegedly traceable to Defendant's actions in processing the unauthorized transactions. Defendant argues, however, that Plaintiff suffered no actual injury because the money lost "was Cascade's, not [Plaintiff's]," and because "Cascade must reimburse" Plaintiff for the lost money. ECF No. 81 at 2. First, the Court notes the logical contradiction in these arguments. If the lost funds did indeed belong to Cascade, then there would be no need for Cascade to reimburse Plaintiff for their loss. That Plaintiff would seek reimbursement from Cascade indicates that Plaintiff has suffered injury.
Second, the record before the Court establishes that payment orders were effectuated from Plaintiff's direct deposit account creating a negative balance. Whether Cascade, the County or some other entity eventually covered the loss in that account does not divest the County from suffering the loss to its direct deposit account.
Most importantly, the loss of the funds is redressable under Article 4A. Article 4A requires banks to issue refunds for unauthorized payment orders issued in the name of a customer. RCW 62A.4A-204(a). Article 4A defines a "customer" as a person "having an account with a bank or from whom a bank has agreed to receive payment orders." RCW 62A.4A-105(a)(3). While it is undisputed that Plaintiff held an account with the bank, the parties dispute whether the payment orders were issued in the name of Plaintiff or Cascade. ECF Nos. 37 at 6; 63 at 21. The record indicates that the authorization for Cascade to initiate ACH transfers was executed by David Griffiths in his role as the Chelan County Treasurer. See ECF No. 40-1 at 8, 16-18. While a Cascade employee may initiate the payment orders, they were processed on behalf of Plaintiff and from an account held by Plaintiff. As such, RCW 62A.4A-204 creates a concrete monetary interest related to the injury Plaintiff suffered. Plaintiff has standing to pursue the Article 4A claim.
Plaintiff moves to strike the declaration of Lisa Stensgaard as a sanction for Defendant's alleged violation of discovery obligations. ECF No. 47 at 3. Specifically, Plaintiff contends that the declaration was responsive to Plaintiff's document request and Defendant had a continuing "obligation to produce it when it was created." Id. Defendant contends that there was no obligation to provide the declaration to Plaintiff because (1) it falls under the work product exception to discovery, (2) Plaintiff was aware that Stensgaard possessed discoverable information, and (3) the declaration is not a "document" under the purview of Federal Rule of Civil Procedure 26. ECF No. 55.
Rule 26(b) allows parties to obtain discovery "regarding any nonprivileged matter that is relevant to any party's claim or defense—including the existence, description, nature, custody, condition, and location of any documents or other tangible things and the identity and location of persons who know of any discoverable matter." Fed. R. Civ. P. 26(b)(1). Parties have a continuing obligation to provide requested discovery materials. Fed. R. Civ. P. 26(e). However, the rule excludes from the discovery obligations "documents and tangible things that are prepared in anticipation of litigation or for trial" unless "they are otherwise discoverable" and the requesting party shows a "substantial need for the materials." Fed. R. Civ. P. 26(b)(3)(A). A document is prepared "in anticipation of litigation" if "in light of the nature of the document and the factual situation in the particular case, the document can be fairly said to have been prepared or obtained because of the prospect of litigation." In re Grand Jury Subpoena (Torf), 357 F.3d 900, 907 (9th Cir. 2004) (quoting 8 CHARLES ALAN WRIGHT, ARTHUR R. MILLER & RICHARD L. MARCUS, FEDERAL PRACTICE AND PROCEDURE § 2024 (2d ed. 1994)).
The declaration of a witness prepared in anticipation of filing a motion for summary judgment is a document "prepared in anticipation of litigation." Such declarations "assemble information, sift . . . relevant [facts] from the irrelevant facts," and can relay legal theory and strategy to those reading it, and, as such, are not discoverable under Rule 26. See Hickman v. Taylor, 329 U.S. 495, 511 (1947). Moreover, although reduced to written form, the declaration is not a "document" as understood in Rule 26. Rather, the declaration is in essence proffered testimony, the substance of which is discoverable through interrogatories or the deposition of a witness, not through document requests. See Intel Corp. v. VIA Technologies, Inc., 204 F.R.D. 450, 451-52 (N.D. Cal. 2001). Plaintiff's motion is denied to the extent the failure to produce the declaration itself is a violation of Defendant's discovery obligations.
