5 UNITED STATES DISTRICT COURT 6 WESTERN DISTRICT OF WASHINGTON AT SEATTLE 7 EMAN BAYANI, individually and on behalf CASE NO. 2:23-cv-00271-JHC 8 of all others similarly situated, ORDER RE: DEFENDANT’S MOTION TO 9 Plaintiff, DISMISS 10 v. 11 T-MOBILE USA, INC.,
12 Defendant. 13 I 14 INTRODUCTION 15 This matter comes before the Court on Defendant T-Mobile USA, Inc.’s Motion to 16 Dismiss. Dkt. # 19. The Court has reviewed the materials filed in support of and in opposition 17 to the motion, pertinent portions of the record, and the applicable law. The Court finds that oral 18 argument is unnecessary. Being fully advised, the Court GRANTS in part and DENIES in part 19 the motion. 20 II 21 BACKGROUND 22 According to Plaintiff Eman Bayani, T-Mobile is a telecommunications carrier that 23 markets, sells, and maintains wireless cell phone service for the public. Dkt. # 1 at 3 ¶¶ 13–14, 24 11 ¶ 63. Bayani, who files this putative class action on behalf of himself and others similarly 1 situated, is a resident of Illinois and opened a cell phone account with T-Mobile in December 2 2021. Id. at 3 ¶¶ 9–10. 3 Bayani alleges that he and the proposed class “were victims of a SIM card swapping
4 scam perpetrated through their T-Mobile cellular accounts.” Id. at 1 ¶ 2. According to the 5 complaint, a “SIM swap1 scam” occurs as follows: (1) a scammer contacts a cell phone service 6 provider, like T-Mobile, and falsely claims that the victim’s phone has been lost or damaged; (2) 7 the scammer requests that the provider activate a new SIM card2 associated with the victim’s 8 telephone number but is within the scammer’s phone; (3) the provider activates the new SIM 9 card in the scammer’s telephone, allowing the scammer to receive the victim’s messages, calls, 10 and data; (4) once the scammer has access to the victim’s SIM card and phone number, they may 11 be able to access the victim’s private information such as login credentials, bank account details, 12 email, or social media accounts. Id. at 1–2 ¶¶ 3–4. 13 Bayani opened an account with T-Mobile on or around December 11, 2021. Id. at 4 ¶ 20. 14 Then, between December 19–28, 2021, scammers accessed his SIM card on various occasions 15 and stole “approximately $21,000 of cash reserves in [Bayani’s] Coinbase account3 to purchase 16 Bitcoin and transfer it out,” as well as about $2,700 from his banking account. Id. at 4–5 ¶¶ 21– 17 29. On January 10, 2023, after filing a police report and receiving a letter from T-Mobile 18
19 1 “A ‘SIM swap’ occurs when a phone number associated with one SIM becomes associated with a different SIM; no information contained on the previous SIM is transferred to the new SIM, other than 20 the phone number.” Terpin v. AT&T Mobility, LLC, 2023 WL 2839068, at *1 (C.D. Cal. Mar. 28, 2023). 2 “Cellular phones, tablets, and other mobile devices utilize an integrated microchip called a 21 subscriber identity module (‘SIM’); this SIM enables the device to authenticate to its wireless network[.] The wireless network uses SIM identification information to associate the specific device with a phone 22 number, in order to route communications and associate wireless services with a specific customer account.” Id. 3 Coinbase is a cryptocurrency wallet: an application that holds cash reserves or the private keys 23 necessary to access or transact cryptocurrency, such as Bitcoin. “Wallets do not physically hold cryptocurrency, but rather hold only the private keys required to transact with a given wallet address. . . . 24 Wallets can be accessed remotely only when the user inputs the appropriate access credentials.” Id. 1 confirming the unauthorized activity, Bayani opted out of T-Mobile’s arbitration agreement. Id. 2 at 5 ¶¶ 31–32; see also Dkt. ## 1-1 at 1, 1-2 at 2. 3 Bayani filed this putative class action on February 27, 2023, claiming that T-Mobile
4 “failed to protect [his] and other customers’ personal and financial data information” after 5 scammers used T-Mobile’s services “to access [his] personal information, including [his] email, 6 banking, and investment accounts.” Dkt. # 1 at 1 ¶¶ 1–2. Bayani brings six causes of action, 7 alleging that T-Mobile committed: (1) violations of the Federal Communications Act (“FCA”), 8 see 47 U.S.C. §§ 201–22; (2) negligence; (3) negligent hiring, retention, and supervision; (4) 9 violation of the Stored Communications Act (“SCA”), see 18 U.S.C. §2701 et seq.; (5) violation 10 of the Computer Fraud and Abuse Act (“CFAA”), see 18 U.S.C. § 1030; and (6) violations of the 11 Washington Consumer Protection Act (“CPA”), see Revised Code of Washington (“RCW”) 12 19.6. Dkt. # 1 at 10–18 ¶¶ 61–122.
13 T-Mobile moves to dismiss this case on various grounds, saying that (1) all but one of 14 Bayani’s claims are time-barred; and (2) Bayani fails to state a claim under the FCA, a theory of 15 negligence, the SCA, the CFAA, or the CPA. Dkt. # 19 at 10–32. 16 III DISCUSSION 17 When considering a motion to dismiss under Federal Rule of Civil Procedure 12(b)(6), 18 the Court construes the complaint in the light most favorable to the nonmoving party. Livid 19 Holdings Ltd. v. Salomon Smith Barney, Inc., 416 F.3d 940, 946 (9th Cir. 2005). The Court must 20 accept all well-pleaded facts as true and draw all reasonable inferences in favor of the 21 plaintiff. Wyler Summit P’ship v. Turner Broad. Sys., Inc., 135 F.3d 658, 661 (9th Cir. 1998). 22 “To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as 23 24 1 true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 2 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). 3 A. The Court Will Not Consider T-Mobile’s Terms and Conditions at the Pleading Stage
4 T-Mobile moves to dismiss claims one through five as barred by a one-year time 5 limitation established in T-Mobile’s Terms and Conditions (“T&Cs”). Dkt. # 20-1 at 2–6; see 6 Dkt. # 19 at 14. T-Mobile asks the Court to consider the T&Cs at the pleadings stage and 7 incorporate them by reference into the complaint. Dkt. # 19 at 14. For the reasons outlined 8 below, the Court declines to do so. 9 1. The Court Declines to Incorporate the T&Cs by Reference 10 When considering a Rule 12(b)(6) motion, a district court may not typically “consider 11 material outside the pleadings when assessing the sufficiency of a complaint[.]” Khoja v. 12 Orexigen Therapeutics, Inc., 899 F.3d 988, 998 (9th Cir. 2018). When matters outside the
13 pleadings are not excluded, the Rule 12(b)(6) motion converts to a motion for summary 14 judgment under Rule 56. Id. Under the incorporation-by-reference doctrine, however, courts 15 may examine documents properly incorporated into the complaint by reference. Tellabs, Inc. v. 16 Makor Issues & Rts., Ltd., 551 U.S. 308, 322 (2007). “[C]ourts may take into account 17 ‘documents whose contents are alleged in a complaint and whose authenticity no party questions, 18 but which are not physically attached to the [plaintiff's] pleading.’” Davis v. HSBC Bank 19 Nevada, N.A., 691 F.3d 1152, 1160 (9th Cir. 2012). A document may be incorporated by 20 reference into a complaint if the plaintiff (1) “refers extensively to the document” or (2) the 21 document “forms the basis of the plaintiff's claim.” United States v. Ritchie, 342 F.3d 903, 908 22 (9th Cir. 2003).
