1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 LITTLE SEEDS CHILDREN'S CENTER, Case No. 25-cv-01517-HSG INC., et al., 8 ORDER GRANTING IN PART AND Plaintiffs, DENYING IN PART MOTION TO 9 DISMISS v. 10 Re: Dkt. No. 13

CITIBANK, N.A.,

11 Defendant. 12 13 Pending before the Court is Defendant’s motion to dismiss Plaintiffs’ complaint. See Dkt. 14 No. 13 (“Mot.”); Dkt. No. 17 (“Opp.”); Dkt. No. 18 (“Reply”). The Court finds this matter 15 appropriate for disposition without oral argument and the matter is deemed submitted. See Civil 16 L.R. 7-1(b). For the reasons discussed below, the Court GRANTS IN PART and DENIES IN 17 PART the motion to dismiss. 18 I. BACKGROUND 19 Plaintiffs Little Seeds Children’s Center, Inc. (“LSCC”), LSCC CEO Mahvash Kamrani, 20 and LSCC CFO Hossein Kamrani filed a lawsuit against Defendant Citibank, N.A., in February 21 2025, bringing various state law actions arising out of a series of allegedly fraudulent wire 22 transfers. See Dkt. No. 1-1 (“Compl.”) ¶¶ 1–2, 17. Plaintiffs Mahvash and Hossein Kamrani have 23 held bank accounts with Defendant since 1999, and those accounts have been used to manage 24 LSCC’s funds. See id. ¶¶ 12–13. Before July 2024, Plaintiffs conducted all their business in 25 person. Id. ¶ 14. Plaintiffs allege that, between 1999 and 2024, Defendant’s standard practice was 26 to contact Plaintiffs via email or text message and by phone regarding potential account 27 interference and to “confirm any transaction that appeared out-of-the-norm.” Id. ¶¶ 15, 17. In one 1 local branch manager contacted Plaintiffs to confirm the check was legitimate. Id. ¶ 16. 2 In July 2024, Plaintiffs were allegedly convinced “over [their] initial reluctance” by 3 Defendant’s agents at an Alameda branch to begin scanning their checks and to use a security key 4 to authorize transactions remotely. Id. ¶¶ 19–20. The security key provided a one-time password 5 used in combination with Plaintiffs’ username and password to log into Defendant’s website. Id. 6 ¶ 21. Plaintiffs allege that they were told by the Alameda branch agents that the security key 7 “would provide added protections on top of the ability to conduct important transactions in person 8 and the account monitoring and the already agreed-upon security protocol of phone calls for 9 potentially suspicious transactions.” Id. ¶¶ 71, 80. 10 On October 1, 2024, Plaintiffs were allegedly called by “Jason B.,” an individual using a 11 Citibank phone number and purporting to be an employee at Citibank’s fraud department. Id. 12 ¶¶ 29–43. On the call, Jason B. alerted Plaintiffs to a dozen pending wire transfers that had been 13 issued against Plaintiffs’ accounts and pretended to freeze them, but in actuality, he convinced 14 Plaintiffs to use the security key to trigger completion of the wire transfers. See id. Plaintiffs 15 claim they never provided any confidential personal information on this call, and “Jason B. 16 already had all of this information before calling Plaintiffs.” Id. ¶ 43. In total, $717,293.08 was 17 stolen across almost twenty wire transfers, many of which occurred within the span of an hour, 18 and most of which went to recipients in Florida. Id. ¶¶ 27, 95–96, 100. Plaintiffs allege they had 19 “no history of requesting or authorizing wire fund transfers of any kind . . . let alone multiple wire 20 transfers in one day or for large sums of money.” Id. ¶ 26. 21 Plaintiffs now seek to recover from Defendant on theories of negligent and intentional 22 misrepresentation, violation of various California statutes, and negligent hiring.1 Defendant 23 moved to dismiss all claims. Dkt. No. 13. 24 25 1 The first three claims (negligent misrepresentation, intentional misrepresentation, and violation 26 of the California Commercial Code) are brought by Plaintiff LSCC. The fourth and fifth claims (violation of the California Consumer Privacy Act and the California Consumer Records Act) are 27 brought by the Kamranis as individuals. The remaining two claims are brought by all Plaintiffs. 1 II. LEGAL STANDARD 2 Federal Rule of Civil Procedure 8(a) requires that a complaint contain “a short and plain 3 statement of the claim showing that the pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). A 4 defendant may move to dismiss a complaint for failing to state a claim upon which relief can be 5 granted under Rule 12(b)(6). “Dismissal under Rule 12(b)(6) is appropriate only where the 6 complaint lacks a cognizable legal theory or sufficient facts to support a cognizable legal theory.” 7 Mendiondo v. Centinela Hosp. Med. Ctr., 521 F.3d 1097, 1104 (9th Cir. 2008). To survive a Rule 8 12(b)(6) motion, a plaintiff need only plead “enough facts to state a claim to relief that is plausible 9 on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). A claim is facially plausible 10 when a plaintiff pleads “factual content that allows the court to draw the reasonable inference that 11 the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). 12 In reviewing the plausibility of a complaint, courts “accept factual allegations in the complaint as 13 true and construe the pleadings in the light most favorable to the nonmoving party.” Manzarek v. 14 St. Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008). Nevertheless, courts do not 15 “accept as true allegations that are merely conclusory, unwarranted deductions of fact, or 16 unreasonable inferences.” In re Gilead Scis. Sec. Litig., 536 F.3d 1049, 1055 (9th Cir. 2008) 17 (quotation omitted). 18 Even if the court concludes that a 12(b)(6) motion should be granted, the “court should 19 grant leave to amend even if no request to amend the pleading was made, unless it determines that 20 the pleading could not possibly be cured by the allegation of other facts.” Lopez v. Smith, 203 21 F.3d 1122, 1127 (9th Cir. 2000) (en banc) (quotation omitted). 22 III. DISCUSSION 23 Defendant seeks dismissal on several grounds, including (1) under the economic loss rule; 24 (2) for failure to state a claim under Rule 9(b); (3) for failure to state a claim for negligent hiring 25 and under various violations of the California Commercial Code, California Consumer Privacy 26 Act, and California Consumer Records Act; and (4) for failure to plead an adequate remedy at law. 27 Mot. at 8–9. 1 i. Negligent Misrepresentation (Claim One) 2 Plaintiffs allege that Defendant’s employees stated that the security key was an additional 3 security measure on top of the existing phone and email notifications, and that Defendant knew or 4 should have known that the security key was a replacement for these procedures. Compl. ¶¶ 71, 5 75. Defendant contends that the economic loss doctrine bars Plaintiffs’ negligent 6 misrepresentation cause of action because Plaintiff LSCC’s relationship with Defendant is 7 contractual, and Plaintiffs do not allege any physical injury or property damage. Mot. at 13. 8 The “economic loss rule prevents the law of contract and the law of tort from dissolving 9 one into the other.” Robinson Helicopter Co. v. Dana Corp., 34 Cal. 4th 979, 988 (2004) (internal 10 quotation and alteration omitted). “The rule itself is deceptively easy to state: In general, there is 11 no recovery in tort for negligently inflicted ‘purely economic losses,’ meaning financial harm 12 unaccompanied by physical or property damage.” Sheen v. Wells Fargo Bank, N.A., 12 Cal. 5th 13 905, 922 (2022). 14 This Court has previously interpreted the California Supreme Court’s holding in Robinson 15 Helicopter to mean that “a negligent misrepresentation claim paralleling a contract claim that 16 prays only for economic damages will be barred by the economic loss rule unless the plaintiff 17 alleges both that the defendant made an affirmative misrepresentation, and that the defendant’s 18 misrepresentation exposed the plaintiff to independent personal liability.” Crystal Springs Upland 19 Sch. v. Fieldturf USA, Inc., 219 F. Supp. 3d 962, 970 (N.D. Cal. 2016); see also Farrales v. Ford 20 Motor Co., No. 21-CV-07624-HSG, 2022 WL 1239347, at *9 (N.D. Cal. Apr. 27, 2022) (noting 21 that “[i]n the absence of California Supreme Court authority, the Court continues to read Robinson 22 Helicopter as a narrow exception to the economic loss rule”). In other words, “non-economic loss 23 is a required element of a negligence cause of action alleged in a sale of goods case, and thus non- 24 economic loss must be pleaded to survive a motion to dismiss.” Ladore v. Sony Comput. Ent. Am., 25 LLC, 75 F. Supp. 3d 1065, 1075 (N.D. Cal. 2014). 26 The California Supreme Court recently elaborated regarding the economic loss doctrine in 27 Rattagan v. Uber Technologies., Inc., 17 Cal. 5th 1 (2024), when it considered whether fraudulent 1 loss doctrine and held that fraudulent concealment claims are exempt from the doctrine, which 2 “does not apply to limit recovery for intentional tort claims like fraud” and only applies when “the 3 parties have entered into a contract; the plaintiff sues for tort damages, alleging defendant failed to 4 perform as the contract requires; and [the defendant] negligently caused economic losses flowing 5 from the breach,” not “physical damage or personal injury beyond the economic losses.” Id. at 38, 6 44. 7 However, the court also clarified that the economic loss doctrine and the holding in 8 Robinson Helicopter are just specific applications of the “independent tort principle,” which holds 9 that “[b]roader tort liability only arises if a defendant violates an independent legal duty and the 10 type of harm that ensues was not reasonably contemplated or accounted for by the contractual 11 parties.” See id. at 26, 34, 37. Under this broader principle, courts must “(1) ascertain the full 12 scope of the parties’ contractual agreement”; (2) “determine whether there is an independent tort 13 duty to refrain from the alleged conduct”; and (3) “if an independent duty exists . . . consider 14 whether the plaintiff can establish all elements of the tort independently of the rights and duties 15 assumed by the parties under the contract.” Id. at 26. As a result, the Rattagan court ultimately 16 held that “[a] plaintiff may assert a tort claim for fraudulent concealment based on conduct 17 occurring in the course of a contractual relationship, if the elements of the cause of action can be 18 established independently of the parties’ contractual rights and obligations and the tortious 19 conduct exposes the plaintiff to a risk of harm beyond the reasonable contemplation of the parties 20 when they entered into the agreement.” Id. at 38. 