Court Dismisses Some Claims Against Intuit for Allowing Refund Fraud

CHRISTINE DIAZ, et al.,
Plaintiffs,
v.
INTUIT, INC.,
Defendant.

UNITED STATES DISTRICT COURT
NORTHERN DISTRICT OF CALIFORNIA
SAN JOSE DIVISION

ORDER GRANTING IN PART AND
DENYING IN PART MOTION TO DISMISS

Re: Dkt. No. 78

I. INTRODUCTION

In this putative class action suit, six individual Plaintiffs¹ allege that Defendant Intuit, Inc. ("Intuit"), knowingly allowed fraudsters to open fake accounts and file fraudulent federal and state tax returns through Intuit's TurboTax tax preparation software. By separate order, this Court granted Intuit's motion to compel arbitration of four of the six individual Plaintiffs' claims and to stay their cases, which leaves only the claims of Plaintiffs Christine Diaz ("Diaz") and Richard Brown ("Brown") pending at present. In the instant motion, Intuit moves to dismiss the two remaining Plaintiffs' claims pursuant to Rules 12(b)(1) and (b)(6), Fed.R.Civ.P. See Intuit's Motion to Dismiss, p. 1, fnt. 1. The Court finds it appropriate to take the motion under submission for decision without oral argument pursuant to Civil Local Rule 7-1(b). For the reasons set forth below, Intuit's motion to dismiss is GRANTED in part and DENIED in part.

II. BACKGROUND

Intuit develops and offers various financial and tax preparation software and related services, including TurboTax, a tax preparation software program. TurboTax can be utilized online or it can be downloaded and installed on a customer's personal computer. Inuit charges persons who file tax returns through TurboTax a "tax preparation fee" generally between approximately $50 and $150, in addition to other fees.

Plaintiffs allege that Intuit has known for years that fraudsters exploit Intuit's lax security in order to open fraudulent accounts with Intuit and file numerous fraudulent tax returns through TurboTax in other peoples' names. Intuit allegedly allows the fraud to occur through TurboTax in two ways: (a) Stolen Identity Refund Fraud ("SIRF"), where a fraudster gathers data about a taxpayer from outside means, such as the black market or "phishing," creates a fraudulent, new TurboTax account in the victim's name, and files a fraudulent tax return in the victim's name through TurboTax; and (b) Account Takeover Refund Fraud ("ATO"), where a fraudster hacks into an existing TurboTax account and files a fraudulent return in the victim's name through TurboTax.

Intuit allegedly knew that it was allowing SIRF and ATO fraud to occur through TurboTax, and that its allegedly lax security protocols were enabling and assisting the fraud. An internal Intuit strategy presentation allegedly showed that the number of "suspicious" customers who successfully filed a return using TurboTax was approximately 900,000 in 2010 and 2.5 million in 2012. In 2015, Intuit's Chief Information Security Officer allegedly stated in an interview with KrebsOnSecurity.com that about 40% of the tax returns flagged as likely fraudulent by Intuit were the result of ATOs and 60% appeared to be the result of SIRFs.

Intuit allegedly knew that the risk of fraud perpetrated through TurboTax was continuing to increase as the number of major external "data breaches" increased, exposing the personal identifying information of millions of Americans to would-be fraudsters. Despite knowledge of widely reported data breaches involving identify theft, and knowledge of SIRF and ATO fraud, Intuit allegedly maintained lax security policies in order to boost its revenues. The allegedly lax policies included:

• allowing anyone to open TurboTax accounts without authenticating their identities;

• allowing TurboTax "tax preparation fees" to be paid from tax refund proceeds, which gave fraudsters a free shot at filing fraudulent returns through TurboTax with no outlay of money;

• providing a service that allows tax refunds to be directed to Intuit's affiliate Santa Barbara Bank, which, after deducting the "tax preparation fees" and an additional $34.99 "refund processing fee," sends the balance of the refund in non-traceable forms (such as pre-loaded debit cards) that substantially eliminated any chance fraudsters could be caught;