23 24 1 T-Mobile contends that Bayani agreed to the T&Cs when he received a telephone number 2 from the company=. Therefore, according to T-Mobile, the complaint “necessarily relies” on the 3 T&Cs and forms the basis of Bayani’s claim. Dkt. # 19 at 14–15.4 4 Bayani responds that the T&Cs do not form the basis of his claims. Dkt. # 26 at 12–14. 5 Further, according to Bayani, because T-Mobile seeks to incorporate the T&Cs only as a defense 6 to Bayani’s claims, the Court must prohibit it from doing so. Id. at 14 (citing Khoja, 899 F.3d at 7 1002). 8 The T&Cs do not form the basis of Bayani’s complaint. For example, the T&Cs are 9 mentioned only five times in the complaint, explicitly and implicitly. Dkt. # 1 at 4 ¶ 19–20, 5 ¶ 10 32, 7 ¶ 41, 8 ¶ 53; see also Dkt. # 1-2 at 2 (confirmation that Bayani opted out of arbitration 11 agreement). Only twice does the complaint explicitly refer to the T&Cs, and in one of these 12 references, Bayani states that his claims do not “arise out of” the T&Cs. See Dkt. ## 1 at 4 ¶ 19,
13 1-2 at 2. Although Bayani does not dispute that a contract bound Bayani and T-Mobile when he 14 possessed a T-Mobile phone number, the complaint does not seek recourse based on T-Mobile’s 15 violations of this contract but is based on T-Mobile’s alleged violations of state and federal 16 statute. 17 At this stage, it is not apparent to the Court that the T&Cs form the basis of Bayani’s 18 claims; the Court also recognizes that the Ninth Circuit has cautioned against incorporating 19 documents that may merely serve as a defense to well-pled allegations to defeat otherwise 20 cognizable claims. Khoja, 899 F.3d at 1003 (“Submitting documents not mentioned in the 21 complaint to create a defense is nothing more than another way of disputing the factual 22
23 4 In its motion, T-Mobile concedes that complaint does not extensively reference the T&CS, but that the T&Cs form the basis of the Bayani’s claims because they govern the relationship between T- 24 Mobile (the wireless provider) and Bayani (the customer). Dkt. # 19 at 15–16. 1 allegations in the complaint[.] . . . Although the incorporation-by-reference doctrine is designed 2 to prevent artful pleading by plaintiffs, the doctrine is not a tool for defendants to short-circuit 3 the resolution of a well-pleaded claim.”). Because the T&Cs do not form the basis of Bayani’s
4 complaint, the Court concludes that they are inappropriate for incorporation.5 5 2. Bayani’s Claims Are Not Time-Barred 6 T-Mobile contends that Bayani’s claims are time-barred because the T&Cs require the 7 parties to bring claims against one another “within one year of the date the claim arises.” Dkt. # 8 20-1 at 2–6; see Dkt. # 19 at 15. Because Bayani filed this action more than a year after the SIM 9 swap, T-Mobile seeks dismissal of these claims. Although the Court has declined to consider the 10 T&Cs by incorporation, see supra part III.A.2, even if it were to consider the substance of the 11 T&Cs, T-Mobile’s request fails because it requires the Court to perform fact-based inquiries at 12 the pleading stage. See Dkt. # 19 at 15–16. 13 Both federal and state claim limitations periods may be shortened by contract. Parties 14 may shorten a limitations period provided under federal statute so long as that statute does not 15 prohibit such a shortening. See MFS Int’l, Inc. v. Int’l Telcom Ltd., 50 F. Supp. 2d 517, 522 16 (E.D. Va. 1999) (citing Order of United Com. Travelers of Am. v. Wolfe, 331 U.S. 586 (1947))). 17 Under Washington law, parties can also shorten statutory limitations periods: “[a] stipulated 18 limitation period prevails over the general statute of limitations unless prohibited by statute or 19 public policy, or unless the provision is unreasonable.” EPIC v. CliftonLarsonAllen LLP, 199 20 Wash. App. 257, 271, 402 P.3d 320 (2017). Contractual limitation clauses between three months 21
22 5 Because the Court declines incorporation, it will not consider any other arguments premised on the contents of the T&Cs. T-Mobile maintains that the T&Cs, on grounds other than the limitation 23 provision, preclude at least three of Plaintiff’s claims, including: (1) negligence (Dkt. # 19 at 22–23), (2) CFAA violation (Dkt. # 19 at 28), and (3) CPA claims (Dkt. # 19 at 30–31). The Court will not consider 24 the merits of any portion of these arguments at the pleading stage. 1 to a year are reasonable for state claims. Id. (collecting cases); see, e.g., Gallion v. Medco 2 Health Sols., Inc., No. 13-CV-0135-TOR, 2014 WL 1328764, at *5 (E.D. Wash. Apr. 2, 2014) 3 (enforcing contractual one-year time limitation for negligence claim).
