Exarhos v. JPMorgan Chase Bank, National Association

• Court: District Court, N.D. Illinois
• Decided: July 20, 2021
• Docket: 1:20-cv-07754
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION

BOBBY EXARHOS & TARA EXARHOS, ) ) Plaintiffs, ) ) No. 20 C 7754 v. ) ) Judge Sara L. Ellis JPMORGAN CHASE BANK, N.A., ) ) Defendant. )

OPINION AND ORDER Plaintiffs Bobby and Tara Exarhos, residents of Chicago, Illinois, filed suit against Defendant JPMorgan Chase Bank, N.A. (“Chase”) alleging violations of the Electronic Fund Transfer Act (“EFTA”), 15 U.S.C. § 1693 et seq., for failure to properly handle their complaints regarding unauthorized transfers on two of their Chase checking accounts. Chase now moves to dismiss the case for failure to state a claim pursuant to Federal Rule of Civil Procedure 12(b)(6). The Court denies Chase’s motion because: (1) the Court cannot conclude at this stage that the Exarhoses’ are liable for the unauthorized transfers on their joint checking account ending in 5372 (“First Chase Account”) and (2) the Exarhoses adequately alleged that they provided notice of the single unauthorized transfer on their account ending in 8718 (“Second Chase Account”). BACKGROUND1 The Exarhoses are Chase and Amazon account holders who were victims of the July 2019 Capital One and Amazon data breach. Over a period of nine months, from October 2, 2019 through July 22, 2020, fourteen debit transfers totaling more than $500 and named

1 The Court takes the facts in the background section from the Exarhoses’ complaint and the exhibits attached thereto and presumes them to be true for the purpose of resolving Chase’s motion to dismiss. See Phillips v. Prudential Ins. Co. of Am., 714 F.3d 1017, 1019–20 (7th Cir. 2013). “Amazon.com Servi Internet” or “Amazon Marketpla Internet” appeared on the First Chase Account. The Exarhoses did not authorize or benefit from any of the transfers. Doc. 1 at 2. Eight of the fourteen transfers occurred in June and July 2020. The Exarhoses did not recognize that these transfers did not relate to their own Amazon purchases until July 2020. On July 24,

2020, Bobby reported the transfers to Chase through the bank’s Dispute Transaction Form. That same day, the Exarhoses received a letter from Chase indicating that it would provide temporary credit for one of the disputed transfers, dated October 2, 2019 in the amount of $1.79.2 Around July 27, the Exarhoses closed the First Chase Account and opened the Second Chase Account. Just over one week later, on August 5, an unauthorized $1.36 charge named “Amazon Marketpla Internet” appeared on the Second Chase Account. Id. at 4. On August 14, the Exarhoses received a letter from Chase stating that it would not credit certain reported transfers because the Exarhoses are “responsible for any transactions that occur[red] more than 60 days after [Chase] sen[t] the first statement on which unauthorized transactions appear[ed]” on October 16, 2019. Doc. 1-1 at 2. In response, on August 24, the

Exarhoses, through counsel, sent Chase a letter disputing the transfers on the First Chase Account, with the exception of the October 2, 2019 charge, and noting that the Exarhoses believe they are victims of the July 2019 Capital One and Amazon data breach. The letter demanded that Chase provide a written explanation of its findings and all information on which it relied and attached an exhibit which listed all of the disputed transfers. The Exarhoses’ counsel also sent a second dispute letter to Chase that day reporting the unauthorized transfer on the Second Chase Account. The letter mistakenly indicated that the

2 Although not included in the complaint, the Court takes notice of this letter, which the Exarhoses attached to their response to Chase’s motion to dismiss, because it is consistent with the complaint. See Peterson v. Wexford Health Sources, Inc., 986 F.3d 746, 752 n.2 (7th Cir. 2021). transfer amount was $211.99, instead of the actual transfer amount of $1.36. However, an exhibit attached to the letter included and circled the correct amount.3 The letter also noted that the Exarhoses were victims of the July 2019 Capital One and Amazon data breach, referenced the connection between the disputed transfers on their two Chase accounts, and demanded that

Chase take necessary measures to protect their accounts. Chase did not respond to either letter and did not issue the Exarhoses any provisional credits. On October 5, the Exarhoses’ counsel sent a follow-up letter to Chase regarding the disputed transfers. Chase did not respond to this letter and did not issue any provisional credits. LEGAL STANDARD A motion to dismiss under Rule 12(b)(6) challenges the sufficiency of the complaint, not its merits. Fed. R. Civ. P. 12(b)(6); Gibson v. City of Chicago, 910 F.2d 1510, 1520 (7th Cir. 1990). In considering a Rule 12(b)(6) motion, the Court accepts as true all well-pleaded facts in the plaintiff’s complaint and draws all reasonable inferences from those facts in the plaintiff’s favor. Kubiak v. City of Chicago, 810 F.3d 476, 480–81 (7th Cir. 2016). To survive a Rule

12(b)(6) motion, the complaint must assert a facially plausible claim and provide fair notice to the defendant of the claim’s basis. Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009); Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007); Adams v. City of Indianapolis, 742 F.3d 720, 728–29 (7th Cir. 2014). A claim is facially plausible “when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 678.