That said, Defendant did have an obligation to disclose the substance of Stensgaard's declaration as it related to discoverable information Plaintiff requested by interrogatory. See Fed. R. Civ. P. 33. This obligation was a continuing one and required Defendant to supplement any interrogatories in a timely manner upon discovery of new information relating to the interrogatory. Fed. R. Civ. P. 26(e)(1).
Interrogatory No. 20 in Plaintiff's Second Interrogatories requested of Defendant: "If you contend that Bank of America offered and Chelan County refused a commercially reasonable security procedure between October 25, 2010[,] and April 18, 2013, state the dates and substance of each offer and refusal." ECF No. 77 at 35.
After noting objections to the breadth and vagueness of the interrogatory, Defendant replied substantively:
ECF No. 56-1 at 18-19.
Defendant did not disclose in this response significant facts later reported in the Stensgaard declaration. These facts include that Stensgaard "had several conversations with the County's representative, Theresa Pinneo, about the County's [security decisions], and [Stensgaard] warned her that the changes to the account structure posed a security risk" as well as that Stensgaard "advised the County repeatedly" to adopt more secure procedures. ECF No. 42 at 6. The Court finds that Defendant failed to fully comply with its obligation to provide a complete response to Plaintiff's interrogatory because the response does not identify Stensgaard or indicate that she participated in multiple communications relevant to the interrogatory.
However, the Court concludes that exclusion of Stensgaard's declaration or testimony is not a proper remedy. Because the Court denies Defendant's motion for summary judgment, any prejudice to Plaintiff resulting from the belated disclosure of the substance of Stensgaard's testimony is minimal. Plaintiff has ample opportunity to prepare for and counter the testimony offered by Stensgaard at trial. Further, the Court will consider a request that Stensgaard submit to a deposition, provided the parties cannot reach an agreement on the matter themselves in light of the late disclosure of the substance of her testimony. Because Plaintiff is not prejudiced by the belated disclose, the Court denies the motion to strike the declaration.
Defendant moves to exclude the testimony of two experts proffered by Plaintiff. ECF Nos. 50; 52. Defendant contends that Brian H. Kelley and Charisse Castagnoli lack "the `knowledge, skill, experience, training, or education' necessary to testify about bank security." ECF Nos. 50 at 2, 4-7 (quoting Fed. R. Evid. 702); 52 at 2, 5-7 (same). Defendant also contends that the proffered expert opinions "will not `help the trier of fact to understand the evidence or to determine a fact in issue.'" ECF Nos. 50 at 2, 7-11 (quoting Fed. R. Evid. 702); 52 at 2, 7-10 (same). Plaintiff opposes the motions, arguing that its proffered experts have the requisite knowledge or experience and that their opinions will assist the Court in evaluating the commercial reasonableness of Defendant's security procedures. ECF Nos. 57; 60.
Expert witness testimony is governed by Federal Rule of Evidence 702, which provides:
Fed. R. Evid. 702.
In Daubert v. Merrell Dow Pharmaceuticals, 509 U.S. 579, 597 (1993), the Supreme Court directed trial courts to perform a "gatekeeping" function to ensure that expert testimony conforms to Rule 702's admissibility requirements. In serving this function, the district court has broad latitude to determine the admissibility of particular expert testimony. See Kumho Tire Co. v. Carmichael, 526 U.S. 137, 152-53 (1999). The Court is not required to hold a hearing before ruling on the admissibility of expert testimony if the record before the court is adequate for such a determination. In re Hanford Nuclear Reservation Litigation, 292 F.3d 1124, 1138-39 (9th Cir. 2002).
As challenged here, when determining the admissibility of expert testimony, the Court must consider (1) whether each witness has sufficient expertise to be "qualified as an expert by knowledge, skill, experience, training, or education," and (2) whether the witness's proffered testimony "will assist the trier of fact to understand or determine a fact in issue." Fed. R. Evid. 702.