21 Courts already differ in how they apply Rattagan. See Iwatani Corp. of Am. v. Nel Asa, 22 No. 8:24-CV-00192-JVS-KES, 2024 WL 4800080, at *5–*6 (C.D. Cal. Oct. 18, 2024), corrected 23 in relevant part sub nom. Iwatani Corp. v. Nel Asa, No. 8:24-CV-00192-JVS-KES, 2024 WL 24 4800078 (C.D. Cal. Oct. 29, 2024) (dismissing negligent misrepresentation claim but not 25 intentional misrepresentation claims, and distinguishing between breaches of contractual promises 26 and breaches of duties growing out of a contract); Dolby Lab’ys Licensing Corp. v. Roku, Inc., No. 27 24-CV-04660-EJD, 2025 WL 2021803, at *12 (N.D. Cal. July 18, 2025) (applying Rattagan, and 1 the reasonable contemplation of the parties). Most notably, multiple courts have suggested that 2 fraudulent inducement claims can survive without conducting the full Rattagan inquiry, reasoning 3 that these claims are controlled by a fraudulent inducement exception that the California Supreme 4 Court declined to overturn from Dhital v. Nissan North America, Inc., 84 Cal. App. 5th 828 5 (2022). See, e.g., Moore v. Am. Honda Motor Co., No. 5:23-CV-05011-BLF, 2025 WL 948114 6 (N.D. Cal. Mar. 28, 2025) (“By expressly calling out the distinction between Rattagan’s facts and 7 the fraudulent inducement cases and then dismissing the appeal of Dhital without vacating, 8 reversing, or otherwise altering the court of appeal’s opinion, the California Supreme Court 9 indicated that the reasoning in Dhital should guide [such] claims . . . .”); Ramos v. Ford Motor 10 Co., No. 2:24-CV-04066-AH-(JPRX), 2025 WL 1606917, at *5 (C.D. Cal. Apr. 16, 2025). Dhital 11 held that fraudulent inducement is an exception to the economic loss rule “because a defendant’s 12 conduct in fraudulently inducing someone to enter a contract is separate from the defendant’s later 13 breach of the contract or warranty provisions that were agreed to.” 84 Cal. App. 5th at 841. 14 While Dhital discusses intentional omissions and misrepresentations, some recent cases have 15 applied this “fraudulent inducement exception” to negligent misrepresentations, reasoning that 16 negligent misrepresentation is a species of fraud that should be treated the same as intentional 17 omissions. See Shared P’ship v. Meta Platforms, Inc., No. 22-CV-02366-RS, 2024 WL 4280936, 18 at *5 (N.D. Cal. Sept. 23, 2024) (citing non-precedential case Kalitta Air, L.L.C. v. Cent. Texas 19 Airborne Sys., Inc., 315 F. App’x 603, 607 (9th Cir. 2008)). 20 Here, the Court must apply the test articulated in Rattagan. The Court agrees that 21 Rattagan permits at least some claims for fraudulent inducement. Rattagan, 1 Cal. 5th at 41 (“[I]t 22 has long been the rule that where a contract is secured by fraudulent representations, the injured 23 party may elect to affirm the contract and sue for the fraud.”) (quotation omitted). But Rattagan 24 also provides a controlling framework for analyzing tort liability, and the Court will not bypass 25 this analysis and extend Dhital’s reasoning to a different cause of action absent clear guidance 26 from the California Supreme Court. The Court is especially reluctant to do so because Rattagan’s 27 extensive discussion of the independent tort principle and economic loss doctrine suggests that the 1 contract and the principles underpinning contract and tort remedies.2 Nothing in Rattagan 2 suggests that claims can be easily and categorically excluded: to the contrary, the court provided 3 further clarification about when fraudulent concealment claims would be permitted in contractual 4 disputes, even after determining that the narrower economic loss rule did not apply.3 5 Applying Rattagan, the Court finds that Plaintiffs may have adequately pleaded a violation 6 of an independent tort duty to survive at this early pleading stage. Here, Plaintiffs do not allege 7 that Defendant “use[d] its affirmative misrepresentations as a means of breaching its contract”; 8 rather, they seem to allege that Defendant’s “affirmative misrepresentations were [used] to induce 9 [them] to accept the [security key], something [Defendant] could not have accomplished 10 independently without engaging in [allegedly] fraudulent conduct.” Rattagan, 17 Cal. 5th at 36 11 (discussing the holding of Robinson Helicopter) (emphasis in original). 12 However, even assuming (without deciding) that they can clear the independent duty 13 hurdle, Plaintiffs have not adequately pleaded that they were exposed to liability “beyond the 14 reasonable contemplation of the parties that might result from a breach when they entered into 15 their contract.” Id. Plaintiffs argue that the failure to use the agreed-upon security measures 16 created a significant risk of reputational damage and future non-compliance with California 17 regulations regarding childcare facilities. Opp. at 11. But those harms are not alleged in the 18 complaint.4 All that remains is a purely economic loss—stolen funds—that falls within the 19