• delaying notification to tax authorities of returns Intuit deemed suspicious

• failing to apply reasonable limits on the number of returns that could be filed from a single account;

• failing to apply reasonable limits on the number of accounts that could be opened with the same social security number;

• permitting state returns to be filed without a corresponding federal return (an option which allegedly is recognized in the industry as facilitating the filing of fraudulent state returns and is not offered by Intuit's competitors);

• keeping open TurboTax accounts that were known to be used entirely for fraud and declining to flag as suspicious returns filed through such accounts despite repeated warnings from employees; and

• dispensing with multi-factor authentication, and allowing TurboTax accounts to be opened without authentication.

Intuit allegedly made a deliberate and knowing decision to maintain the protocols described above in order to generate revenue and market share. Plaintiffs also allege that Intuit's desire to maximize fee revenue cause it to ignore the recommendations of its own security experts, Robert Lee and Shane MacDougall.

Plaintiff Brown was never a TurboTax customer; he never used TurboTax, never provided Intuit with personally identifiable information or paid money to Intuit. Plaintiff Diaz purchased the desktop version of TurboTax in 2011 and used it to e-file her tax year 2010 Ohio state and federal tax returns. Since then, Diaz has not used TurboTax. Both Plaintiffs allege that they were the victims of SIRF fraud, "meaning that Intuit allowed a fake TurboTax account to be opened in their names and allowed fraudulent tax returns to be filed from that account in their names." SCAC at ¶¶ 88, 98. Plaintiffs assert claims for unfair competition, negligence, aiding and abetting fraud, "negligent enablement of third party imposter fraud," and unjust enrichment.

III. STANDARDS

A Rule 12(b)(1) motion challenges a court's subject matter jurisdiction and may be either facial or factual. Fed.R.Civ.P. 12(b)(1); Wolfe v. Strankman, 392 F.3d 358, 362 (9th Cir. 2004). When a defendant makes a facial challenge, as in this case, all material allegations in the complaint are assumed true, and the court must determine whether lack of federal jurisdiction appears from the face of the complaint itself. Wolfe, 392 F.3d at 362. Standing can be properly challenged through a Rule 12(b)(1) motion. White v. Lee, 227 F.3d 1214, 1242 (9th Cir. 2000). Since standing is "an indispensable part of the plaintiff's case, each element must be supported in the same way as any other matter on which the plaintiff bears the burden of proof." Lujan v. Defenders of Wildlife, 504 U.S. 555, 561 (1992).

A motion to dismiss under Rule 12(b)(6) tests the legal sufficiency of claims alleged in the complaint. Fed.R.Civ.P. 12(b)(6); Parks School of Business, Inc. v. Symington, 51 F.3d 1480, 1484 (9th Cir. 1995). Dismissal "is proper only where there is no cognizable legal theory or an absence of sufficient facts alleged to support a cognizable legal theory." Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 2001). The complaint "must contain sufficient factual matter, accepted as true, to 'state a claim to relief that is plausible on its face.'" Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)).

IV. DISCUSSION

A. Negligence (Second Count)

In order to plead a claim for negligence under California law, a plaintiff must establish the following elements: (1) the defendant owed a legal duty to use due care, (2) a breach of that duty, and (3) the breach was the proximate or legal cause of the resulting injury. Ladd v. Cnty. of San Mateo, 12 Cal. 4th 913, 917 (1996). "Whether a legal duty arises is a 'question of law which is simply an expression of the sum total of the policy considerations that lead a court to conclude that a particular plaintiff is entitled to protection.'" Ileto v. Glock Inc., 349 F.3d 1191, 1203 (9th Cir. 2003) (quoting Jacoves v. United Merchandising Corp., 9 Cal.App.4th 88, 114 (1992)). To determine whether to impose a legal duty, courts consider the factors set forth in Rowland v. Christian, 69 Cal.2d 108 (1968), including:

[F]oreseeability of harm to the plaintiff, the degree of certainty that the plaintiff suffered injury, the closeness of the connection between the defendant's conduct and the injury suffered, the moral blame attached to the defendant's conduct, the policy of preventing future harm, the extent of the burden to the defendant and consequences to the community of imposing a duty to exercise care with resulting liability for breach, and the availability, cost, and prevalence of insurance for the risk involved.