"The determination whether an expert witness has sufficient qualifications to testify is a matter within the district court's discretion." United States v. Garcia, 7 F.3d 885, 889 (9th Cir. 1993) (citation omitted). "Rule 702 contemplates a broad conception of expert qualifications." Hangarter v. Provident Life & Accident Ins. Co., 373 F.3d 998, 1015 (9th Cir. 2004) (internal quotation marks and citation omitted) ("[T]he advisory committee notes emphasize that Rule 702 is broadly phrased and intended to embrace more than a narrow definition of qualified expert." (citation omitted)). Where a witness has considerable experience working in a specific field, the witness's "lack of particularized expertise" in one aspect of that field, "goes to the weight accorded her testimony, not to the admissibility of her opinion as an expert." Garcia, 7 F.3d at 889-90. In such situations, "[v]igorous cross-examination, presentation of contrary evidence, and careful [application of] the burden of proof are the traditional and appropriate means of attacking shaky but admissible evidence." See Daubert, 509 U.S. at 596.
The determination of whether the offered testimony will assist the Court requires the Court to evaluate its relevance and reliability. See Daubert, 509 U.S. at 591-92, 597. Evidence is relevant if "(a) it has any tendency to make a fact more or less probable than it would be without the evidence; and (b) the fact is of consequence in determining the action." Fed. R. Evid. 401. The reliability of expert testimony is evaluated in regard to the expert's "basis in the knowledge and experience of his discipline." Kumho Tire Co., 526 U.S. at 148 (1999) (quoting Daubert, 509 U.S. at 592). This inquiry is "flexible" and reliability must be evaluated "in light of the particular facts and circumstances of the particular case." Id. at 158; see also Estate of Barabin v. AstenJohnson, Inc., 740 F.3d 457, 463 (9th Cir. 2014).
Defendant argues first that Brian H. Kelley lacks the requisite qualifications to testify as an expert in ACH security procedures. ECF No. 50 at 4-7. Kelley has over thirty-five years of experience in commercial banking. ECF No. 58 at 6, 21-22. Between 1999 and 2011, Kelley served as president, chief executive officer, and director of three regional Southern California banks. Id. at 6, 21. While in those positions, Kelley "directed and oversaw a broad range of deposit and lending activities, including the implementation and oversight of electronic banking services including ACH and On-Line Banking activities." Id. at 6.
Defendant contends that "[s]uch experience provides nothing more than a limited perspective on the nature of bank security procedures for ACH transactions, and Kelley lacks the training and exposure required to testify as an expert in this area." ECF No. 50 at 6. Defendant objects that Kelley "fails to give any examples of the knowledge he gained from [these] experience[s]." ECF No. 75 at 5.
Having reviewed Kelley's declaration, expert report, and resume, the Court concludes Kelley does have the requisite qualifications to testify as an expert in this matter. Kelley's extensive history managing banks, including their ACH services, has granted Kelley knowledge of the types of security procedures available to and feasible for banks. Defendant's objection to Kelley's particularized experience with ACH security procedures is grounds to attack the weight which the Court should assign Kelley's opinions, but does not bar him from testifying from his experience overseeing ACH services in general. Cf. Garcia, 7 F.3d at 889-90.
Defendant argues second that Kelley's testimony should be excluded because it is irrelevant. ECF No. 50 at 7-11. Specifically, Defendant contends Kelley's opinions are irrelevant because "he admits that his experience is limited to regional and community banks" and Kelly cannot consequently testify as to the security procedures of international banks similarly situated to Defendant. Id. at 9-10.
As discussed in detail below, resolution of the claim in this case involves determining the "commercial reasonableness" of security procedures employed by Defendant in verifying ACH transactions. See RCW 62A.4A-202(b)(i), (c). As part of this "flexible" analysis, the Court is guided to look at "security procedures in general use by customers and receiving banks similarly situated." RCW 62A.4A-202(c), -203 cmt. 4. Kelley may not have particular experience with international banks, but his general knowledge of banking security and ACH transactions may assist the Court's inquiry in this case.
There is no indication at this time that ACH security standards for international banks vary substantially from standards applicable to regional banks with which Kelley has experience. Thus, there is no immediate reason to exclude Kelley's testimony as irrelevant given that the standards with which he is familiar may be the same or substantially similar to standards applicable to Defendant. See Fed. R. Evid. 104(b). Defendant may challenge, by cross-examination or presentation of contrary evidence, whether the standards with which Kelley is familiar are in general use by banks similarly situated to Defendant. This potential disparity, however, relates to weight, not admissibility.