4 T-Mobile maintains that Bayani’s decision to opt out of the arbitration clause 5 demonstrates his assent to the T&Cs. Dkt. # 27 at 7. And T-Mobile says that Bayani “cannot 6 cherry-pick terms from the T&Cs to support his claims.” Id. (citing Gray v. Amazon.com, Inc., 7 2023 WL 1068513 (W.D. Wash. Jan. 27, 2023)). 8 In opposition, Bayani contends that “in order for such a shortened period to be 9 enforceable, the parties must have actually assented to it.” Dkt. # 26 at 13–14. While Bayani 10 does not contest the existence of a contract with T-Mobile, he does not admit that he agreed to 11 the T&Cs when entering the contract and asserts that T-Mobile has failed to show that he “was 12 ever presented with or assented to the T&Cs.” Id. at 15 (citing Alvarez v. T-Mobile USA, Inc.,
13 2011 WL 6702424, at *2 (E.D. Cal. Dec. 21, 2011)). 14 “[T]he existence of mutual assent or a meeting of the minds is a question of fact.” Sea- 15 Van Invs. Assocs. v. Hamilton, 125 Wash. 2d 120, 126, 881 P.2d 1035 (1994). “The burden of 16 proving a contract, whether express or implied, is on the party asserting it,” and that party “must 17 prove each essential fact,” of the contract “including the existence of a mutual intention.” 18 Johnson v. Nasi, 50 Wash. 2d 87, 91, 309 P.2d 380 (1957). 19 In this case, although the existence of a wireless contract is not in dispute, whether 20 Bayani assented to the terms of the T&Cs—so as to establish mutual assent—is a factual inquiry 21 that should not be considered at the motion to dismiss stage. See e.g., Alvarez, 2011 WL 22 6702424, at *9.6 And a time-bar argument is an affirmative defense to a plaintiff's claim for 23
6 T-Mobile’s assertion that, under Gray v. Amazon.com, Inc., Bayani cannot “avoid incorporation 24 by alleging he didn’t read or assent to part of the T&Cs[,]” is misplaced. Dkt. # 27 at 7. In Gray, 1 relief, which Bayani need not anticipate and negate in his pleading. See Fed. R. Civ. Proc. 2 8(c)(1) (listing “statute of limitations” as an affirmative defense); see also Perry v. Merit Sys. 3 Prot. Bd., 582 U.S. 420, 435 (2017). So although Bayani did not allege his mutual assent to the
4 T&Cs—or the lack thereof—such details are not required at the pleading stage.7 The Court thus 5 denies T-Mobile motion to dismiss claims 1–5 on time-bar grounds. 6 B. Bayani Alleges a Plausible FCA Claim 7 Under the FCA, T-Mobile is a telecommunications carrier engaged in interstate 8 communication that furnishes communication services to the public. See 47 U.S.C. § 201(a). T- 9 Mobile therefore has a duty to protect the confidentiality of the proprietary information of its 10 customers, such as Bayani. 47 U.S.C. § 222(a). Under the FCA, T-Mobile must maintain the 11 confidentiality of its customers’ “Customer Proprietary Network Information” (“CPNI”). 47 12 U.S.C. § 222(c). CPNI is defined as: 13 (A) information that relates to the quantity, technical configuration, type, destination, location, and amount of use of a telecommunications service 14 subscribed to by any customer of a telecommunications carrier, and that is made available to the carrier by the customer solely by virtue of the carrier-customer 15 relationship; and (B) information contained in the bills pertaining to telephone exchange service or 16 telephone toll service received by a customer of a carrier; except that such term does not include subscriber list information. 17 18
19 plaintiffs contended that the district court may not consider arguments premised on the terms of a Privacy Notice because they were not on notice of these terms and therefore these policies were not binding on 20 them. Gray, 2023 WL 1068513, at *5. The court in Gray rejected this argument because plaintiffs’ complaint was based on Amazon’s alleged breach of these terms and were extensively referenced 21 throughout. Id. The complaint here neither extensively references the T&Cs nor bases its claims on them. 22 7 Bayani also contends that the Court may not consider the T&Cs’ time-limitation because the T&Cs are a contract of adhesion, and their terms are unenforceable because they are substantively unconscionable. Dkt. # 26 at 16. Because the Court declines to incorporate the T&Cs and whether 23 Bayani assented to the T&Cs is a fact-based inquiry, the Court declines to consider whether the T&Cs are substantively unconscionable at this point. 24 1 47 U.S.C. § 222(h)(1) (emphasis added); see also 47 C.F.R. § 64.5103. 2 Under 47 C.F.R. § 64.201, “telecommunications carriers must take reasonable measures 3 to discover and protect against attempts to gain unauthorized access to CPNI. Carriers must
4 properly authenticate a customer prior to disclosing CPNI based on customer‐initiated contact, 5 online account access, or an in‐store visit.” With few exceptions, a telecommunications provider 6 is prohibited from using, disclosing, or permitting access to a customer’s CPNI. See 47 C.F.R. § 7 64.2005. Based on this statutory duty, T-Mobile, “must take reasonable measures to discover 8 and protect against attempts to gain unauthorized access to CPNI.” 47 C.F.R. § 64.2010(a). 9 Bayani asserts that T-Mobile violated its duties under § 222 of the FCA when it failed to 10 protect his confidential personal information (“CPI”) and CPNI “by using, disclosing, or 11 permitting access to their CPI and CPNI without the consent, notice, and/or legal authorization as 12 required by the FCA.” Dkt. # 1 at 12 ¶ 70.
13 In the motion to dismiss, T-Mobile contends that this FCA claim fails for three reasons. 14 First, T-Mobile says that “Bayani pleads no facts connecting any possible access to his CPNI to 15 any of his alleged injuries.” Dkt. # 19 at 17. T-Mobile maintains that CPNI is a narrowly 16 defined term, defined as “the logistical data collected by phone companies about a consumer’s 17 calls” but “does not relate to the content or substance of communications, whether calls or text 18 messages.” Id. (emphasis in original). According to T-Mobile, “even if a criminal used Mr. 19 Bayani’s phone line as part of a scheme to access other accounts, unauthorized use of a phone 20 line does not plausibly involve disclosure of CPNI. Id. at 18 (citing Terpin v. AT&T Mobility, 21 LLC, 2023 WL 2839068, at *7 (C.D. Cal. Mar. 28, 2023)). 22 Second, T-Mobile also contends that “the FCA does not protect CPI” because (1) CPI is
23 not defined by statute and appears only once in the FCA’s prefatory provision; (2) in 2016 24 Congress expressly rejected a proposed rule to expand protections of CPI under the FCA; and (3) 1 Bayani alleges no causal link connecting the disclosure of Bayani’s CPI to the injuries he claims 2 he suffered. See 47 U.S.C. § 222(a) (“Ever telecommunications carrier has a duty to protect the 3 confidentiality of proprietary information of, and relating to, other telecommunications carriers,
4 equipment manufacturers, and customers”); Dkt. # 19 at 18–19. 5 Third, T-Mobile asserts that Bayani may not bring an FCA claim for any alleged 6 “unreasonable” acts perpetrated by T-Mobile. 47 U.S.C. § 201(b) (“All charges, practices, 7 classifications, and regulations for and in connection with such communication service, shall be 8 just and reasonable, and any such charge, practice, classification, or regulation that is unjust or 9 unreasonable is declared to be unlawful[.]”). T-Mobile contends that claims brought under this 10 section of the FCA are within the primary jurisdiction of the Federal Communications 11 Commission (“FCC”) and, absent an FCC determination, a private plaintiff may not bring such a 12 claim. Dkt. # 19 at 19–20 (citing In re Long Distance Telecomms. Litig., 831 F.2d 627, 631 (6th
13 Cir. 1987); Havens v. Mobex Network Servs., LLC, 820 F.3d 80, 89 (3d Cir. 2016); N. Cnty. 14 Commc’ns Corp. v. Cal. Catalog & Tech., 594 F.3d 1149, 1158 (9th Cir. 2010) (“[I]t is within 15 the Commission's purview to determine whether a particular practice constitutes a violation for 16 which there is a private right to compensation[.]”)). 17 In response to T-Mobile’s three assertions, first Bayani highlights that, on various 18 occasions, T-Mobile informed Bayani that “an unknown party would have had access” to his 19 CPNI during the December 2021 SIM swaps. Dkt. # 1-1 at 2–4; see Dkt. # 19 at 19–20. Bayani 20 contends that at the pleading stage, he “cannot be expected to know, prior to discovery, the exact 21 nature and extent of who accessed what information and how that information may have been 22 used to harm him.” Dkt. # 26 at 19.