Id. at 113. The most important factor in establishing a duty is foreseeability. Tarasoff v. Regents of Univ. of Calif., 17 Cal.3d 425, 434-35 (1976). In general, there is no duty to protect against the conduct of another in the absence of a special relationship. Tarasoff, 17 Cal.3d at 435; see also, Burns v. Neiman Marcus Grp., Inc., 173 Cal.App.4th 479, 488-90 (2009) (retailer had no duty to inquire before accepting plaintiff's checks to pay off a retail employee's store credit card); Casey v. U.S. Bank Nat'l Ass'n, 127 Cal.App.4th 1138, 1149 (2005) (bank owes no duty to nondepositors to investigate or disclose suspicious activities).

Brown's Negligence Claim

The foreseeable factor weighs against imposing a duty with respect to Plaintiff Brown, who was not a TurboTax customer and never provided personal identifying information to Intuit. A third-party fraudster obtained Brown's personal identifying information elsewhere and used it to open TurboTax accounts and to file fraudulent returns in Brown's name. Brown has not alleged facts explaining how Intuit could have or should have known that the account(s) opened in Brown's name were fraudulent.

A banking case, Sun 'n Sand, Inc. v. United California Bank, 21 Cal.3d 671 (1978), is instructive. In that case, plaintiff Sun 'n Sand, at its employee's urging, made checks payable to defendant bank. The employee altered the checks to increase the sums then deposited the checks in her personal account with the bank. The bank permitted this negotiation without any inquiry, despite the fact that the checks were not payable to the employee but to the bank. Under these facts, the California Supreme Court held that a bank owes a limited duty of inquiry when a check presented for deposit bears some objective signs of fraud. The Court reasoned that the bank "may not ignore the danger signals inherent" in the transaction made in that case, and instead there must be "some objective indicia from which the bank could reasonably conclude that the party presenting the check is authorized to transact in the manner proposed." Sun 'n Sand, 21 Cal.3d at 695-96. Following the reasoning of Sun 'n Sand, the court in Software Design and Application, Ltd. V. Hoefer & Arnett, Inc., 49 Cal.App.4th 472 (1996), held that the defendant bank had no duty to noncustomer plaintiffs because unlike Sun 'n Sand, the noncustomer plaintiffs alleged no "suspicious circumstances" that would have placed defendant on notice of potential harm.

Brown has not alleged "suspicious circumstances" or "danger signals" that would have or should have placed Intuit on notice that a fraudster was opening a TurboTax account in his name. Therefore, Intuit's motion to dismiss Brown's negligence is granted with leave to amend.

Diaz's Negligence Claim

Intuit contends that Diaz's negligence claim is barred by the economic loss doctrine. Diaz contends that the economic loss doctrine is inapplicable because her claim arises from conduct outside the scope of her contractual relationship with Intuit. The Court agrees.

Diaz purchased the 2010 desktop version of TurboTax, and agreed to be bound by the Intuit Software End User License Agreement TurboTax Desktop Software — Tax Year 2010. The Limitation of Liability and Damages provision upon which Intuit relies provides that "THE ENTIRE CUMULATIVE LIABILITY OF INTUIT AND ITS AFFILIATES AND ITS SUPPLIERS FOR ANY REASON ARISING FROM OR RELATING TO THIS AGREEMENT SHALL BE LIMITED TO THE AMOUNT PAID BY YOU TO INTUIT FOR THE SOFTWARE IN THE 12 MONTH PERIOD IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO SUCH CLAIM." See Diaz Complaint, Ex. 1. Thus, the provision explicitly applies only to lability arising from or relating to "THIS AGREEMENT," which governs Diaz's installation, access and use of the licensed software. Diaz's negligence claim, however, is not predicated on her installation, access or use of the licensed software. Instead, it is based upon Intuit's allegedly lax policies that allowed a fraudster to open an entirely separate TurboTax account and to file fraudulent returns in Diaz's name. Therefore, Intuit's motion to dismiss Diaz's negligence claim on the grounds that it is barred by the economic loss doctrine is denied.

