I. FACTUAL AND PROCEDURAL BACKGROUND

A. Factual Background Severin is an auto towing company doing business as “USA Towing & Recovery.” Severin is owned and operated by brothers Asad and Basil Raffo, who started the company in 2007. That year, Severin hired Guillermo Oseguera as its first employee. The company did not run a background check

3 on Oseguera when it hired him, but a check a few years later came back clean. Oseguera began as a tow truck driver, and was promoted to lot manager within a year. He was “ ‘100 percent responsible’ for running the lot.” Tow truck drivers would drop an average of four to five cars at the lot each day. Each driver would give Oseguera an invoice for the vehicle, which Oseguera was supposed to enter into Severin’s computer system. When someone would come to retrieve a vehicle, that person would give payment to Oseguera, who would release the vehicle. Oseguera “was the only lot manager that had the power to ‘release’ cars from the lot by himself.”3 At the end of each day, Oseguera was supposed to take the invoices and payments to Asad. Asad testified in his deposition that Oseguera “ ‘was 100 percent responsible for receiving the car, entering the information [into Severin’s computer system], receiving the check and then releasing the car, and he would run that all through [Asad].” No one at Severin reviewed Oseguera’s files or compared the invoices he delivered at the end of each day to the original invoices in his files. Severin first suspected in mid-2016 that Oseguera might be stealing money. Severin discovered that from time-to-time, at the end of the work day, Oseguera “would actually steal one or two checks and misfile the related invoices.” When Asad confronted Oseguera about the theft, Oseguera left work and never returned. Asad filed a police report, but never took legal action against Oseguera because he was “a fugitive . . . in Mexico.”

3 Asad explained in deposition that managers of Severin’s other lots “needed permission” because they did not have the software required to generate invoices.

4 After Oseguera’s departure, Severin implemented several new procedures to prevent employee theft, including installation of surveillance cameras on the lot, use of triplicate invoices delivered simultaneously to the lot manager and an owner, and division of responsibility for intaking and releasing vehicles. Still, Asad testified Oseguera “could have come up with something else” to circumvent Severin’s new measures. It “blew out [Asad’s] mind,” in the first place, “that somebody could cash a check written to somebody else.” About a month after it discovered the fraud, Severin notified Oseguera’s bank (Chase). Based on a review of Oseguera’s account records for the period January 2014 through September 2016, it appears he deposited into his own account 211 checks payable to “USA Towing” totaling $156,805.30. Each check was for an amount less than $1,500, and was deposited at an ATM. Oseguera endorsed the checks with what appears to be his own name or initials, rather than the name Severin or USA Towing.4 Under Chase’s applicable Deposit Review Operations procedures, checks under $1,500 deposited at ATM’s were “automatically processed and accepted for deposit without human review.” Accordingly, every check at issue “was processed by automatic means and accepted without review for deposit into Oseguera’s account.”

4 The appellate record contains Severin’s stolen checks and several unrelated checks payable to Oseguera. He endorsed all of these checks in a substantially similar manner, with what appear to be two initials followed by handwriting that is difficult to decipher (see exemplar attached as Appendix A, post, page 23). Chase’s appellate counsel acknowledged at oral argument that none of the “squiggle[d]” endorsements on the checks appear on their face to be in the name of Severin or USA Towing. We agree. 5 B. Severin’s Complaint Severin sued Chase in August 2017 to recover the sums Oseguera stole. Severin’s complaint asserted three causes of action: (1) a statutory negligence claim alleging Chase breached a duty of care by permitting Oseguera to deposit checks payable to USA Towing into his personal account without verifying the endorsements; (2) a statutory conversion claim alleging Chase converted funds by allowing Oseguera to deposit checks lacking proper endorsements into his personal account; and (3) a UCL claim premised on the statutory violations alleged in the first two causes of action. C. Cross-Motions for Summary Disposition The parties eventually filed simultaneous dispositive motions—Severin moved for summary adjudication of its conversion claim, and Chase moved for summary judgment (or, in the alternative, summary adjudication) of all of Severin’s claims. 1. Chase’s Motion Chase moved for summary judgment on two grounds. First, Chase argued that claims arising from 34 of the stolen checks were time-barred under the applicable three-year statute of limitations. (See Edward Fineman Co. v. Superior Court (1998) 66 Cal.App.4th 1110, 1117- 1118 (Edward Fineman) [individual checks are subject to summary adjudication].) Severin did not contest the argument, and the trial court found it meritorious. Second, Chase argued all of Severin’s claims were barred by the defense set forth in section 3405, which, as noted, can shield a bank from liability for accepting a check made out to an employer if an employee “fraudulently indorse[d]” the check and the bank exercised “ordinary care” in accepting the check “in good faith.” (§ 3405, subd. (b).) Chase relied on the