Finally, the parties dispute whether Kelley can offer testimony as to whether Defendant acted in good faith. As discussed in detail below, resolution of the claim in this case involves determining whether Defendant accepted the unauthorized payment orders in good faith. See RCW 62A.4A-202(b)(ii). Defendant must show, inter alia, that its employees accepted and executed the payment orders in a way that comported with Plaintiff's "reasonable expectations, as established by reasonable commercial standards of fair dealing." Choice Escrow & Land Title, LLC v. BancorpSouth Bank, 754 F.3d 611, 622-23 (8th Cir. 2014).
Defendant contends Kelley's testimony is inadmissible because this particular subject of testimony was not disclosed in Plaintiff's expert report or pretrial expert disclosures. ECF Nos. 75 at 6. Plaintiff disclosed that its experts would testify to "industry standards and whether [Defendant's] security procedures met these standards." ECF No. 51-1. Plaintiff did not disclose that its experts would testify as to whether Defendant acted on the security procedures in a manner consistent with standards of fair dealing.
Regardless, the Court has reviewed Kelley's report and concludes his "bad faith" opinions do not contain relevant information. Kelley has offered opinions relating to Defendant's allegedly delayed attempts to recovery funds after the ACH transactions had been processed. ECF No. 58 at 16-17. Liability under Article 4A relates only to the actions of a bank while processing and accepting ACH payment orders. See RCW 62A.4A-202 (. . . the bank proves that it accepted the payment order in good faith and in compliance with the security procedure. . . ." (emphasis added)). Recovery actions undertaken after an ACH transaction is processed are not encompassed by the Article 4A analysis and any evidence offered on the matter is irrelevant.
Defendant also argues that Charisse Castagnoli lacks the requisite qualifications to offer expert testimony. ECF No. 52 at 5-7. Castagnoli has "over [twenty-six] years of experience in information security having worked in the design, development, and marketing of secure operating systems, security auditing, network and host based intrusion detection, network firewalls, cryptographic systems, application whitelisting, realtime network security monitoring, threat detection and remediation, mobile device security, and identity and access management." ECF No. 61 at 4. Defendant contends Catagnoli lacks the requisite experience or knowledge to testify because she has no "particularized experience analyzing online security practices for banks" or "particular knowledge related to the conduct of large commercial banks in processing ACH transactions." ECF No. 52 at 5, 6.
However, having reviewed Castagnoli's declaration, expert report, and resume, the Court concludes Castagnoli does have the requisite qualifications to testify as an expert in this matter. Castagnoli's extensive experience with internet security systems and authentication practices allows Castagnoli to testify as to the types of security procedures available for internet-based banking platforms. Defendant's objection to Castagnoli's particular experience with the ACH security procedures of international banks is grounds to attack the weight which the Court should assign her opinions, but does not bar Castganoli from testifying based upon her general experience with cyber security and authentication procedures. Cf. Garcia, 7 F.3d at 889-90.
Defendant also argues that Castagnoli's testimony should be excluded because it is irrelevant. ECF No. 52 at 7-10. Specifically, Defendant contends Castagnoli's testimony "does not explain how banks similarly situated to [Defendant] implemented alternative security procedures in April 2013." ECF No. 52 at 8. Castagnoli's report, however, discusses various security procedures widely available at the time of the breach and which were included in "[m]ost modern online banking packages." ECF No. 61 at 6-11. This testimony is relevant to the Court's inquiry of whether Defendant used commercially reasonable security procedures.
Accordingly, the Court declines to categorically exclude the testimony of Kelley and Castagnoli. Defendant is free to challenge the opinions offered in order to aid the Court in determining the weight to be given to the testimony. Defendant's motions are denied to the extent they seek to exclude the entirety of the expert testimonies.
However, Defendant objects as well to any opinions offered by Kelley and Constagnoli that embrace legal conclusions. ECF Nos. 50 at 8-9; 52 at 8. The Court will not consider opinions as to the ultimate legal conclusion in this case, i.e. whether the implemented security procedures were commercially reasonable. See Hangarter, 373 F.3d at 1016 ("[A]n expert witness cannot give an opinion as to her legal conclusion, i.e., an opinion on an ultimate issue of law." (emphasis in original) (citation omitted)); RCW 62A.4A-202(c) ("Commercial reasonableness of a security procedure is a question of law. . . ."). That conclusion rests solely with the Court at the close of the scheduled bench trial. To the extent Plaintiff's experts opine on the ultimate commercial reasonableness of the security procedures the parties implemented, Defendant's motions are granted.