20 2 For similar reasons, the Court rejects Plaintiffs’ argument that it should not apply the economic loss doctrine because many courts in this circuit have held that the economic loss rule does not bar 21 negligent misrepresentation claims. Opp. at 9–10. It is true that many courts have declined to extend the economic loss rule to negligent misrepresentation claims. See, e.g., Phillips v. 22 Brooklyn Bedding LLC, No. 23-CV-03781-RFL, 2024 WL 2830663, at *7 (N.D. Cal. Mar. 28, 2024) (collecting cases). But none of the cases cited by Plaintiffs addressed Rattagan’s holding, 23 which this Court is required to apply.

24 3 Moreover, Plaintiffs do not brief the issue of whether Dhital should apply to their claim for negligent misrepresentation, and the Court is not convinced from the existing allegations that this 25 is a case—like Dhital—where a contract was secured by misrepresentation, as opposed to a case where a misrepresentation arose during the course of an existing contractual relationship. 26

4 In light of this fact, the Court need not determine if these two harms were beyond the reasonable 27 contemplation of the parties. But the Court is skeptical that these harms—variants of which could 1 reasonable contemplation of an agreement to safeguard that money. The Court finds Rattagan’s 2 description of Robinson Helicopter instructive: there, despite the fact that the plaintiff “would not 3 have accepted delivery and used the nonconforming [parts]” if not for the defendant’s 4 misrepresentations, the court still analyzed the “risk of harm far beyond the disappointment of its 5 expectancy interest in contract fulfillment . . . including potential liability for personal injury or 6 property damage and disciplinary action by the FAA.” Rattagan, 17 Cal. 5th at 33–34. Plaintiffs 7 include no comparable allegations, so the Court DISMISSES this claim with leave to amend.5 8 ii. Intentional Misrepresentation (Claim Two) 9 Defendant also moves to dismiss Plaintiff LSCC’s intentional misrepresentation claim, 10 arguing that Plaintiffs fail to plead an actual misrepresentation, intent, reasonable reliance, and 11 causation with the adequate particularity required by Rule 9(b). Mot. at 14–15.6 12 “The elements of a claim for intentional misrepresentation are (1) a misrepresentation; (2) 13 knowledge of falsity; (3) intent to induce reliance; (4) actual and justifiable reliance; and (5) 14 resulting damage.” Cisco Systems, Inc. v. STMicroelectronics, Inc., 77 F. Supp. 3d 887, 897 (N.D. 15 Cal. 2014). When fraud is an essential element of a claim, Rule 9(b) imposes a heightened 16 pleading standard. See Fed. R. Civ. P. 9(b) (“In alleging fraud or mistake, a party must state with 17 particularity the circumstances constituting fraud or mistake.”); see also Vess v. Ciba–Geigy Corp. 18 USA, 317 F.3d 1097, 1107 (9th Cir. 2003). A plaintiff must identify “the who, what, when, where, 19 and how” of the alleged conduct to provide defendants with sufficient information to defend 20 against the charge. Cooper v. Pickett, 137 F.3d 616, 627 (9th Cir. 1997) (quotation omitted). 21 However, “[m]alice, intent, knowledge, and other conditions of a person’s mind may be alleged 22 generally.” Fed. R. Civ. P. 9(b). 23 Plaintiffs have met these requirements. First, Plaintiffs allege that “[i]n or about July 24

25 5 While Rattagan’s broader test appears to supersede the Court’s previous interpretation of Robinson Helicopter, the Court notes that the Robinson Helicopter test would yield the same 26 result—Plaintiffs’ claim fails because they have not alleged any independent personal liability.

27 6 Defendant makes the same arguments against Plaintiffs’ negligent misrepresentation claim. 1 2024,” Defendant’s “agents at the Alameda branch” misrepresented that “the security token would 2 provide added protections on top of . . . the agreed-upon security measure of account monitoring 3 and phone calls . . . for potentially suspicious transactions,” when really “Defendant [silently] 4 withdrew security support” once Plaintiffs signed up for the security token. Compl. ¶¶ 19, 80–82. 5 Contrary to Defendant’s claims, this establishes enough detail about “who made any purported 6 misrepresentations, what specifically was said, where it was said, [and] what was false about the 7 representation” to satisfy Rule 9(b)’s particularity requirements. See Mot. at 15.7 Second, 8 Plaintiffs allege that “Defendant did not intend to provide the same level of account monitoring it 9 historically had provided,” “knew that the representation to Plaintiffs . . . was not true or 10 Defendant made the statement with reckless disregard for its truth,” and “Defendant intended for 11 Plaintiffs to rely on its statements.” Compl. ¶¶ 81, 83, 85. Plaintiffs may allege intent generally 12 under Rule 9(b). Third, Plaintiffs specifically allege that they had relied on phone and email 13 account alerts for years, were reluctant to adopt the security key, and only did so because the 14 agents represented that the key would be a supplementary measure. Id. ¶¶ 14–15, 18, 20, 86. 15 Finally, Plaintiffs allege that Defendant reduced its security support once Plaintiffs agreed to use 16 the security key, which permitted the fraudulent wire transfers. Id. ¶ 87. Whether this alleged 17 change in security procedures was a legally sufficient cause of Plaintiff LSCC’s injuries is not 18 something the Court can decide as a matter of law at this early pleading stage. For these reasons, 19 the Court DENIES Defendant’s motion with respect to the intentional misrepresentation claim.8 20 iii. Violation of California Commercial Code (Claim Three) 21 Defendant moves to dismiss Plaintiff LSCC’s claim under the California Commercial 22 7 Defendant suggests Plaintiffs “[do] not allege with particularity what the anonymous Citibank 23 employee actually said (as opposed to what LSCC believed).” Reply at 12 n.4. The Court disagrees. Plaintiffs plead that “Defendant, by and through [the Alameda branch employees], 24 stated that the security token would provide added protections.” Compl. ¶ 80. This describes a statement, not a belief. Plaintiffs are not required to specifically quote the July 2024 statement to 25 provide sufficient notice to Defendant and satisfy the Rule 9(b) standard.