6 definition of “ordinary care” set forth in section 3103, subdivision (a)(7), which, in certain circumstances, allows banks to accept checks “by automated means” without “examin[ing]” them.5 Chase submitted a declaration and report from a banking expert who asserted Chase “exercised ordinary care and observed reasonable commercial standards in the process of the ATM deposits at issue.” Chase did not address the fraudulent indorsement prong of the defense. In opposition, Severin argued Chase had failed to establish its section 3405 defense because it had not shown that Oseguera fraudulently indorsed the stolen checks as required by section 3405. Citing the statute’s narrow definition of a “fraudulent indorsement” as “a forged indorsement purporting to be that of the employer” (§ 3405, subd. (a)(2), italics added),6 Severin argued that because Oseguera had signed the checks in his own name, rather than in Severin’s or USA Towing’s name, Chase had not satisfied the threshold criterion. Severin also argued Chase “did not act with ordinary

5 Section 3103, subdivision (a)(7) states: “ ‘Ordinary care’ in the case of a person engaged in business means observance of reasonable commercial standards, prevailing in the area in which the person is located, with respect to the business in which the person is engaged. In the case of a bank that takes an instrument for processing for collection or payment by automated means, reasonable commercial standards do not require the bank to examine the instrument if the failure to examine does not violate the bank’s prescribed procedures and the bank’s procedures do not vary unreasonably from general banking usage not disapproved by this division or Division 4 (commencing with Section 4101).”

6 The definition also covers another scenario not at issue here: “[I]n the case of an instrument with respect to which the employer is the issuer, a forged indorsement purporting to be that of the person identified as payee.” (§ 3405, subd. (a)(2).)

7 care” because its ATM check deposit procedures were “commercially unreasonable.” In its reply, Chase did not address the contention that it had failed to establish the fraudulent indorsement prong of the section 3405 defense. Instead, Chase highlighted the undisputed facts showing it acted with ordinary care in accepting the ATM check deposits. Chase also highlighted that Severin had not attempted to defend its negligence or UCL claims. Finally, Chase incorporated by reference its opposition to Severin’s cross- motion for summary adjudication, in which Chase argued Severin’s conversion claim was also barred by section 3406, which precludes recovery by “[a] person whose failure to exercise ordinary care substantially contribute[d] to . . . the making of a forged signature.” (§ 3406, subd. (a).) Chase asserted cursorily that “[i]t was [Severin]’s total failure to supervise its employee that allowed [him] to steal the checks . . . .” 2. Severin’s Motion Severin moved for summary adjudication of its statutory conversion cause of action, arguing the undisputed facts satisfied the elements of the claim and established that Chase’s ordinary care defense failed as a matter of law. Severin supported its motion with a declaration and report from a banking expert who opined Chase’s check deposit procedures were “commercially unreasonable” and “inconsistent with general banking usage.” Chase opposed Severin’s motion and moved to exclude Severin’s expert evidence. The trial court ultimately granted the exclusion motion, and Severin does not challenge that ruling. Chase opposed Severin’s summary adjudication motion on the basis that the conversion claim was barred by the ordinary care defenses set forth in sections 3405 and 3406.