Defendant moves the Court to grant summary judgment in its favor arguing that the undisputed facts indicate it implemented and complied with commercially reasonable security procedures. ECF No. 37. Plaintiff opposes this motion, arguing that there are genuine issues of material fact, that the procedures implemented were not commercially reasonable, and that Defendant failed to abide by the procedures the parties agreed to implement. ECF No. 63.
Summary judgment may be granted to a moving party who demonstrates "that there is no genuine dispute as to any material fact and that the movant is entitled to judgment as a matter of law." Fed. R. Civ. P. 56(a). The moving party bears the initial burden of demonstrating the absence of any genuine issues of material fact. Celotex Corp. v. Catrett, 477 U.S. 317, 323 (1986). The burden then shifts to the non-moving party to identify specific genuine issues of material fact which must be decided at trial. See Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 256 (1986).
For purposes of summary judgment, a fact is "material" if it might affect the outcome of the suit under the governing law. Id. at 248. A dispute concerning any such fact is "genuine" only where the evidence is such that a reasonable factfinder could find in favor of the non-moving party. Id. at 248, 252 ("The mere existence of a scintilla of evidence in support of the plaintiff's position will be insufficient; there must be evidence on which the jury could reasonably find for the plaintiff."). In ruling upon a summary judgment motion, a court must construe the facts, as well as all rational inferences therefrom, in the light most favorable to the nonmoving party. Scott v. Harris, 550 U.S. 372, 378 (2007). "[A] district court is not entitled to weigh the evidence and resolve disputed underlying factual issues." Chevron Corp. v. Pennzoil Co., 974 F.2d 1156, 1161 (9th Cir. 1992). Only evidence which would be admissible at trial may be considered. Orr v. Bank of Am., NT & SA, 285 F.3d 764, 773 (9th Cir. 2002).
Article 4A creates a framework by which to balance the rights and obligations of banks and institutional customers concerning electronic funds transfers. It specifically addresses the balance of risk when a third party obtains a customer's identifying information and attempts to issue a fraudulent payment order to a bank. Generally, a bank bears the risk for unauthorized orders and must refund the payment of any unauthorized payment. RCW 62A.4A-204(a). However, in certain circumstances, the risk of loss shifts to the customer and a bank is not liable for refunding unauthorized payment orders.
As relevant in this case, a bank is not liable for repayment of an unauthorized payment order if (1) the bank and its customer have agreed to a security procedure by which the authenticity of the payment order is to be verified, (2) "the security procedure is a commercially reasonable method of providing security against unauthorized payment orders," and (3) "the bank proves that it accepted the payment order in good faith and in compliance with the security procedure and any written agreement or instruction of the customer restricting acceptance of payment orders issued in the name of the customer." RCW 62A.4A-202(b). The burden rests upon the bank to show that the security procedures are commercially reasonable and that the bank acted in good faith in complying with those procedures. RCW 62A.4A-203 cmt. 3.
"The question of whether loss that may result from the transmission of a spurious or erroneous payment order will be borne by the receiving bank or the sender or purported sender is affected by whether a security procedure was or was not in effect and whether there was or was not compliance with the procedure." RCW 62A.4A-201 cmt. Thus, as embodied in Section 202(b), the first step of the Article 4A analysis requires the Court to determine the exact framework of the agreed-upon security procedures. RCW 62A.4A-202(b) ("If a bank and its customer have agreed that the authenticity of payment orders . . . will be verified pursuant to a security procedure. . . .").
A security procedure is "a procedure established by agreement of a customer and a receiving bank for the purpose of . . . verifying that a payment order . . . is that of the customer. . . ." RCW 62A.4A-201. This definition specifically limits security procedures to those procedures established by agreement between the parties; it does not apply to procedures the parties may unilaterally impose in processing payment orders. See RCW 62A.4A-201 cmt. A procedure need not be explicitly referenced in writing so long as ample evidence indicates that the parties agreed to implement the procedure. See RCW 62A.1-201 ("`Agreement,' as distinguished from `contract,' means the bargain of the parties in fact, as found in their language or inferred from other circumstances, including course of performance, course of dealing, or usage of trade. . . ."); Choice Escrow, 754 F.3d at 618.