B. Negligent Enablement of Third Party Imposter Fraud (Fourth Count)

No California court has recognized a claim for negligent enablement of third party imposter fraud. Accordingly, the claim is dismissed with prejudice.

C. Aiding and Abetting Fraud (Third Count)

Liability may be imposed "on one who aids and abets the commission of an intentional tort if the person (a) knows the other's conduct constitutes a breach of duty and gives substantial assistance or encouragement to the other to so act or (b) gives substantial assistance to the other in accomplishing a tortious result and the person's own conduct, separately considered, constitutes a breach of duty to the third person." Saunders v. Super. Ct., 27 Cal. App. 4th 832, 846 (1994).

Plaintiffs' allegations are insufficient to establish a claim for aiding and abetting. Plaintiffs have not alleged that Intuit intentionally transmitted fraudulent returns in their names or in their Social Security numbers to taxing authorities. Plaintiffs instead allege that Intuit could determine if a return looked "suspicious," but suspicion does not amount to actual knowledge of fraud. Nor have Plaintiffs alleged that Intuit gave substantial assistance to the alleged fraud perpetrated against Brown and Diaz. Insubstantial assistance requires a "significant and active, as well as a knowing participation in the wrong." Alfus v. Pyramid Tech. Corp., 745 F.Supp. 1511, 1520 (N.D. Cal. 1990) (citation omitted). In this case, Plaintiffs allege that Intuit aided and abetting by failing to implement adequate measures: to verify taxpayer information when an account is created or a return is filed; to notify taxpayers and IRS and other taxing authorities of returns that were fraudulent or suspicious; or to timely report data regarding suspicious filings to the IRS and state taxing agencies. In general, failure to act does not constitute substantial assistance for purposes of aiding and abetting liability. See Fiol v. Doellstedt, 50 Cal.App.4th 1318, 1326 (1996) ("Mere knowledge that a tort is being committed and the failure to prevent it does not constitute aiding and abetting."); see also Howard v. Superior Court, 2 Cal.App.4th 745, 749 (1992) ("while aiding and abetting may not require a defendant to agree to join the wrongful conduct, it necessarily requires a defendant to reach a conscious decision to participate in tortious activity for the purpose of assisting another in performing a wrongful act"). Accordingly, the aiding and abetting claim is dismissed with leave to amend.

D. Violation of Unfair Competition Law (First Count)

Intuit seeks dismissal of the unfair competition claim, asserting that Plaintiffs lack standing because they cannot show that they were harmed as a result of the alleged unfair competition. Plaintiffs contend that they have alleged both an economic injury that confers UCL standing, as well as a violation of the UCL.

With respect to standing, Plaintiff Brown alleges that as a result of Intuit's conduct, he is no longer eligible to e-file his tax returns, that his tax refunds will be delayed because he is unable to e-file, and that he has incurred the cost of purchasing Equifax's identify theft and credit monitoring protection. These alleged losses are sufficient to establish Brown's standing to assert an unfair competition claim. See Law Offices of Matthew Higbee v. Expungement Assistance Servs., 214 Cal.App.4th 544, 561 (2013) ("[T]he quantum of lost money or property necessary to show standing" is "only so much as would suffice to establish injury in fact and it suffices to allege some specific, identifiable trifle of injury.") Brown is not required to have been a TurboTax customer in order to have standing. See, e.g., Allergan, Inc. v. Athena Cosmetics, Inc., 640 F.3d 1377, 1383 (Fed. Cir. 2011).