8 In reply, Severin argued primarily that Chase had not exercised ordinary care in accepting the checks at issue. D. Trial Court’s Rulings The trial court granted Chase’s summary judgment motion and denied Severin’s motion as moot. First, as noted, the trial court found that Severin’s claims regarding 34 of the checks were time-barred. Second, the court found that Chase’s unrebutted expert evidence established a section 3405 ordinary care defense to Severin’s conversion claim. The court did not explain how Chase had satisfied section 3405’s fraudulent indorsement requirement, nor did the court address Chase’s section 3406 argument. Finally, the court found that Severin’s negligence and UCL claims failed because (1) Severin “fail[ed] to raise any argument as to” them; (2) the negligence claim was also barred by the section 3405 defense; and (3) the UCL claim was merely derivative of Severin’s other unmeritorious claims. The trial court entered judgment in Chase’s favor.

II. DISCUSSION

Severin maintains the section 3405 and 3406 defenses do not support summary disposition of its conversion claim (or derivative UCL claim).7

7 The statute on which Severin based its conversion claim (§ 3420) has its own “good faith” defense, but, by its express terms, it does not apply to “a depositary bank” like Chase. (§ 3420, subd. (c) [“[a] representative, other than a depositary bank, who has in good faith dealt with an instrument . . . is not liable in conversion,” italics added]; see § 4105 [defining a depositary bank as “the first bank to take an item”]; Laurie B LLC v. Wells Fargo Bank, N.A. (C.D.Cal., May 8, 2015, No. CV 14-3942-DMG (SSX)) 2015 WL 12656285, at p. *5 (Laurie B.) [although prior version of “conversion statute provided a good faith defense to depositary banks, [it] was subsequently eliminated in 1992”]; Official Comment on Cal. U. Com. Code, 23A pt. 2 West’s Ann. Com. Code (2002 ed.) foll. § 3420, p. 507, comment 3 [protection 9 As to section 3405, Severin contends Chase failed to meet its burden of establishing that Oseguera fraudulently indorsed the stolen checks. We agree. As to section 3406, Severin maintains (1) Chase waived the issue by failing to timely and properly assert it in its own motion; (2) there are factual disputes about whether Severin’s alleged “failure to exercise ordinary care contribute[d] to . . . the making of a forged signature” (§ 3406, subd. (a));8 and (3) Chase failed to exercise ordinary care by accepting the stolen checks via automated means. We disagree that Chase waived the section 3406 defense, but agree that factual disputes preclude summary judgment under it. A. Summary Judgment Principles “Summary judgment is appropriate only ‘where no triable issue of material fact exists and the moving party is entitled to judgment as a matter of law.’ ” (Regents of University of California v. Superior Court (2018) 4 Cal.5th 607, 618; see Code Civ. Proc., § 437c, subd. (c).) A defendant who moves for summary judgment has the initial burden of showing each alleged cause of action is without merit. (Code Civ. Proc., § 437c, subd. (c); Aguilar v. Atlantic Richfield Co. (2001) 25 Cal.4th 826, 843.) A defendant can meet this burden by “prov[ing] an affirmative defense, disprov[ing] at least one essential element of the plaintiff’s cause of action [citations], or show[ing] that an element of the cause of action cannot be established.” (Sanchez v. Swinerton & Walberg Co. (1996) 47 Cal.App.4th 1461, 1465; see Hutton v.

for depositary banks in former version was eliminated because it “drew criticism from the courts, that saw no reason why a depositary bank should have the defense”].)

8 Severin does not argue that section 3406 does not apply because Oseguera’s endorsements do not constitute “forged signature[s]” under section 3406. We will assume without deciding that section 3406 applies.