At the second step of the Article 4A analysis, the Court must determine whether the agreed-upon security procedures were commercially reasonable. RCW 62A.4A-202(b)(i).
RCW 62A.4A-202(c). Commercial reasonableness is a "flexible" concept that requires a court to determine "whether the procedure is reasonable for the particular customer and the particular bank." RCW 62A.4A-203 cmt. 4. "The standard is not whether the security procedure is the best available," and a particular security procedure is not unreasonable "simply because another procedure might have been better." Id. However, a "security procedure that fails to meet prevailing standards of good banking practice applicable to the particular bank should not be held to be commercially reasonable." Id.
In some situations, an institutional customer may refuse all or portions of a bank's offered security procedures which are "commercially reasonable and suitable for that customer and insists on using a higher-risk procedure because it is more convenient or cheaper," in which case the customer voluntarily assumes the risk of loss. Id. In those situations, the security procedures actually in place will be deemed commercially reasonable if
RCW 62A.4A.202(c). Thus, as the Eighth Circuit has stated, Sections 202(b) and 202(c) can be synthesized into the following rule:
Choice Escrow, 754 F.3d at 618.
At the third step of the Article 4A analysis, a bank must show that it "accepted the payment order in good faith and in compliance with the security procedure and any written agreement or instruction." RCW 62A.4A-202(b)(ii). Good faith "means honesty in fact and the observance of reasonable commercial standards of fair dealing." RCW 62A.1-201(b)(20). Thus, "[t]his two-pronged definition has both a subjective component—honesty in fact—and an objective component—the observance of reasonable commercial standards of fair dealing." Choice Escrow, 754 F.3d 611, 622 (8th Cir. 2014) (citing In re Nieves, 648 F.3d 232, 239 (4th Cir. 2011)).
The subjective prong concerns whether the bank actually complied with the agreed-upon security procedure. That is, "technical compliance" with the security procedure. See Choice Escrow, 754 F.3d at 623. The objective prong concerns whether the bank accepted the payment order in accordance with the security procedures "in a way that reflects the parties' reasonable expectations as to how those procedures will operate." Id. This inquiry focuses on the aspects of accepting a payment order that are left to the Bank's discretion. Id. (citing Milford-Bennington R. Co., Inc. v. Pan Am. Rys., Inc., 695 F.3d 175, 179 (1st Cir. 2012)). Defendant must show that its employees accepted and executed the payment orders in a way that comported with Plaintiff's "reasonable expectations, as established by reasonable commercial standards of fair dealing." Id.
The parties dispute certain factual issues that are material to the resolution of this case. Specifically, the parties dispute what security procedures they had agreed to implement and what, if any, alternative security measures were offered to Plaintiff or Cascade, but ultimately refused.
There is no dispute that the parties implemented certain agreed-upon security measures. First, CashPro users were required to enter a company ID, user ID, and password to access the online banking platform. ECF Nos. 38 at ¶ 27; 69 at ¶ 27. Second, CashPro created a digital fingerprint of each authorized computer and challenged login attempts from unrecognized computers with a security question. ECF Nos 38 at ¶ 29; 69 at ¶ 29. Third, logging into CashPro required a valid digital certificate stored on each authorized computer. ECF Nos. 38 at ¶ 30; 69 at ¶ 30. Fourth, CashPro employed an automatic fraud scoring process upon login. See ECF Nos. 38 at ¶ 28; 41 at ¶ 12; 69 at ¶ 12.
The parties strongly dispute whether other security procedures were agreedupon. First, the parties dispute whether they agreed to a "zero-balance" procedure pursuant to which Defendant could not transfer funds out of the direct deposit account until and unless Plaintiff made a corresponding transfer of funds into the account from the main operating account. See ECF Nos. 38 at ¶ 24; 63 at 1-4; 68 at ¶¶ 16-27; 69 at ¶ 24; 81 at 10. In essence, this procedure would have prevented the direct deposit account from being overdrawn or having a negative balance. See ECF No. 63 at 4 ("Nevertheless, [Defendant] processed the Fraudulent Transfers, and created an overdraft of $1,003,069 on an account that was never intended to fall below zero.").