23 24 1 Second, Bayani concedes that the “focus of the FCA is on CPNI” and not on the broader 2 concept of CPI. Id. at 20 n.3. Still, Bayani rebuts the notion that CPI only appears once in the 3 FCA and says that CPI is mentioned “multiple times in the statute.” Id. at 20 n.3.
4 Third, Bayani maintains that “where the FCC has properly issued implementing 5 regulations based on § 201(b), a plaintiff can bring claims based on a violation of such 6 regulation.” Id. at 20 (citing Glob. Crossing Telecomms., Inc. v. Metrophones Telecomms., Inc., 7 550 U.S. 45, 54 (2007). 8 Bayani has plausibly alleged an FCA claim under the theory of T-Mobile’s alleged CPNI 9 disclosure, in violation of 47 U.S.C. § 222(c), and alleged “unreasonable” acts, in violation of 47 10 U.S.C. § 201(b). 11 As to T-Mobile’s first argument, the Court recognizes that, at the pleading stage, it would 12 be unreasonable for the Court to require Bayani “to know, prior to discovery, the exact nature
13 and extent of who accessed what information and how that information may have been used to 14 harm him.” See Dkt. # 26 at 19. The Court also notes that—in several letters to Bayani—T- 15 Mobile acknowledged that an unknown party may have had access to his CPNI during the 16 various times that the scammers accessed his SIM card. Although the definition of CPNI may be 17 narrow, as T-Mobile contends, it would still be premature to dismiss Bayani’s claims now. See 18 Terpin v. AT&T Mobility, LLC, 399 F. Supp. 3d 1035 (C.D. Cal. 2019) (ruling that customer 19 sufficiently alleged that cell service provider permitted unauthorized access to CPNI, and thus 20 stated a claim for unauthorized disclosure despite failing to identify any information that fell 21 within definition of CPNI); see also Terpin, 2023 WL 2839068, at *7 (dismissing customer’s 22 FCA claims at summary judgment because the “SIM swap did not disclose any [CPNI]
23 information” protected under § 222). 24 1 As to T-Mobile’s second claim, Bayani seems to have abandoned the theory that T- 2 Mobile violated the FCA when it disclosed his CPI information. See Dkt. # 1 at 11 ¶ 67; 47 3 U.S.C. § 222(a). In his response to the motion to dismiss, Bayani does not refute T-Mobile’s
4 assertion that “the FCA does not protect CPI, which in contrast to CPNI, is not defined in the 5 statute or its implementing regulations”; nor does Bayani contest T-Mobile’s contention that 6 Congress’s failure to expand the FCA’s protections of CPI “strongly favor[s] construing the FCA 7 to exclude the FCC’s proposed interpretation, which would have expanded the statute’s 8 protections beyond CPNI.” Dkt. # 19 at 18–19. Consequently, the Court will not entertain any 9 FCA claims based on T-Mobile’s failure to protect the confidentiality of Bayani’s CPI. See Dkt. 10 # 1 at 11 ¶ 67. 11 T-Mobile’s third argument fails because § 201(b) provides a right of action to private 12 litigants. In Global Crossing, the Supreme Court held that it was an “unreasonable practice” for
13 a telecommunications carrier to refuse to comply with an FCC regulation. Glob. Crossing, 550 14 U.S. 45 at 55 (“In our view, the FCC’s § 201(b) “unreasonable practice” determination is a 15 reasonable one . . . The carrier’s refusal to [comply with an FCC regulation], despite the FCC's 16 regulation requiring it to do so, can reasonably be called a ‘practice’ ‘in connection with’ the 17 provision of that service that is ‘unreasonable.’”). 18 Global Crossing confirms that private litigants may bring an action for damages under § 19 207 when a carrier violates an FCC rule or regulation that lawfully implements 47 U.S.C. § 20 201(b). Id. at 54–55. Bayani contends that T-Mobile violated FCC regulation 47 C.F.R § 21 64.2010(a)–(d) when it failed to “properly authenticate a customer prior to disclosing CPNI 22 based on customer-initiated telephone contact” and has therefore has a private cause of action
23 under §201(b). Dkt. # 1 at 6 ¶¶ 33–46, 11–12 ¶¶ 69–72; see also Dkt. # 26 at 20. 24 1 For these reasons, the Court concludes that Bayani alleges plausible claims under the 2 FCA to survive the motion to dismiss. 3 C. Bayani Alleges Plausible Negligence Claims
4 T-Mobile seeks dismissal of Bayani’s negligence claims, contending that: (1) T-Mobile 5 owed no duty to Bayani and (2) the “independent duty doctrine” bars Bayani’s claims.8 Dkt. # 6 19 at 20–23. 7 First, T-Mobile alleges that it owed no duty to protect Bayani from third-party scams 8 because (1) T-Mobile did not commit any affirmative act that harmed Bayani and (2) had no 9 special relationship with Bayani. Id. at 20–21 (citing Robb v. City of Seattle, 176 Wash. 2d 427, 10 429-30, 295 P.3d 212 (2013)). 11 In response, Bayani contends that T-Mobile committed an affirmative act when it 12 transferred Bayani’s SIM card “without instituting proper procedures to protect access to 13 [Bayani’s] information” and exposed his account information to a scammer. Dkt. # 26 at 21. 14 The Court agrees. Under Washington law, negligence requires “(1) the existence of a 15 duty to the plaintiff, (2) a breach of that duty, (3) a resulting injury, and (4) the breach as the 16 proximate cause of the injury.” Degel v. Majestic Mobile Manor, 129 Wash. 2d 43, 48, 914 P.2d 17 728 (1996). Typically, absent a special relationship, “an actor owes no duty to protect an injured 18 party from harm caused by the criminal acts of third parties.” Parrilla v. King County., 138 19 Wash. App. 427, 436, 157 P.3d 879 (2007). Even still, Washington law confirms that: 20 [A]n actor might still have a duty to take action for the aid or protection of the plaintiff in cases involving misfeasance (or affirmative acts), where the actor's prior 21 conduct, whether tortious or innocent, may have created a situation of peril to the 22