10 Fidelity National Title Co. (2013) 213 Cal.App.4th 486, 492.) “ ‘[A] defendant moving for summary judgment based upon the assertion of an affirmative defense . . . “has the initial burden to show that undisputed facts support each element of the affirmative defense.” ’ ” (Consumer Cause, Inc. v. SmileCare (2001) 91 Cal.App.4th 454, 467-468 (Consumer Cause).) “We review an order granting summary judgment de novo.” (Serri v. Santa Clara University (2014) 226 Cal.App.4th 830, 858.) “A trial court’s stated reasons for granting summary judgment do not bind us; we review the court’s ruling, not its rationale.” (Citizens for Odor Nuisance Abatement v. City of San Diego (2017) 8 Cal.App.5th 350, 358.) If an appellate court reverses summary judgment on grounds affecting fewer than all causes of action, the appellate court may direct the trial court to enter an order granting summary adjudication of the unaffected causes of action so long as the moving party alternatively moved for summary adjudication of them. (See Code Civ. Proc., § 437c, subd. (f)(2); Troyk v. Farmers Group, Inc. (2009) 171 Cal.App.4th 1305, 1354-1355 (Troyk).) B. General Principles Regarding the UCC and Checks In enacting sections 3405 and 3406, the Legislature adopted UCC sections 3-405 and 3-406, respectively, as proposed by the National Conference of Commissioners on Uniform State Laws. (See Edward Fineman, supra, 66 Cal.App.4th at p. 1121; Lee Newman, M.D., Inc. v. Wells Fargo Bank (2001) 87 Cal.App.4th 73, 81-82 (Lee Newman).) The Legislature directed that the statutes be “interpreted and applied in accordance with the Official Comments of the National Conference of Commissioners on Uniform State Laws.” (Edward Fineman, at p. 1121; see Lee Newman, at p. 82.) Additionally, because “one important purpose of the Uniform Commercial Code is to make uniform the law among the various jurisdictions . . . we

11 generally afford great deference to the decisions of our sister jurisdictions interpreting its provisions.” (Oswald Machine & Equipment, Inc. v. Yip (1992) 10 Cal.App.4th 1238, 1247; see § 1103, subd. (a)(3).) Sections 3405 and 3406 appear in division 3 of the California Uniform Commercial Code, which “applies to negotiable instruments.” (§ 3102, subd. (a).) “ ‘[N]egotiable instruments . . . is a fancy word for checks.’ ” (HH Computer Systems, supra, 231 Cal.App.4th at p. 227, italics omitted.) A transaction involving a “ ‘check typically involve three parties, (1) the “drawer” who writes the check, (2) the “payee”, to whose order the check is made out, and (3) the “drawee” or “payor bank” . . . [that] has the drawer’s checking account from which the check is to be paid.’ ” (Mills v. U.S. Bank (2008) 166 Cal.App.4th 871, 881, fn. 10 (Mills).) “ ‘After receiving the check, the payee typically indorses it on the back in the payee’s own name, and then deposits it in the payee’s account in a different bank, the “depositary bank”. The depositary bank credits the check to the payee’s account, and sends the check through the check clearing system to the payor bank for ultimate payment from the drawer’s account.’ ” (Ibid.) C. Chase Did Not Meet Its Burden to Show That Section 3405 Applies Section 3405 provides a bank with a “defense for accepting a check made out to [an] employer that has been fraudulently [i]ndorsed by [an] employee.” (Taubman v. USAA Federal Savings Bank (N.D.Cal. 2019) 408 F.Supp.3d 1053, 1054 (Taubman); see Lee Newman, supra, 87 Cal.App.4th at p. 82; § 3405, subd. (b).9) The statute allocates the risk of loss to the