Diaz alleges, among other things, that her 2014 tax refund was delayed until September of 2015. Being "deprived of the use of money, including the ability to earn interest" constitutes a sufficient injury in fact for an unfair competition claim. Labriola v. Bank of Am., Nat. Ass'n, 2012 WL 1657191 at *6 (N.D. Cal. 2012). Accordingly, the Court finds Plaintiffs' allegations of standing sufficient to withstand a motion to dismiss.²

California Business & Professions Code § 17200 defines unfair competition as any "unlawful, unfair or fraudulent business act or practice." "Unlawful" practices are forbidden by law. Saunders v. Super. Ct., 27 Cal.App.4th 832, 838 (1999). "Unfair" practices constitute "conduct that threatens an incipient violation of an antitrust law, or violates the policy or spirit of one of those laws because its effects are comparable to or the same as a violation of the law, or otherwise significantly threatens or harms competition." Cel-Tech Commc'ns, Inc. v. L.A. Cellular Tel. Co., 20 Cal.4th 163 (1999). The "fraudulent" prong requires a showing of actual or potential deception to some members of the public, or harm to the public interest. See id. at 180.

Plaintiffs' contend that their unfair competition claim is predicated on "unfair" practices under both the "balancing" and "tethering" test applied by California courts. With respect to the "balancing" test, Plaintiffs allege that Intuit's conduct was "unethical, oppressive, unscrupulous, or substantially injurious to consumers," and that the resulting harm outweighs any countervailing benefits. Second Consolidated Amended Class Action Complaint, ¶ 178. Plaintiffs allege that Intuit implemented and carried out multiple policies that Intuit knew were encouraging and enabling widespread tax fraud, and deliberately did so in order to generate additional fee revenue. Plaintiffs further allege that there is no legitimate utility to Intuit's conduct, and even if there were any utility, it would be significantly outweighed by the gravity of the harm to consumers caused by Intuit's conduct. Id. Intuit counters that there are countervailing policy considerations that weigh against finding any "unfair" act. While that may be true, Plaintiffs' allegations are nevertheless sufficient at the pleading stage. In particular, it is questionable whether any legitimate policy considerations outweigh the gravity of harm that was allegedly caused by Intuit's policy of allowing tax refunds to be directed to Intuit's affiliate Santa Barbara Bank, and then essentially converted into non-traceable forms, such as pre-loaded debit cards.

Plaintiffs' allegations also satisfy the "tethering" test. Plaintiffs allege that Intuit's conduct violates California public policy, as reflected in numerous statutes, regulations and common law that prohibit fraud and specifically fraudulent tax filings. Plaintiffs need not allege a direct violation of a statute to satisfy the tethering test. See In re Carrier IQ, Inc., 78 F.Supp.3d 1051, 1116 (N.D. Cal. 2015): see also Cel-Tech Comm'ns, Inc. v. Los Angeles Cell. Tel. Co., 20 Cal.4th 187 (sufficient under tethering test to allege practice violates "spirit" of another law). Accordingly, Intuit's motion to dismiss the unfair competition claim is denied.

E. Unjust Enrichment (Fifth Count)

California recognizes unjust enrichment as a standalone claim for restitution. Astiana v. Hain Celestrial Grp., Inc., 783 F.3d 753, 762 (9th Cir. 2015). Plaintiffs have alleged that Intuit has been conferred benefits through an unfair business practice. Accordingly, Intuit's motion to dismiss the unjust enrichment claim is denied.

V. CONCLUSION

For the reasons set forth above, Intuit's motion to dismiss Plaintiffs' claims is GRANTED in part and DENIED in part. Intuit's motion to dismiss Brown's negligence is granted with leave to amend. Intuit's motion to dismiss Diaz's negligence claim is denied. Intuit's motion to dismiss Plaintiffs' claim for negligent enablement of third party imposter fraud is granted; their claim is dismissed with prejudice. Intuit's motion to dismiss Plaintiffs' aiding and abetting claim is granted with leave to amend. Intuit's motion to dismiss Plaintiffs' unfair competition and unjust enrichment claims is denied.

Plaintiffs Brown and Diaz may file and serve an amended complaint consistent with this order no later than October 23, 2017.

IT IS SO ORDERED.

Dated: September 29, 2017

EDWARD J. DAVILA
United States District Judge