23 8 In the motion to dismiss, T-Mobile does not differentiate between Bayani’s second cause of action (negligence) and third cause of action (negligent hiring, retention, and supervision). The Court 24 therefore addresses these two negligence claims together. 1 other. Liability for nonfeasance (or omissions), on the other hand, is largely confined to situations where a special relationship exists. 2 Veridian Credit Union v. Eddie Bauer, LLC, 295 F. Supp. 3d 1140, 1157 (W.D. Wash. 2017) 3 (emphasis added) (citing Robb v. City of Seattle, 176 Wash. 2d 427, 436, 295 P.3d 212 (2013). 4 Under this theory, the defendant must have engaged in some “misfeasance” that “necessarily 5 entails the creation of a new risk of harm to the plaintiff.” Robb, 176 Wash. 2d at 437. 6 The Court therefore concludes that Bayani sufficiently alleges that T-Mobile had a duty 7 under the theory of negligence because: 8 [T]he criminal conduct involved in a SIM swap is not “independent,” but is facilitated by the wireless carrier. Unlike a direct hack of data where the company 9 may play a more passive role, SIM swaps are ultimately actualized by the wireless carrier. It is the company that effectuates the SIM card change. 10 Williams v. AT&T Mobility, LLC, 2020 WL 1492803, at *4 (E.D.N.C. Mar. 25, 2020).9 11 Next, T-Mobile contends that the “independent duty doctrine” bars Bayani’s negligence 12 claims because “they arise from circumstances inextricably linked to contractual duties in the 13 T&Cs rather than through an independently arising tort duty.” Dkt. # 19 at 22. Bayani refutes 14 this, asserting that this doctrine is applied to a “narrow class of cases, primarily limiting its 15 application to claims arising out construction on real property[.]” Dkt. # 26 at 22 (quoting Elcon 16 Constr., Inc. v. E. Wash. Univ., 174 Wash. 2d 157, 165, 273 P.3d 965 (2012)). Further, 17 according to Bayani, his claims do not arise out of the contract between the parties, with T‐ 18 Mobile’s duty of care stemming from federal and state statute. Id. at 23. 19 20 21
22 9 Although T-Mobile claims that Buckley v. Santander Consumer USA, Inc., 2018 WL 1532671 (W.D. Wash. Mar. 29, 2018) and Veridian Credit Union v. Eddie Bauer, LLC, 295 F. Supp. 3d 1140, 1157 (W.D. Wash. 2017) are instructive, the Court disagrees. In both cases plaintiffs alleged that 23 defendants failed to implement adequate security measures (committing nonfeasance or omissions), which differs from Bayani’s claims that T-Mobile engaged in affirmative acts (misfeasance) that created 24 his risk of harm. See Buckley, 2018 WL 1532671, at *4; Veridian, 295 F. Supp. 3d at 1157–58. 1 For reasons discussed above, see supra part III.A, the Court declines to consider T- 2 Mobile’s argument. Because T-Mobile’s “independent duty doctrine” claim hinges on Bayani’s 3 assent to the T&Cs, it would be inappropriate to consider it at the pleading stage. Bayani thus
4 alleges plausible negligence claims. 5 D. Bayani Fails to Allege a Plausible SCA Claim 6 Bayani alleges that T-Mobile violated the SCA when it “knowingly divulge[d] . . . the 7 contents of a communication while in electronic storage by that service[.]” Dkt. # 1 at ¶ 92 8 (citing 18 U.S.C. §2702(a)(1); 18 U.S.C. §2701). In its motion to dismiss, T-Mobile asserts that 9 the complaint does not allege facts sufficient to show that T-Mobile (1) “knowingly” divulged 10 the “contents” of a communication, or (2) that T-Mobile’s actions otherwise fit the law 11 governing “electronic storage” of the data, see 18 U.S.C. § 2702(a)(1), and “remote computing 12 service” (“RCS”) providers, see 18 U.S.C. § 2702(a)(1). Dkt. # 19 at 23. In response, Bayani
13 contends that (1) by “effectuating the SIM swap, T‐Mobile knew that it was providing access to 14 the content of [Bayani’s] text messages to a new SIM card” and (2) that Bayani satisfies the 15 remaining contested elements to allege a plausible SCA claim. Dkt. # 26 at 23–24 (emphasis in 16 original). 17 1. The SCA’s Definitions of “Knowingly” and “Contents” 18 First, T-Mobile maintains that because the complaint alleges only that T-Mobile “failed 19 to protect [Bayani’s] information due to negligent conduct,” it does not sufficiently aver that the 20 company “knowingly” disclosed the contents of Bayani’s communication as required by the 21 SCA. Dkt. # 19 at 23–24; see 18 U.S.C. § 2702(a)(1) (“[An] entity providing an electronic 22 communication service to the public shall not knowingly divulge to any person or entity the
23 contents of a communication while in electronic storage by that service[.]”) (emphasis added); 18 24 U.S.C. § 2702(a)(2) (An “entity providing remote computing service to the public shall not 1 knowingly divulge to any person or entity the contents of any communication which is carried or 2 maintained on that service[.]”) (emphasis added). 3 The Court disagrees. To be sure, SCA legislative history clarifies that “a knowing state
4 of mind is (1) an awareness of the nature of the conduct, (2) an awareness of or a firm belief in 5 the existence of the circumstance, and (3) an awareness of or a firm belief in the substantial 6 certainty of the result.” See Long v. Insight Commc’ns of Cent. Ohio, LLC, 804 F.3d 791, 797 7 (6th Cir. 2015) (quoting H.R. REP. NO. 99-647, at 49 (1986)). And the SCA’s knowledge 8 requirement was “intended to make clear that ‘reckless’ or ‘negligent’ conduct is not sufficient to 9 constitute a violation of this section.’” Id. (citing S. REP. NO. 99-541, at 36–37 (1986)). 10 But the conduct in question is the unauthorized SIM card disclosure that occurred during 11 the SIM card swaps. As previously outlined, see supra part III.C, the complaint alleges that T- 12 Mobile committed an affirmative act when it transferred Bayani’s SIM card to a scammer’s
13 phone. See e.g., Dkt. # 1 ¶ 2, 15 ¶ 96. Although T-Mobile disputes any liability arising from its 14 participation in this alleged scam, it does not dispute that it was aware of the nature of its actions 15 when it carried out the SIM transfers. See Dkt. 1-1 (various letters recognizing that T-Mobile 16 had transferred Bayani’s SIM card). For these reasons, the complaint satisfies the SCA’s 17 requirement that T-Mobile acted “knowingly.” 18 Second, T-Mobile contends that Bayani fails to allege that T-Mobile divulged the 19 “contents” of his communication. See 18 U.S.C. §§ 2702(a)(1), 2702(a)(1). T-Mobile asserts 20 that “[n]owhere does the [c]omplaint allege what ‘communication’ was divulged, and this alone 21 justifies the dismissal of his claim.” Dkt. # 19 at 24. 22 The SCA prohibits disclosures of the “contents of a communication[,]” which is defined
23 as “any information concerning the substance, purport, or meaning of that communication.’” In 24 re Zynga Priv. Litig., 750 F.3d 1098, 1104 (9th Cir. 2014) (citing 18 U.S.C. § 2510(8)); see 18 1 U.S.C. §2702(a)(1)). In other words, “Congress intended the word ‘contents’ to mean a person's 2 intended message to another (i.e., the ‘essential part’ of the communication, the ‘meaning 3 conveyed,’ and the ‘thing one intends to convey’).” Zynga, 750 F.3d at 1106.