9 Section 3405, subdivision (b) states: “For the purpose of determining the rights and liabilities of a person who, in good faith, pays an instrument or takes it for value or for collection, if an employer entrusted an employee with responsibility with respect to the instrument and the employee . . . makes a fraudulent indorsement of the instrument, the indorsement is effective as the 12 employer when (1) “the employer ‘entrusted [the] employee with responsibility with respect to’ the check”; (2) the check was “fraudulently [i]ndorsed by the employee”; and (3) “the bank accepted the check ‘in good faith.’ ” (Taubman, at p. 1054, quoting § 3405, subd. (b); see Lee Newman, at p. 82.) “If these requirements are satisfied, the extent of the defense depends on the doctrine of comparative negligence. If the bank was not negligent”— that is, if it exercised ordinary care as defined in section 3103, subdivision (a)(7) (see fn. 5, ante)—“the defense is complete. If the bank was negligent, then it remains partially liable, with liability based on the extent to which the bank’s negligence ‘contributed to the loss.’ ” (Taubman, at p. 1054; see Lee Newman, at p. 83.) Section 3405 defines a “[f]raudulent indorsement” as occurring in two circumstances in which an employee endorses a check in a manner purporting to be that of the payee.10 In the circumstance at issue here, involving “an instrument payable to the employer,” a “[f]raudulent indorsement” is “a forged indorsement purporting to be that of the employer.” (§ 3405, subd. (a)(2), italics added.) It is sufficient if the endorsement is “substantially similar” to the employer’s name. (§ 3405, subd. (c).)

indorsement of the person to whom the instrument is payable if it is made in the name of that person. If the person paying the instrument or taking it for value or for collection fails to exercise ordinary care in paying or taking the instrument and that failure contributes to loss resulting from the fraud, the person bearing the loss may recover from the person failing to exercise ordinary care to the extent the failure to exercise ordinary care contributed to the loss.” (§ 3405, subd. (b).)

10 The entire definition reads: “ ‘Fraudulent indorsement’ means (A) in the case of an instrument payable to the employer, a forged indorsement purporting to be that of the employer, or (B) in the case of an instrument with respect to which the employer is the issuer, a forged indorsement purporting to be that of the person identified as payee.” (§ 3405, subd. (a)(2).)

13 In light of this definition, the courts and commentators agree that when an employee has endorsed a check other than in a name “purporting to be that of the employer” (§ 3405, subd. (a)(2)), the employee has not made a “fraudulent indorsement.” (See John Hancock Financial Services, Inc. v. Old Kent Bank (E.D.Mich. 2002) 185 F.Supp.2d 771, 773-774, 778 [no fraudulent indorsement where employee of “John Hancock Financial Services, Inc.” endorsed checks payable to employer with “Sherman and Associates Financial Services”]; Continental Cas. Co. v. Fifth/Third Bank (N.D.Ohio 2006) 418 F.Supp.2d 964, 975 [no fraudulent indorsement where employee endorsed checks payable to employer with “missing or illegible endorsements”]; Willier, Inc. v. Hurt (S.D.W.Va., Dec. 31, 2007, No. CIV.A. 5:06-CV-00547) 2007 WL 4613033, at p. *6 [no fraudulent indorsement where employee deposited checks payable to employer into personal account with no endorsement]; McMullen Oil Co. v. Crysen Ref., Inc. (In re McMullen Oil Co.) (Bankr.C.D.Cal. 2000) 251 B.R. 558, 565, 574-575 (McMullen) [no fraudulent endorsement where employee of “McMullen Oil Co.” endorsed checks payable to that entity with “McMullen Oil Co. Pension Plan,” italics added]; Laurie B, supra, 2015 WL 12656285, at p. *5 [no fraudulent indorsement where employee of “Laurie B LLC” endorsed checks payable to “Desert Underground Utilities Inc., dba Laurie B”];11 6B Lawrence’s Anderson on the Uniform Commercial Code (3d ed. Dec. 2020 supp.) Negotiable Instruments, § 3-405:11 (Anderson UCC); 4 Hawkland UCC Series (Dec. 2020 Update) § 3-405:1.)

11 The Ninth Circuit reversed summary judgment in Laurie B., finding there was a triable issue of fact about whether the names were substantially similar. (Laurie B LLC v. Wells Fargo Bank N.A. (9th Cir. 2017) 679 Fed.Appx. 598.)