26 8 Defendant cites several cases to support its arguments, but these cases are distinguishable. See, e.g., White v. J.P. Morgan Chase, Inc., 167 F. Supp. 3d 1108, 1115 (E.D. Cal. 2016), aff’d sub 27 nom. White v. JPMorgan Chase & Co., 702 F. App’x 642 (9th Cir. 2017) (dismissing largely 1 Code. Plaintiffs allege that Defendant (1) incorrectly processed the wire transfers, citing Cal. 2 Com. Code § 11201(b); (2) failed to use commercially reasonable security procedures, see id. 3 § 11202; (3) failed to provide Plaintiff LSCC with proper notification of any errors, see id. 4 § 11204; (4) failed to return the fraudulently wired funds with interest, see id. § 11204; and (5) 5 engaged in unauthorized actions that caused the loss or misdirected the funds, see id. § 11205. 6 Compl. ¶ 90. 7 Defendant first argues that California Commercial Code section 11201(b) does not exist. 8 Mot. at 16. Plaintiffs concede that this was a “typographical error.” Opp. at 21. Plaintiff LSCC’s 9 claim is DISMISSED without leave to amend to the extent it brings an action under section 10 11201(b). 11 Defendant next argues that California Commercial Code section 11205 only “addresses . . . 12 errors in payment orders related to misdescription of the beneficiary, an error in the amount of the 13 transfer, or a duplicate transfer.” Mot. at 17. Plaintiffs agree. Opp. at 26. Plaintiff LSCC’s claim 14 is DISMISSED without leave to amend to the extent it brings an action under section 11205. 15 Defendant next argues that California Commercial Code section 11202 does not itself 16 impose liability. Mot. at 16. The Court agrees: section 11202 defines authorized and effective 17 payment orders. It states that a payment order is authorized if “[the customer] authorized the order 18 or is otherwise bound by it under the law of agency.” Cal. Com. Code § 11202(a). An 19 unauthorized order may nevertheless be effective if “a bank and its customer have agreed that the 20 authenticity of payment orders . . . will be verified pursuant to a security procedure,” “the security 21 procedure is a commercially reasonable method of providing security against unauthorized 22 payment orders,” and “the bank proves that it accepted the payment order in good faith and in 23 compliance with the bank’s obligations under the security procedure and any agreement or 24 instruction of the customer, evidenced by a record, restricting acceptance of payment orders issued 25 in the name of the customer.” Id. § 11202(b). 26 However, Plaintiffs properly bring their cause of action under section 11204 for failure to 27 return the fraudulently wired funds, Compl. ¶ 90(d), so the Court need not dismiss on this ground. 1 “If a receiving bank accepts a payment order issued in the name of its customer as 2 sender which is (i) not authorized and not effective as the order of the customer under Section 11202, or (ii) not enforceable, in whole or in part, against the 3 customer under Section 11203, the bank shall refund any payment of the payment order received from the customer to the extent the bank is not entitled to enforce 4 payment and shall pay interest on the refundable amount calculated from the date the bank received payment to the date of the refund.” 5 6 Plaintiffs allege that they did not authorize the wire transfers. Compl. ¶¶ 38, 42. They also allege 7 that the wire transfers were not effective under section 11202(b) because Defendant did not have a 8 commercially reasonable security procedure. Id. ¶¶ 90(b), 91–105. “If a payment order was 9 neither authorized nor verified pursuant to a commercially reasonable security procedure that the 10 bank followed in good faith, the bank must bear the loss.” See 800 Columbia Project Co., LLC v. 11 CMB Wing Lung Bank, Ltd., 2022 WL 17884221, at *6 (C.D. Cal. Sept. 19, 2022). 12 Defendant argues that Plaintiffs have not alleged that the use of a security token to confirm 13 authorization for an online transaction is commercially unreasonable or that Defendant failed to 14 follow its security procedures in good faith. Mot. at 16. “Commercial reasonableness of a 15 security procedure is a question of law to be determined by considering the wishes of the customer 16 expressed to the bank, the circumstances of the customer known to the bank, including the size, 17 type, and frequency of payment orders normally issued by the customer to the bank, alternative 18 security procedures offered to the customer, and security procedures in general use by customers 19 and receiving banks similarly situated.” Cal. Com. Code § 11202(c). 20 Plaintiffs allege enough facts to support an inference at the pleading stage that Defendant’s 21 security procedures were not commercially reasonable. For example, Plaintiffs allege that 22 Defendant allowed twelve wire transfers to be completed in an hour, draining more than $300,000 23 from accounts that had never made a wire transfer before, and allege that, “[h]ad Defendant 24 employed adequate security procedures and tools to effectively monitor and respond to anomalous 25 account activity,” Defendant would have noticed this and frozen the accounts. Compl. ¶ 95. 26 Plaintiffs also allege that Defendant had previously alerted Plaintiffs any time there was 27 “anomalous or ahistorical account activity” in the last twenty years. Id. ¶¶ 15, 17, 98. The Court 1 supports a plausible inference that these security procedures were commercially unreasonable.9 2 Whether this actually proves to be true is for a later stage of the case. 3 Finally, Defendant argues that it cannot be liable under section 11204, because Plaintiffs 4 provided their information to the imposter via the security key, and this provision only requires a 5 bank to refund a wire transfer “if the customer proves that the order was not caused . . . by a 6 person . . . who obtained, from a source controlled by the customer . . . information facilitating 7 breach of the security procedure.”10 Mot. at 16–17 (quoting Cal. Com. Code § 11203(a)(2)). But 8 that rule only applies to payment orders that are unauthorized under section 11202(a), but effective 9 under section 11202(b). See Cal. Com. Code § 11203(a). As discussed above, Plaintiffs have 10 plausibly pleaded that these payment orders are both unauthorized and ineffective, and section 11 11203(a)(2) does not apply. Accordingly, Defendant’s motion is DENIED with respect to the 12 remainder of Plaintiffs’ California Commercial Code claim. 