4 After consideration of the allegations set forth in the complaint, the Court concludes that 5 Bayani has alleged that T-Mobile disclosed the contents of his communications, in violation of 6 the SCA. For example, the complaint alleges that Bayani lost access to his T-Mobile account 7 three times in December 2021 because of unauthorized SIM swaps. Dkt. #1 at 4–5 ¶¶ 21, 23, 25. 8 During that time, Bayani alleges that scammers accessed his Coinbase account and bank account 9 because they had access Bayani’s SIM card and text messages. Id. at 5 ¶¶ 29–30. These 10 allegations were later confirmed by T-Mobile. Dkt. # 1-1; Dkt. # 1 at 5 ¶ 31. Because the very 11 nature of the SIM swap scam involves the interception of text and phone calls by an 12 unauthorized party, at the motion to dismiss stage, Bayani has alleged that T-Mobile plausibly
13 divulged the contents of his communications to an unauthorized third party. 14 2. The SCA’s Definitions of “Electronic Storage” and “Remoting Computing Service” 15 T-Mobile also contends that Bayani’s SCA claim fails because his communications were 16 not divulged “while in electronic storage” nor does T-Mobile provide a “remote computing 17 service to the public[.]” Dkt. # 19 at 24–25. 18 Under the SCA: 19 (1) a person or entity providing an electronic communication service to the public 20 shall not knowingly divulge to any person or entity the contents of a communication while in electronic storage by that service; and 21 (2) a person or entity providing remote computing service to the public shall not 22 knowingly divulge to any person or entity the contents of any communication which is carried or maintained on that service[.] 23 18 U.S.C. § 2702(a)(1)–(2) (emphasis added). 24 1 a. “Electronic Storage” under 18 U.S.C. § 2702(a)(1) 2 “Electronic storage” means (1) “any temporary, intermediate storage of a wire 3 or electronic communication incidental to the electronic transmission thereof;” and (2) “any
4 storage of such communication by an electronic communication service for purposes of backup 5 protection of such communication[.]” 18 U.S.C. § 2510(17). Bayani responds that the SIM 6 swap scam itself satisfies the SCA’s “electronic storage” element because—rather than being a 7 typical hands-on phone theft—T-Mobile provided the scammers “with a duplicate SIM card,” 8 which allowed the scammer’s access to Bayani’s “email accounts, banking accounts, and 9 Coinbase account.” Dkt. # 26 at 24. 10 The Court disagrees. Without more information about how SIM cards store data, the 11 Court struggles to follow the logic of this argument. Although the Court recognizes that the 12 contents of Bayani’s communications were compromised through the SIM swap, see supra part
13 III.D.1, the complaint does not allege how the interception of these messages constitutes 14 “temporary, intermediate storage of a wire or electronic communication incidental to the 15 electronic transmission” or storage of such communications “for purposes of backup protection.” 16 18 U.S.C. § 2510(17). Without more information on how the storage capabilities of a SIM card 17 align with the statutory definition of “electronic storage,” Bayani has failed to allege a plausible 18 claim under 18 U.S.C. § 2702(a)(1). 19 b. “Remote Computing Service” under 18 U.S.C. § 2702(a)(2) 20 “Remote computer service” is “the provision to the public of computer storage or 21 processing services by means of an electronic communications system.”10 18 U.S.C. § 2711(2). 22 “A ‘remote computing service’ refers to ‘the processing or storage of data by an offsite third 23
10 “‘[E]lectronic communication service’ means any service which provides to users thereof the 24 ability to send or receive wire or electronic communications[.]” 18 U.S.C. § 2510(15). 1 party.’ In defining RCS, ‘Congress appeared to view ‘storage’ as a virtual filing cabinet.’” 2 Quon v. Arch Wireless Operating Co., 529 F.3d 892, 901 (9th Cir. 2008), rev’d and remanded on 3 other grounds sub nom. City of Ontario, Cal. v. Quon, 560 U.S. 746 (2010)) (citations omitted).
4 T-Mobile says that Bayani’s SCA claim fails under 18 U.S.C. 2702(a)(2) because he does 5 not allege that T-Mobile provides remote computing services to customers. Dkt. # 19 at 26. T- 6 Mobile says that a “company that provides only wireless text-messaging services” is solely a 7 provider of electronic communication services and cannot provide remote computing services. 8 Id. In response, Bayani asserts that T-Mobile may act as a provider of both services. Dkt. # 26 9 at 25. 10 Electronic communication services and remote computing services are often provided by 11 the same entities. Theofel v. Farey-Jones, 359 F.3d 1066, 1070 (9th Cir. 2004). Whether an 12 entity acts as a remote computing service or an electronic communications service “is context
13 dependent, and depends, in part, on the information disclosed.” Low v. LinkedIn Corp., 900 F. 14 Supp. 2d 1010, 1023 (N.D. Cal. 2012)). Because T-Mobile does not dispute that it provides 15 electronic communication services, see Dkt. # 19 at 26, the Court must determine whether, 16 according to the complaint, T-Mobile also provides remote computing services, which would 17 entail T-Mobile’s provision of computer storage and processing services through an electronic 18 communications system. See 18 U.S.C. § 2711(2). 19 In the complaint, Bayani explains that T-Mobile is a wireless cell phone service, which 20 provides service plans across the country. See Dkt. # 1 at 3 ¶¶ 13–15. But Bayani does not 21 include information as to the services that T-Mobile provides that may fall within the statutory 22 definition of “remote computing.” It very well may be that all telecommunications providers
23 like T-Mobile inherently provide storage or processing services in the normal course of wireless 24 text and data service plans. Indeed, the Court recognizes that whether T-Mobile provided remote 1 computing services to Bayani is a context-specific inquiry, and this consideration may be better 2 suited after the pleading stage. Still, the complaint does not sufficiently explain how T-Mobile 3 even generally provides “computer storage or processing services by means of an electronic