Defendant has presented evidence that County Treasury employees were aware of times when the direct deposit account carried a negative balance. ECF No. 39-1 at 39, 52-53. Theresa Foltz, an accountant in the County Treasury office, agreed in her deposition that these negative balances "would have been because a taxing district released an ACH batch before it made a wire request[.]" ECF No. 39-1 at 53. Based upon these facts alone, in may be that there was no strict zerobalance procedure and that Plaintiff was aware that the direct deposit account could be overdrawn.
On the other hand, however, Plaintiff has presented evidence supporting its contention that the parties had agreed to a strict zero-balance procedure. Plaintiff's chief accountant, Theresa Pinneo, stated in her deposition that the County Treasury employees "had an understanding with [Defendant's] representative," Alex Johnston, that "no money was to go out of that account unless it was funded" from the main operating account. Id. at 33-34. As such, Pinneo stated, a transfer was required "so that [an ACH payment] could go out" from the direct deposit account. Id. Likewise, David Griffiths, the County Treasurer, stated that Defendant had established the zero-balance system and monitored the direct deposit account for potential overdrafts. ECF Nos. 64 at ¶ 10(a)-(b), (f); 39-1 at 12.
In fact, Johnston himself—Defendant's own employee—stated that he believed Plaintiff had set up the direct deposit "funding arrangement" with the bank. ECF No. 67-1 at 26. Johnston did not state, though, that the arrangement would prevent an overdraft, instead stating only that an overdraft may trigger a telephonic inquiry from the bank. Id. at 27, 30 ("A typical customer response would be, `Yes, we are aware of it. We forgot to fund. We made a mistake. Money's coming in.' The vast majority of these is a timing issue.").
In short, while it is undisputed that the direct deposit account was occasionally overdrawn, this fact is not indisputably determinative of whether the parties agreed that the account should never be overdrawn. It may be that Defendant failed, on more than one occasion, in its responsibility to retain money in the direct deposit account until a corresponding transfer was made from the main operating account. This possibility, along with testimony indicating there was some as yet unclarified "funding arrangement" between the parties, indicates that further factual development of the record is required. The evidence Plaintiff presents, however, is such that a reasonable fact finder could find the procedure was agreed-upon. The Court concludes there is a genuine dispute of fact on this matter.
Second, the parties dispute whether there was an agreed-upon procedure in place whereby Defendant was required to notify Plaintiff of any discrepancies in the direct deposit account, the so-called "call-back" procedure. See ECF Nos. 63 at 3; 68 at ¶¶ 16-27; 81 at 8-9. Defendant flatly disputes that the call-back procedure was an agreed-upon security procedure. ECF No. 81 at 8. Plaintiff, however, contends the system was agreed-upon and required a bank representative to contact Plaintiff if Defendant's "system detected a payment order for which funds had not been placed in the Direct Deposit Account." ECF No. 63 at 3. In response to the Defendant's motion, Plaintiff offers evidence supporting this contention.
Foltz stated that she was made aware of previous overdrafts of the direct deposit account through calls from Defendant. ECF No. 39-1 at 53. Griffiths also stated that Defendant established a procedure by which it would monitor the direct deposit account and call the County Treasurer "if there was even the smallest discrepancy." Id. at 12. Johnston stated that an overdraft of the direct deposit account would trigger a phone call from the bank, "depending on the size" of the overdraft. ECF No. 67-1 at 27. He also agreed that an overdraft of $50,000 would trigger an email response. ECF No. 67-1 at 29. This evidence is such that a reasonable factfinder could find there was an agreed-upon call-back procedure. See Anderson, 477 U.S. at 248, 252. Further factual development is required, however, to define what, if any, duties the procedure imposed upon Defendant. A genuine dispute of fact exists on this matter.
Finally, the parties dispute whether there was an agreed-upon procedure whereby Plaintiff had twenty-four hours to recognize erroneous or fraudulent payment orders and to have them reversed in full by Defendant, the so-called "twenty-four hour" procedure. ECF No. 68 at ¶¶ 30-32; 81 at 8. Plaintiff has offered evidence in support of the contention that such a procedure was agreedupon.