13 iv. Violation of California Consumer Privacy Act (Claim Four) 14 Defendant argues that Plaintiffs’ claim under the California Consumer Privacy Act 15 (“CCPA”), Cal. Civ. Code §§ 1798 et seq., “do[es] nothing more than restate the statutory 16 elements of a CCPA claim” and should be dismissed. Mot. at 18. 17 The CCPA creates a cause of action for “[a]ny consumer whose nonencrypted and 18 nonredacted personal information . . . is subject to an unauthorized access and exfiltration, theft, or 19 disclosure as a result of the business’ violation of the duty to implement and maintain reasonable 20 security procedures and practices.” Cal. Civ. Code § 1798.150(a)(1). Plaintiffs allege that 21 Defendant’s “failure to implement a reasonable security procedure to protect [Plaintiffs’] personal 22 information, including their names, birth dates, and other security information . . . allowed either 23 negligently hired employees or third-party actors to access sufficient information” to call Plaintiffs 24 and access their bank accounts. Compl. ¶ 114. 25 9 These allegations are much more detailed than the conclusory allegations in Chen v. JPMorgan 26 Chase Bank, N.A., 745 F. Supp. 3d 1025, 1032–33 (C.D. Cal. 2024), which Defendant relies on to support its argument. Mot. at 16. 27 1 Courts are split on what is required to adequately plead that a defendant failed to maintain 2 reasonable security procedures. See, e.g., Tian v. Bank of Am., N.A., No. 2:24-CV-09877-MCS- 3 PD, 2025 WL 1377767, at *3 (C.D. Cal. Apr. 2, 2025) (collecting cases and dismissing claim); 4 Doe v. MKS Instruments, Inc., No. SACV 23-00868-CJC (KESX), 2023 WL 9421115, at *3 (C.D. 5 Cal. Nov. 3, 2023) (collecting cases and denying dismissal on these grounds). As Defendant 6 notes, several courts have dismissed claims where “[p]laintiffs’ conclusory allegations . . . simply 7 restate the statutory requirements,” even where the plaintiffs alleged that defendants did not 8 monitor their systems to identify suspicious activity. Chen v. JPMorgan Chase Bank, N.A., 745 F. 9 Supp. 3d 1025, 1033–34 (C.D. Cal. 2024); see also Anderson v. Kimpton Hotel & Rest. Grp., LLC, 10 No. 19-CV-01860-MMC, 2019 WL 3753308, at *5 (N.D. Cal. Aug. 8, 2019). Other courts permit 11 claims similar to Plaintiffs’ to survive. See Alexander v. Wells Fargo Bank, N.A., No. 23-CV-617- 12 DMS-BLM, 2023 WL 5109532, at *2 (S.D. Cal. Aug. 9, 2023); Mehta v. Robinhood Fin. LLC, 13 No. 21-CV-01013-SVK, 2021 WL 6882377, at *8 (N.D. Cal. May 6, 2021). 14 Plaintiffs sufficiently identify the type of information that can be subject to an 15 unauthorized access or exfiltration under the CCPA. Plaintiffs allege that either (1) their first and 16 last name, account security code, and social security number, driver’s license number, or account 17 number, see Cal. Civ. Code § 1798.81.5(d)(1)(A)(3); or (2) username or email address in 18 combination with a password or security question and answer that permits access to an online 19 account, see id. § 1798.150(a)(1), were improperly accessed or stolen. Compl. ¶¶ 109, 112. The 20 Court can reasonably infer from Plaintiffs’ allegations that “Jason B.” knew about the Plaintiffs’ 21 accounts and had already initiated allegedly fraudulent wire transfers when he called them, Compl. 22 ¶¶ 29–43, 114, that he or his conspirators had access to this personal information. 23 But Plaintiffs do not sufficiently allege that any access or exfiltration was the result of 24 Defendant’s violation of the duty to implement and maintain reasonable security procedures. 25 Plaintiffs assert that Defendant’s “failure to implement a security procedure” allowed Jason B. to 26 access their accounts and initiate wire transfers, Compl. ¶ 114, but this allegation just restates the 27 statutory elements of a CCPA claim. See Maag v. US Bank, Nat’l Ass’n, No. 21-CV-00031-H-LL, 1 did not implement and maintain reasonable security procedures and practices, failed to effectively 2 monitor its systems, and had lax security). Plaintiffs allege that they took “reasonable 3 precautions” to protect their account access by “using passwords, and other security measures 4 provided by Defendant,” Compl. ¶ 28, but they do not sufficiently allege that Jason B. accessed 5 Plaintiffs’ personal information from Defendant, rather than from another source.11 Cf. Udo v. 6 Wells Fargo Bank, N.A., No. 23-CV-02935-JSW, 2023 WL 8600791, at *3 (N.D. Cal. Dec. 12, 7 2023) (noting plaintiff only recited elements of the statute and failed to explain why the theft was 8 not the result of his own action of losing his briefcase). Additionally, at least some cases denying 9 dismissal of a CCPA claim did so only where the defendant had admitted there was a broad data 10 breach, which is not alleged here. Cf. Mehta, 2021 WL 6882377, at *1. 11 Plaintiffs argue that they adequately pleaded four facts that establish that unreasonable 12 security procedures resulted in the data breach: (1) a Citibank phone number was able to be 13 hacked by an “outside agent”; (2) Plaintiff was directed to call the “imposter” number one day 14 later by Citibank’s actual fraud department; (3) Defendant’s agents “cannot explain the reason for 15 possible infiltration”; and (4) Defendant allowed criminals to drain $600,000 from Plaintiffs’ 16 accounts to banks in another state in less than a day without identifying or alerting Plaintiffs to any 17 abnormal activity. Opp. at 28–29 (citing Compl. ¶¶ 29–34, 47, 51–52). Defendant correctly 18 observes that none of these allegations are direct evidence that its security procedures for 19 protecting personal information were deficient, see Reply at 15—only the allegations that the 20 funds were depleted in a day without alert and that Jason B. was able to spoof a fraud phone 21 number clearly implicate security procedures at all, and both of those allegations relate to the 22 improper wire transfers rather than the alleged pre-transfer data breach. Given this, the Court 23 DISMISSES Plaintiffs’ CCPA claim with leave to amend. 24 25