4 communications service.” See 18 U.S.C. § 2711(2). 5 Because Bayani does not allege that (1) the contents divulged to the SIM swap scammers 6 were in electronic storage, see 18 U.S.C. § 2702(a)(1), nor that (2) T-Mobile provides remote 7 computing services, see 18 U.S.C. § 2702(a)(2), the Court dismisses the SCA claim. 11 Dkt. # 1 8 at 14–15 ¶¶ 92–98. 9 E. Bayani Alleges a Plausible Claim under the CFAA 10 In his complaint, Bayani alleges that T-Mobile’s violated two provisions of the CFAA. 11 See 18 U.S.C § 1030(a)(5)(A), (C). A defendant violates these two provisions if it: 12 (5)(A) knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without 13 authorization, to a protected computer; 14 (C) intentionally accesses a protected computer without authorization, and as a result of such conduct, causes damage and loss. 15 18 U.S.C § 1030(a)(5)(A), (C). 16 T-Mobile further contends that the complaint fails to “allege facts sufficient to show that 17 it violated either provision or that a violation caused a cognizable loss of at least $5,000.” Dkt. # 18 19 at 18. 19 20 21 22 11 The Court’s ruling is without prejudice. A “district court should grant leave to amend even if 23 no request to amend the pleading was made, unless it determines that the pleading could not possibly be cured by the allegation of other facts.” Lopez v. Smith, 203 F.3d 1122, 1127 (9th Cir. 2000) (en banc) 24 (quoting Doe v. United States, 58 F.3d 494, 497 (9th Cir. 1995)). 1 1. Bayani Satisfies the Definition of “Knowingly” 2 According to T-Mobile, Bayani fails to allege a violation under § 1030(a)(5)(A) because 3 he has not established that T-Mobile “knowingly” caused “the transmission of a program,
4 information, code, or command,” thereby “intentionally cause[ing] damage without 5 authorization, to a protected computer[.]” Dkt. # 19 at 27. T-Mobile contends that “at most” 6 Bayani alleges that T-Mobile “negligently caused damage, but negligence is not sufficient” to 7 violation this section. Id. (citing QVC, Inc. v. Resultly, LLC, 99 F. Supp. 3d 525, 533 (E.D. Pa. 8 2015)). 9 In opposition, Bayani points to a later decision in the same case, QVC, Inc. v. Resultly, in 10 which the court clarified that: 11 [I]t would be sufficient to allege that the defendant intended to engage in activity that he knew would impair the functionality of a protected computer, even if the 12 primary purpose of the defendant’s conduct was not to cause a lack of functionality and the defendant believed that the loss of functionality would be temporary. 13 QVC, Inc. v. Resultly, LLC, 159 F. Supp. 3d 576, 593 (E.D. Pa. 2016) (emphasis added). 14 Applying QVC, even if T-Mobile believed that the wrongful SIM transfer was not 15 induced by fraud, Bayani need only show that T-Mobile intended to participate in the SIM card 16 transfer itself, not that T-Mobile intended to disrupt Bayani’s SIM card access. 17 Reiterating the Court’s previous discussion, see supra part III.C, regarding T-Mobile’s 18 “affirmative act” of transferring SIM card access to the scammer, Bayani has plausibly alleged 19 that T-Mobile “knowingly” caused the SIM transfers at issue under the CFAA. 20 2. Bayani Satisfies the Definition of “Authorization” 21 T-Mobile also maintains that Bayani’s CFAA claim fails because he has not shown that 22 T-Mobile acted “without authorization.” See 18 U.S.C § 1030(a)(5)(A), (C); Dkt. # 19 at 28. T- 23 24 1 Mobile bases this position on the contention that, by agreeing to the T&Cs, Bayani granted T- 2 Mobile authorization to access and make changes to his SIM card. Dkt. # 19 at 28. 3 As discussed, see supra part III.A, the Court declines to consider arguments premised on
4 the incorporation and contents of the T&Cs. Whether T-Mobile exceeded its authorization when 5 it transferred Bayani’s SIM card depends on Bayani’s assent to the T&Cs and the Court will not 6 consider that issue at the pleading stage. 7 Further, even if the Court were to consider the T&Cs, Bayani alleges that T-Mobile failed 8 to employ proper authentication before transferring SIM access from his phone to the scammers 9 and thereby exceeded its authority. See Dkt. # 1 at 1 ¶¶ 2–3, 6 ¶ 40, 16 ¶ 103. Recognizing that 10 Bayani did not request a SIM transfer, but T-Mobile still effected the swap, Bayani has 11 adequately pleaded that T-Mobile acted without authorization. 18 U.S.C § 1030(a)(5)(A). 12 3. Bayani Alleges a Cognizable Loss Under the CFAA
13 T-Mobile contends that Bayani’s “allegations also do not satisfy the $5,000 ‘loss’ 14 threshold to bring a civil CFAA claim.” Dkt. # 19 at 19; see 18 U.S.C. § 1030(g). T-Mobile 15 states that the CFAA has a narrow concept of “loss” and because Bayani only alleges theft from 16 a cryptocurrency account, he has not met the damages threshold. Dkt. # 19 at 29 (citing Nowak 17 v. Xapo, Inc., 2020 WL 6822888, at *4 (N.D. Cal. Nov. 20, 2020) (“losing the value of his stolen 18 cryptocurrency is not a cognizable loss under the CFAA”)). 19 The Court disagrees. The CFAA provides a civil remedy for “[a]ny person who suffers 20 damage or loss by reason of a violation of this section.” 18 U.S.C. § 1030(g). A “loss” is “any 21 reasonable cost to any victim, including the cost of responding to an offense, conducting a 22 damage assessment, and restoring the data, program, system, or information to its condition prior
23 to the offense, and any revenue lost, cost incurred, or other consequential damages incurred 24 1 because of interruption of service[.]” 18 U.S.C.§ 1030(e)(11); see Nowak, 2020 WL 6822888, at 2 *4. 3 In the complaint, Bayani alleges that “scammers took approximately $21,000 of cash
4 reserves in [Bayani’s] Coinbase account to purchase Bitcoin and transfer it out[.]” Dkt. # 1 at 5 5 ¶ 29 (emphasis added). Although this cash was held in a cryptocurrency wallet, Bayani alleges 6 that the stolen funds were real money and not cryptocurrency.12 Id. Because the complaint 7 alleges a cognizable loss of at least $21,000 “cash reserves,” the Bayani has adequately pleaded a 8 cognizable loss under the CFAA. 9 For all these reasons, the Court concludes that Bayani alleged a plausible CFAA claim. 10 F. Bayani Alleges Plausible CPA Claims 11 Bayani contends that T-Mobile engaged in unfair or deceptive conduct that violates the 12 CPA. To adequately plead a CPA claim, a plaintiff must allege: (1) an unfair or deceptive act or 13 practice; (2) occurring in trade or commerce; (3) with a public interest impact; (4) injury to 14 business or property; and (5) causation. Hangman Ridge Training Stables, Inc. v. Safeco Title 15 Ins. Co., 105, Wash. 2d 778, 784–85, 719 P.2d 531 (1986). In the motion, T-Mobile says that 16 Bayani’s claim fails because he does not allege an unfair or deceptive act or practice.13 Dkt. # 19 17 at 30–32. 18 19 20
21 12 Bayani also alleges that $2,700 was transferred out of his Bank of America account, which was later used to purchase cryptocurrency. Dkt. # 1 at 5 ¶ 29. 22 13 T-Mobile also contends that Bayani did not allege a per se violation of the CPA. A per se violation of the CPA occurs when the Washington state legislature has “expressly declared that violation of a particular statute constitutes an unfair or deceptive practice.” Eye Care Ctr. of Snohomish v. Chemat 23 Tech., Inc., 2012 WL 12941686, at *2 (W.D. Wash. Dec. 14, 2012). Bayani states, however, that his complaint did not allege a per se violation of the CPA claim. Dkt. # 26 at 28. The Court will not address 24 this argument. 1 1. Bayani Alleges an “Unfair Act or Practice” Under the CPA 2 A “practice is unfair [if it] causes or is likely to cause substantial injury to consumers 3 which is not reasonably avoidable by consumers themselves and not outweighed by