14 The courts and commentators further agree that section 3405 does not apply unless an employee has made a fraudulent indorsement as defined in the statute. (See Mills, supra, 166 Cal.App.4th at p. 889 [“The instant case . . . does not fall within the scope of section 3405, as it does not concern fraudulent [i]ndorsements made by an employee”];12 McMullen, supra, 251 B.R. at pp. 574-575 [section 3405 “covers only [the] two categories of fraudulent indorsements” defined in the statute]; Anderson UCC, § 3-405:10 [“In order for this section to be applicable, there must be a fraudulent indorsement.”]; see also § 3405, com. 1 [section 3405 “is addressed to fraudulent indorsements” and “covers [the] two categories” specified in the definition].) Although Chase inexplicably failed to address the fraudulent indorsement prong in its summary judgment papers or in its briefing on appeal, Chase’s appellate counsel acknowledged at oral argument that, to establish it was entitled to summary judgment based on the section 3405 defense, Chase bore the initial burden of establishing that Oseguera fraudulently indorsed the stolen checks. (See Consumer Cause, supra, 91 Cal.App.4th at pp. 467-468 [a defendant moving for summary judgment “ ‘ “has the initial burden to show that undisputed facts support each element of [an] affirmative defense.” ’ ”], italics added.) We conclude Chase did not meet this burden.

12 The parties debate in their briefing the significance of our court’s decision in Mills. Mills is factually distinguishable because it did not involve employee fraud (it involved checks deposited by a payee entity into its affiliate’s bank account). (Mills, supra, 166 Cal.App.4th at p. 876.) The case is nevertheless instructive because it supports the general proposition that section 3405 applies only when an employee has made a fraudulent indorsement. (Mills, at p. 889.)

15 Quite simply, Chase never addressed the fraudulent indorsement prong of the section 3405 defense in its summary judgment papers. Neither Chase’s briefing nor separate statement of undisputed material facts addressed the manner in which Oseguera endorsed the checks (i.e., with what appear to be his own name or initials), or explained how those endorsements satisfied the statutory definition of a fraudulent indorsement (i.e, how they “purport[ed] to be that of the employer” (§ 3405, subd. (a)(2)). Instead, Chase skipped ahead to the ordinary care analysis. But none of the cases Chase cited on that issue in the trial court or on appeal involved section 3405’s fraudulent indorsement requirement. (See Story Road Flea Market, Inc. v. Wells Fargo Bank (1996) 42 Cal.App.4th 1733, 1737 [addressing § 4406, which has no fraudulent indorsement requirement]; Espresso Roma Corp. v. Bank of America (2002) 100 Cal.App.4th 525, 527 [same]; National Union Fire Ins. Co. v. Wells Fargo Bank, N.A. (C.D.Cal. Mar. 16, 2005, No. CV 03-2452 NM (CTx)) 2005 WL 6459866 [addressing only motion to exclude experts]; National Union v. Wells Fargo Bank (C.D.Cal. June 24, 2005, No. CV 03-02452-NM(CTx)) 2005 WL 6524450 [addressing motion for reconsideration of expert issues and summary judgment ruling on good faith/ordinary care].)13 “[C]ases are not authority for issues not raised or decided.” (Mintz v. Blue Cross of California (2009) 172 Cal.App.4th 1594, 1607.) At oral argument, Chase’s appellate counsel finally advanced a theory as to how the fraudulent indorsement prong was satisfied: Oseguera must

13 Both in the trial court and on appeal, Chase knowingly and improperly discussed an unpublished Court of Appeal opinion. (See Cal. Rules of Court, rule 8.1115 [unpublished Court of Appeal opinions “must not be cited or relied on by a . . . party in any other action”]; Olive v. General Nutrition Centers, Inc. (2018) 30 Cal.App.5th 804, 816.) We have not considered the improperly cited opinion.