26 11 Plaintiffs allege that only Defendant knew that they had a security key. See Opp. at 27 (citing Compl. ¶ 24). Even if this were sufficient to overcome the other deficiencies, Plaintiffs’ CCPA 27 theory appears to be that Defendant’s security procedures allowed Jason B. to access personal 1 v. Violation of California Consumer Records Act (Claim Five) 2 Defendant next moves to dismiss Plaintiffs’ California Consumer Records Act claim. 3 Plaintiffs alleges that Defendant violated California Civil Code section 1798.81.5 “by failing to 4 implement reasonable security procedures and practices to protect [Plaintiffs’] personal 5 information.” Compl. ¶ 119. Defendant argues that it is exempt from this provision as a financial 6 institution. Mot. at 18–19. Section 1798.81.5(e)(2) exempts “[a] financial institution as defined in 7 Section 4052 of the Financial Code and subject to the California Financial Information Privacy 8 Act.” Plaintiffs concede that financial institutions are exempt and do not dispute that Defendant 9 qualifies. Opp. at 22. The Court thus DISMISSES this claim without leave to amend. Cf. Shah 10 v. Cap. One Fin. Corp., 768 F. Supp. 3d 1033, 1049 (N.D. Cal. 2025) (dismissing similar claim 11 without leave to amend); Chen v. JPMorgan Chase Bank, N.A., 745 F. Supp. 3d 1025, 1034 (C.D. 12 Cal. 2024) (same). 13 Plaintiffs also allege that Defendant violated California Civil Code section 1798.82(a) “by 14 failing to notify Plaintiffs when [Defendant’s] security system was breached and that Plaintiffs’ 15 personal data, which should have been encrypted by Defendant but which was not, was obtained 16 by unauthorized persons.” Compl. ¶ 120. Defendant argues that Plaintiff has not adequately 17 alleged that a security breach occurred or when Defendant first discovered the purported breach. 18 Mot. at 19–20. Section 1798.82(a) requires businesses to “disclose a breach of the security of the 19 system following discovery or notification of the breach . . . without unreasonable delay.” Cal. 20 Civ. Code § 1798.82(a). Plaintiffs must plead a breach of security. See Shah, 768 F. Supp. 3d at 21 1050. Additionally, because these claims are actionable “for the harms resulting from 22 unreasonably delayed notification, a plaintiff must state when a defendant learned of the relevant 23 breach.” Chen, 745 F. Supp. 3d at 1034; Shah, 768 F. Supp. 3d at 1049–50. As it stands, 24 Plaintiffs plead that “negligently hired employees or third-party actors [accessed] Plaintiff LSCC’s 25 accounts . . . before ever speaking to Plaintiff [Kamrani].” Compl. ¶ 122. Plaintiffs do not dispute 26 Defendant’s characterization and agree that they are required to plead specific facts “related to 27 whether the unauthorized wire transfers constitute security breaches pursuant to Cal. Civ. Code 1 § 1798.82(a)” and that “allege when Defendant became aware of the breaches.”12 Opp. at 22. The 2 Court thus DISMISSES this claim with leave to amend. 3 vi. Violation of UCL (Claim Six) 4 Defendant argues that Plaintiffs do not sufficiently plead that they lack an adequate remedy 5 at law. Mot. at 20. Defendant relies on the Ninth Circuit’s ruling in Sonner v. Premier Nutrition 6 Corp, 971 F.3d 834 (9th Cir. 2020), which held that “federal courts must apply equitable 7 principles derived from federal common law to claims for equitable restitution under” California’s 8 Unfair Competition Law (“UCL”). Id. at 837. One established equitable principle is that 9 equitable remedies will not be awarded when there is an “adequate remedy at law.” Id. at 842. 10 “[T]he fundamental thing that Sonner, by its own terms, requires at the pleadings stage is that the 11 complaint ‘allege that [the plaintiff] lacks an adequate legal remedy.’” Johnson v. Trumpet Behav. 12 Health, LLC, No. 3:21-CV-03221-WHO, 2022 WL 74163, at *3 (N.D. Cal. Jan. 7, 2022) (quoting 13 Sonner, 971 F.3d at 844). 14 Courts differ as to what Sonner requires at the pleading stage. While some courts have 15 required plaintiffs to articulate why damages are an inadequate remedy, other courts decline to 16 mandate substantiation. Compare Watkins v. MGA Entertainment, Inc., 550 F. Supp. 3d 815, 17 837–38 (N.D. Cal. 2021), with Murphy v. Olly Pub. Benefit Corp., 651 F. Supp. 3d 1111, 1129 18 (N.D. Cal. 2023). This Court has recently held that explicitly alleging the absence of an adequate 19 remedy at law is sufficient at the pleading state. Law. v. Homary Int’l Ltd., No. 24-CV-04113- 20 HSG, 2025 WL 1571856, at *7 (N.D. Cal. June 2, 2025); see also Johnson, 2022 WL 74163, at *3 21 (“[I]f a plaintiff pleads that she lacks an adequate legal remedy, Sonner will rarely (if ever) require 22 more this early in the case.”). 23 Here, while Plaintiffs do not explain “why monetary damages would be inadequate to 24 make [them] whole,” they do explicitly plead that they “lack[] an adequate remedy at law, as 25