4 countervailing benefits.” Klem v. Washington Mut. Bank, 176 Wash. 2d 771, 787, 295 P.3d 1179 5 (2013) (quoting 15 U.S.C. § 45(n). According to T-Mobile, courts “regularly dismiss CPA 6 claims where a business’s contractual terms and disclosures allow consumers to anticipate and 7 avoid potential injury, since they can decide not to buy the product or service.” Dkt. # 19 at 30– 8 31 (collecting cases). T-Mobile contends that Bayani had reason to anticipate any impending 9 harm and had the means to avoid it because, despite reading various provisions of the T&Cs 10 warning him of the risk of securing his online accounts with T-Mobile, he still began service 11 with T-Mobile. Id. at 31. Further, T-Mobile suggests that Bayani should have used an 12 alternative authentication method to secure his financial accounts, such as an authentication app
13 or security key. For these reasons, according to T-Mobile, Bayani’s injury “was reasonably 14 avoidable” and he does not allege any unfair conduct. Id. at 32. 15 Bayani responds by highlighting two ways T-Mobile engaged in unfair practice: (1) T- 16 Mobile’s conduct was illegal under the FCA, SCA, and CFAA, which statutes “express a public 17 policy requiring wireless carriers to safeguard consumers’ data and accounts in particular ways”; 18 and (2) T-Mobile permitted third parties to access and use Bayani’s customer account that should 19 have been accessible only to him. Dkt. # 26 at 27–28. According to Bayani, whether he had 20 reason to anticipate this SIM swap scam is a question of fact to be resolved later. 21 The Court agrees. Bayani alleges that he has suffered a substantial injury that shows a 22 plausible claim that T-Mobile committed an “unfair” practice or act under the CPA. First, the
23 Court has already determined that it will not incorporate the T&Cs when considering the motion 24 to dismiss, see supra part III.A, and will not consider whether Bayani could have reasonably 1 anticipated the misuse of his SIM card when he opened a phone plan with T-Mobile. The Court 2 currently lacks details as to exactly how the scammers accessed Bayani’s financial accounts and 3 declines to assign blame to Bayani at this juncture. It has not yet been established—and is a
4 factual issue—whether Bayani could have reasonably avoided risk or anticipate injury to prevent 5 the scammers’ access to his accounts. Bayani has alleged an unfair practice or act under the 6 CPA. 7 2. Bayani Alleges a “Deceptive Act or Practice” Under the CPA 8 T-Mobile contends that the complaint does not allege that it “did anything deceptive” 9 and, even so, “no such allegations are possible given the plain disclosures in the T&Cs. Dkt. # 10 19 at 32. T-Mobile also says that the Court should apply Rule 9(b)14 for claims of deception 11 under the CPA, and that Bayani cannot meet this standard, or the lesser pleading standard, 12 because he “does not describe any allegedly deceptive conduct” by T-Mobile. Id. 13 a. A Heightened Pleading Standard Does Not Apply
14 “‘While not all claims brought under the Washington CPA must be pled with the 15 specificity prescribed by Rule 9(b),’ CPA claims that allege and depend upon a ‘unified course 16 of fraudulent conduct’ as the basis of the claims ‘sound in fraud,’ and must be averred with 17 particularity.” Gray, 2023 WL 1068513, at *6 (quoting Nemykina v. Old Navy, LLC, 461 F. 18 Supp. 3d 1054, 1058 (W.D. Wash. 2020); Vess v. Ciba-Geigy Corp. USA, 317 F.3d 1097, 1103 19 (9th Cir. 2003)). As a result, “[f]ederal courts have concluded that Rule 9(b) applies to [CPA] 20 claims alleging that the defendant intentionally misled the public.” Gray, 2023 WL 1068513, at 21 *6 (quoting Cole v. Keystone RV Co., LLC, No. 18-cv-5182, 2018 WL 4051805, at *2 (W.D. 22 Wash. Aug. 24, 2018)) (internal quotation omitted). 23
14 “[A] party must state with particularity the circumstances constituting fraud or mistake.” Fed. R. 24 Civ. P. 9(b). 1 After review of the complaint, the Court concludes that Bayani does not allege that T- 2 Mobile engaged in a “unified course of fraudulent conduct” that might suggest the application of 3 a heightened pleading standard. Instead, the complaint alleges that T-Mobile’s conduct is
4 deceptive under the CPA “because it allowed third parties to access and use T‐Mobile customer 5 accounts that should have been accessible only to the customer and that customers reasonably 6 expected to be secure.” Dkt. # 1 at 17–18 ¶ 115. Because Bayani does not allege that T-Mobile 7 engaged in any consistent acts or practice of fraud to warrant a heightened standard under Rule 8 9(b), the Court declines to apply one. See Nemykina, 461 F. Supp. 3d at 1058 (“[N]ot all claims 9 brought under the Washington CPA must be pled with the specificity prescribed by Rule 10 9(b)[.]”). 11 b. Bayani Alleges a “Deceptive Act or Practice” Under the CPA
12 Deception exists when “the alleged act had the capacity to deceive a substantial portion 13 of the public” and that “representation, omission or practice [] is likely to mislead a reasonable 14 consumer.” Eng v. Specialized Loan Servicing, 20 Wash. App. 2d 435, 445–46, 500 P.3d 171 15 (2021) (internal quotations omitted) (emphasis in original). 16 Under this definition, Bayani alleges a plausible CPA claim. Bayani contends that T- 17 Mobile engaged in affirmative acts within a larger SIM swap scam and then “failed to disclose or 18 made deceptive statements designed to cover up for the fact that it is aware that its security 19 procedures can and do fall short of its expressed and implied representations and promises, as 20 well as its statutory duties.” Dkt. # 1 at ¶ 41. Indeed, Bayani needs only to allege that T- 21 Mobile’s alleged act had the capacity to deceive a substantial portion of the public, which the 22 complaint adequately pleads. The Court therefore concludes that Bayani has adequately pleaded
23 a CPA claim. 24 1 IV CONCLUSION
3 For these reasons, the Court GRANTS in part and DENIES in part the motion.
4 Accordingly, the Court DISMISSES (1) Bayani’s FCA claim based on T-Mobile’s failure to
; protect the confidentiality of Bayani’s CPI with prejudice, see 47 U.S.C. § 222(a), and (2)
‘ Bayani’s SCA claims (Dkt. # 1 at 14-15 4§ 91-98) without prejudice. Bayani is granted until
7 November 16, 2023, to seek leave to amend his complaint under Rule 15(a)(2). Dated this 20th day of October, 2023. ° Cok. 4, Chur 9 JohnH.Chun 10 United States District Judge
1] 12 13 14 15 16 17 18 19 20 21 22 23 24