16 have “intended” that his “squiggle[d]” name or initials on the stolen checks “be interpreted by Chase to be that of the employer.” This argument fails for two reasons. First, Chase forfeited it by raising it for the first time at oral argument. (See In re I.C. (2018) 4 Cal.5th 869, 888, fn. 5.) Second, even assuming without deciding that Oseguera’s intent is relevant to the issue, Chase has cited no evidence—let alone undisputed evidence—establishing his intent. More generally, Chase argues it is “self-evident” from a policy perspective that Severin should bear the losses caused by its employee. In support, Chase cites Lee Newman, which observed: “As explained in the Official Comment to the corresponding Uniform Commercial Code provision, ‘Section 3-405 is based on the belief that the employer is in a far better position to avoid the loss by care in choosing employees, in supervising them, and in adopting other measures to prevent forged indorsements on instruments payable to the employer . . . .’ ” (Lee Newman, supra, 87 Cal.App.4th at p. 83.) But Chase’s argument ignores the fact that the cited Official Comment begins by clarifying that “[s]ection 3-405 is addressed to fraudulent indorsements,” which include “indorsements made in the name of the employer.” (Official Comments on Cal. U. Com. Code, 23A, pt. 2 West’s Ann. Com. Code (2002 ed.) foll. § 3405, p. 426, comment 1 (§ 3405, com. 1).) We agree with section 3405’s risk-shifting policy as it relates to fraudulent indorsements. In that context, in which an employee’s endorsement “purport[s] to be that of the” employer or its payee, the employer is better situated than the bank to prevent or detect fraud—all the bank sees is a seemingly proper endorsement by the payee. But in the context presented here, in which an employee endorsed checks made payable to his employer in a name that does not appear on its face to be that of the

17 employer, the bank is equally well-suited to detect the apparent mismatch and there is no need to shift the risk of loss to the employer. In short, because Chase did not meet its burden to show that Oseguera “fraudulent[ly] indorse[d]” (§ 3405, subd. (a)(2)) the stolen checks, Chase is not entitled to summary judgment under section 3405. D. Fact Disputes Preclude Summary Judgment Under Section 3406 Section 3406 provides an ordinary care defense in broader circumstances than section 3405.14 (See Taubman, supra, 408 F.Supp.3d at p. 1055 [section 3406 “potentially applies in any situation (regardless of the identity of the victim and the perpetrator of the fraud) where a bank accepts an altered or forged check”].) Section 3406 provides a “defense to liability for accepting a fraudulent check if: (i) the victim’s own failure to exercise ordinary care was a cause of the fraud; and (ii) the bank took the check in good faith.” (Taubman, at p. 1055.) “As with Section 3405, if these requirements are satisfied, the extent of the defense depends on comparative negligence: if the bank was not negligent”—that is, if it exercised ordinary care—“it is free from liability; if the bank was also negligent, the loss is

14 Section 3406 states: “(a) A person whose failure to exercise ordinary care contributes to an alteration of an instrument or to the making of a forged signature on an instrument is precluded from asserting the alteration or the forgery against a person who, in good faith, pays the instrument or takes it for value or for collection. [¶] (b) Under subdivision (a), if the person asserting the preclusion fails to exercise ordinary care in paying or taking the instrument and that failure contributes to loss, the loss is allocated between the person precluded and the person asserting the preclusion according to the extent to which the failure of each to exercise ordinary care contributed to the loss. [¶] (c) Under subdivision (a), the burden of proving failure to exercise ordinary care is on the person asserting the preclusion. Under subdivision (b), the burden of proving failure to exercise ordinary care is on the person precluded.”

18 allocated between the bank and the victim ‘according to the extent to which the failure of each to exercise ordinary care contributed to the loss.’ ” (Taubman, at p. 1055.) Severin contends Chase waived its right to assert the section 3406 defense by waiting until its summary judgment reply brief to do so. We are not persuaded. “It is well established that the trial court’s consideration of additional reply ‘evidence is not an abuse of discretion so long as the party opposing the motion for summary judgment has notice and an opportunity to respond to the new material.’ ” (Jacobs v. Coldwell Banker Residential Brokerage Co. (2017) 14 Cal.App.5th 438, 449.) In the context of the parties’ cross-motions (in which Chase raised section 3406 in its opposition to Severin’s motion about three weeks before raising it in reply), and absent a request by Severin for leave to file a surreply, we find no waiver by Chase. (See Jacobs, at p. 449 [by failing “to ask the trial court for permission to submit responsive evidence or to file a sur-reply, . . . or to even object to the court’s consideration of the evidence, plaintiffs forfeited any claim of a due process violation”].) We are similarly unpersuaded by Severin’s assertion that Chase did not comply with the summary judgment statute’s procedure for incorporating items by reference. (See Code Civ. Proc., § 437c, subd. (b)(7) [“An incorporation by reference of a matter in the court’s file shall set forth with specificity the exact matter to which reference is being made and shall not incorporate the entire file.”].) Chase identified in its reply brief the specific materials within the court’s files that it sought to incorporate. This was sufficient. Turning to the substance of the section 3406 defense, we agree with Severin that disputed material facts preclude summary judgment. Whether