Pinneo stated that she had a verbal agreement with Johnston on the implementation of this procedure. ECF No. 39-1 at 33-34. Griffiths stated that the twenty-four hour procedure was part of the previous paper payment order system, and that both he and Defendant's "Senior Client Manager" believed the twentyfour hour procedure would apply to electronic ACH orders as well. Id. at ¶¶ 15, 16. Johnston attested to a twenty-four window for recovering funds "[i]f there was an unauthorized external ACH debit against [Plaintiff's] account." ECF No. 67-1 at 35. Johnston, however, did not recall whether he explained to Griffiths that the twenty-four hour limit applied only to external debits. Id. at 36. The evidence presented is such that a reasonable factfinder could find the twenty-four hour procedure was agreed-upon. See Anderson, 477 U.S. at 248, 252. As such, there is a genuine dispute of fact on the matter.
In sum, there are genuine factual disputes as to whether the zero-balance, call-back, and twenty-four hour procedures were agreed-upon security procedures. These disputes are material to the Article 4A analysis. Resolution of the step-one inquiry will necessarily affect the outcome of the trial. Without a resolution of the preliminary factual inquiry of what security procedures were agreed-upon, the Court cannot evaluate the commercial reasonableness of the overall agreed-upon security framework at step two or whether Defendant acted on the agreed-upon procedures in good faith at step three. A determination of the exact security procedures the parties agreed to implement is a prerequisite to the rest of the Article 4A analysis.
Defendant contends, nevertheless, that even assuming that the zero-balance, call-back, and twenty-four hour procedures were agreed-upon, Defendant "processed the transactions in question in accordance with [Plaintiff's] expectations" and summary judgment is therefore appropriate. ECF No. 81 at 8-10. The Court disagrees. Even assuming arguendo that these three procedures were implemented, material factual disputes remain as to whether Defendant acted on those procedures in good faith.
First, if these procedures were agreed upon, the evidence is such that a reasonable fact finder could find Defendant failed to comply with the technical requirements of the procedures. For example, if a strict zero-balance procedure was agreed upon, Defendant failed to hold the funds in the direct deposit account until the required corresponding transfer was made from the main operating account. Thus, there is a genuine dispute of fact material to the objective good faith inquiry.
Second, if the procedures were agreed upon, the evidence is such that a reasonable fact finder could find Defendant failed to comply with the procedures in a manner reflecting Plaintiff's reasonable expectations. For example, while the record is incomplete regarding any specific duties Defendant had under the callback procedure, the Court could find that Defendant failed to comply with Plaintiff's reasonable expectations that an overdraft should have been detected sooner and that Defendant should have contacted Plaintiff regarding the overdraft at some point before Monday April 22, 2013. Accordingly, even assuming the three disputed procedures were implemented, there are factual disputes material to both prongs of the good-faith analysis.
Finally, the Court notes that the parties also strongly dispute whether Defendant offered, and Plaintiff and Cascade refused, alternative reasonable security measures. Defendant contends that its representative, Lisa Stensgaard, directly communicated security concerns and alternative security measures to Theresa Pinneo. ECF No. 42 at ¶¶ 11, 13. Plaintiff contends that Stensgaard did not actually make direct contact with Pinneo at any point to discuss security risks and alternative security matters. ECF Nos. 63 at 16-17; 48 at ¶ 6. Given the directly contradictory statements, resolution of this factual issue will likely require a credibility determination by the Court. Such a credibility determination is not appropriate on a motion for summary judgment, even where the case is scheduled for a bench trial. See TransWorld Airlines, Inc. v. Am. Coupon Exch., Inc., 913 F.2d 676, 684-85 (9th Cir. 1990). This factual dispute may affect the Court's steptwo analysis and is therefore material. See Anderson, 477 U.S. at 248.
"[C]ourts must not rush to dispose summarily of cases . . . unless it is clear that more complete factual development could not possibly alter the outcome and that the credibility of the witnesses' statements or testimony is not at issue." Transworld Airlines, Inc., 913 F.2d at 684-85. The Court concludes that further factual development and credibility determinations will affect the outcome of this case. As such, summary judgment is not appropriate at this juncture.
(ECF Nos. 50) is
The District Court Clerk is directed to enter this Order and provide copies to counsel.