26 12 This quote from Plaintiffs’ opposition is somewhat at odds with the allegations in the complaint, as the former implies the unauthorized wire transfers were the security breach, while the latter 27 suggests the security breach (as in Plaintiffs’ CCPA claim) is what enabled Jason B. to initiate the 1 actual damages cannot be recovered.” Compl. ¶ 138; Smith v. Apple, Inc., No. 21-CV-09527- 2 HSG, 2023 WL 2095914, at *3 (N.D. Cal. Feb. 17, 2023). Such a statement would normally be 3 sufficient at the pleading stage. Defendant disputes this by citing to this Court’s recent decision to 4 dismiss an equitable claim in Lopez v. Mead Johnson Nutrition Co., No. 24-CV-03573-HSG, 2025 5 WL 895213 (N.D. Cal. Mar. 24, 2025), but the plaintiff there had not alleged that she lacked an 6 adequate remedy at law or otherwise explained how an award of damages under any of her 7 remaining claims would be inadequate. Id. at *6. Similarly, in Smith v. Apple, Inc., No. 21-CV- 8 09527-HSG, 2023 WL 2095914, at *3 (N.D. Cal. Feb. 17, 2023), the plaintiffs had sought 9 equitable claims in the alternative, if there was no adequate remedy at law. Cf. Johnson, 2022 WL 10 741336, at *3 (similarly dismissing claims with purely conditional language). In contrast, 11 Plaintiffs explicitly allege that they lack an adequate remedy at law. 12 However, Plaintiffs specifically plead that they lack an adequate remedy at law because 13 “actual damages cannot be recovered,” citing Bank of the West v. Superior Court, 2 Cal. 4th 1254, 14 1266 (1992). Compl. ¶ 138. That citation states that damages are not available under the UCL. 15 But the relevant inquiry considers the other causes of action that Plaintiffs have available. See 16 Guzman v. Polaris Indus. Inc., 49 F.4th 1308, 1313 (9th Cir. 2022) (“Sonner’s holding applies to 17 equitable UCL claims when there is a viable CLRA damages claim . . . .”). Because Plaintiffs 18 have chosen to clearly articulate their basis for concluding that there is no adequate remedy at law, 19 and because the Court can determine that this basis is defective as a matter of law, these 20 allegations are insufficient. 21 Moreover, the Court must dismiss this claim for lack of standing. Plaintiffs only seek 22 injunctive relief under the UCL. Compl. at 36–37. To have standing to seek injunctive relief 23 under Article III, a plaintiff must “demonstrate a real and immediate threat of repeated injury in 24 the future.” Chapman v. Pier 1 Imports (U.S.) Inc., 631 F.3d 939, 946 (9th Cir. 2011) (quotation 25 omitted). So once a plaintiff has been wronged, they are entitled to injunctive relief only if they 26 can show that they face a “real or immediate threat . . . that [they] will again be wronged in a 27 similar way.” Mayfield v. United States, 599 F.3d 964, 970 (9th Cir. 2010) (quotation omitted). 1 Citibank. But Plaintiffs have not alleged anything about their current relationship with Defendant 2 or what specific injunctive relief they seek from which the Court can determine that Plaintiffs face 3 a risk of future injury. The Court thus DISMISSES the UCL claim with leave to amend.13 4 vii. Negligent Hiring (Claim Seven) 5 Defendant argues that Plaintiffs fail to allege that Citibank hired an unfit employee or that 6 it knew or should have known that it created a risk or hazard by hiring a particular employee. See 7 Mot. at 23–24. Plaintiffs concede that they have failed to state a claim for negligent hiring. Opp. 8 at 32. The Court DISMISSES this claim with leave to amend. 9 IV. CONCLUSION 10 Defendant’s motion to dismiss, Dkt. No. 13, is GRANTED IN PART and DENIED IN 11 PART. The Court DENIES the motion with respect to Plaintiffs’ claims for intentional 12 misrepresentation (Count Two) and violation of California Commercial Code section 11204 13 (Count Three). The Court GRANTS the motion with respect to the remainder of the claims. All 14 claims are dismissed WITH LEAVE TO AMEND, except Plaintiffs’ claims under California 15 Civil Code section 1798.81.5 and California Commercial Code sections 11201(b), 11205. Any 16 amended complaint must be filed within 21 days of the date of this order, and may not add any 17 new claims or defendants. 18 The Court further SETS a case management conference on December 9, 2025 at 2:00 p.m. 19 The hearing will be held by Public Zoom Webinar. All counsel, members of the public, and 20 media may access the webinar information at https://www.cand.uscourts.gov/hsg. All attorneys 21 and pro se litigants appearing for the case management conference are required to join at least 15 22 minutes before the hearing to check in with the courtroom deputy and test internet, video, and 23 audio capabilities. The parties are further DIRECTED to file a joint case management statement 24 by December 2, 2025. 25 // 26 // 27 1 IT IS SO ORDERED. 2 || Dated: 11/10/2025 3 Alayerl 5

HAYWOOD S. GILLIAM, JR.

4 United States District Judge 5 6 7 8 9 10 1] as 12

13 «14

16

17

Oo

Z 18

19 20 21 22 23 24 25 26 27 28