19 a party “fail[ed] to exercise ordinary care” and whether such a failure “substantially contribute[d]” to the forging of an instrument ordinarily are questions for the trier of fact to resolve. (See § 3406, com. 1 [“No attempt is made to define particular conduct that will constitute ‘failure to exercise ordinary care [that] substantially contributes to an alteration.’ Rather, ‘ordinary care’ is defined in Section 3-103(a)(7) in general terms. The question is left to the court or the jury for decision in the light of the circumstances in the particular case,” italics added]; Atlas Vegetable Exchange, Inc. v. Bank of America (1970) 10 Cal.App.3d 868, 876 [whether employer was negligent for failing to implement measures to prevent bookkeeper from forging checks was an issue of fact for jury]; Elden v. Merrill Lynch, Pierce, Fenner & Smith Inc. (S.D.N.Y., Mar. 30, 2011, No. 08 Civ. 8738(RJS)) 2011 WL 1236141, at p. *10 [“[S]ummary judgment is rarely warranted on this issue.”].) Chase cites evidence that would allow a jury to find that Severin failed to exercise ordinary care, thereby substantially contributing to Oseguera forging endorsements on the stolen checks. For example, Asad acknowledged Oseguera—unlike other lot managers—“was 100 percent responsible for receiving the car, entering the information, receiving the check and then releasing the car.” And after Severin discovered the embezzlement, Severin implemented additional controls to reduce the likelihood it would happen again, suggesting Severin was aware that its prior measures were inadequate. But Severin cites evidence that would allow the jury to reach a contrary conclusion. Asad explained that Oseguera had more authority than other lot managers in part because the others did not have access to the computer needed to generate invoices, but also because Oseguera was a trusted employee and Severin’s first hire. A subsequent background check on

20 Oseguera came back clean. Asad compared the checks and invoices Oseguera brought to him each day (“he would run all that through [me]”). And Asad testified it “blew out [his] mind . . . that somebody could cash a check written to somebody else,” and Oseguera “could have come up with something else” to circumvent Severin’s new precautions. On this record, we cannot say as a matter of law that a family-owned business “fail[ed] to exercise ordinary care” in supervising its long-time, trusted employee, who was intentionally stealing checks and misfiling corresponding invoices. Accordingly, Chase is not entitled to summary judgment under section 3406. E. Status of Claims Because Severin has not challenged the trial court’s rulings as to the negligence cause of action or the claims based on the 34 time-barred checks, we do not disturb the trial court’s rulings as to those claims, and will direct the trial court to grant summary adjudication on them in Chase’s favor. (See Troyk, supra, 171 Cal.App.4th at pp. 1354-1355.) And because Severin’s UCL claim is derivative of its conversion claim, and because summary judgment was erroneously granted as to the conversion claim, the UCL claim will be reinstated.

DISPOSITION

The judgment is reversed. The trial court is directed to vacate its order granting summary judgment, and to enter a new order granting summary adjudication to Chase on Severin’s negligence cause of action and all claims based on the 34 time-barred checks (identified at page 425 of Appellant’s Appendix), and denying summary adjudication to Chase on Severin’s

21 conversion and UCL causes of action. Severin is entitled to its costs on appeal.

HALLER, Acting P. J.

WE CONCUR:

AARON, J.

IRION, J.

22 Appendix A

23