3 The complaint contained the same error. However, because the exhibit attached to the complaint contradicts the complaint, the exhibit controls. Centers v. Centennial Mortg., Inc., 398 F.3d 930, 933 (7th Cir. 2005). ANALYSIS I. First Chase Account Transfers The EFTA provides “a basic framework establishing the rights, liabilities, and responsibilities of participants in electronic fund and remittance transfer systems.” 15 U.S.C.

§ 1693(b). The “primary objective” of the EFTA “is the provision of individual consumer rights.” Id. Accordingly, the EFTA contains error resolution procedures and consumer protections for unauthorized electronic fund transfers. See 15 U.S.C. §§ 1693f, 1693g. Specifically, the EFTA requires a financial institution that receives sufficient timely notice from a consumer of an error to: “[1] investigate the alleged error, [2] determine whether an error has occurred, and [3] report or mail the results of such investigation and determination to the consumer within ten business days.” 15 U.S.C. § 1693f(a). The EFTA “obligates consumers to report transfer errors to financial institutions 60 days after having been transmitted the written documentation containing the error.” Camacho v. JPMorgan Chase Bank, No. 14-cv-04048, 2015 WL 5262022, at *2 (N.D. Cal. Sept. 9, 2015) (citing 15 U.S.C. § 1693f(a)). For the

purposes of the EFTA, an unauthorized transfer is an error. 15 U.S.C. § 1693f(f)(1). EFTA Regulation E (“Regulation E”) also requires consumers to “report an unauthorized electronic fund transfer that appears on a periodic statement within 60 days of the financial institution’s transmittal of the statement to avoid liability for subsequent transfers.” 12 C.F.R. § 205.6(b)(3). However, the EFTA places the burden of proof on the financial institution to show that the consumer is liable for unauthorized transfers, 15 U.S.C. § 1693g(b), and specifically limits a consumer’s liability for unauthorized transfers to the lesser of $50 or the amount of the transfers that occur “prior to the time the financial institution is notified of . . . an unauthorized electronic fund transfer,” id. § 1693g(a). The EFTA further states that “reimbursement need not be made to the consumer for losses the financial institution establishes would not have occurred but for the failure of the consumer to report [the unauthorized transfers] within sixty days of transmittal of the statement.” Id. § 1693g(a). Therefore, the EFTA clearly holds consumers liable for transfers that the financial institution establishes would not have occurred if the consumer had timely

notified it of the transfer but limits that liability regardless of whether the consumer timely reports the transfers. In other words, the EFTA may still provide recovery for consumers who fail to timely report unauthorized transfers. See, e.g., Perry v. OCNAC #1 Fed. C.U., 423 F. Supp. 3d 67, 78 (D.N.J. 2019) (noting that “[w]hile proof of [the consumer’s] untimely notice may limit [the financial institution’s] liability for transactions following the first unauthorized transaction, it does not necessarily complete the EFTA analysis”); Cifaldo v. BNY Melon Inv. Serv. Tr. Co., No. 17-cv-00842, 2017 WL 6513342, at *4 (D. Nev. Dec. 19, 2017) (approving an EFTA claim that a financial institution imposed more than a $50 liability on consumer for each disputed unauthorized transfer). Similarly, Regulation E states that if a consumer fails to provide timely notification of unauthorized transfers, “the consumer’s liability shall not exceed the

amount of the unauthorized transfers that occur after the close of the 60 days and before notice to the institution, and that the institution establishes would not have occurred had the consumer notified the institution within the 60-day period.” 12 C.F.R. § 205.6(b)(3). Chase argues that because the Exarhoses failed to timely notify it of the unauthorized transfers on the First Chase Account, the EFTA time-bars their claims and precludes them from recovery. See, e.g., Camacho, 2015 WL 5262022, at *4 (“Pursuant to § 1693f, [the consumer] had 60 days from the latter half of January, or until an equivalent date in March, 2013, to report the omitted transfer to Chase. It is undisputed that he failed to make that report. As such, § 1693g(a) precludes Chase’s liability for the loss of life insurance proceeds because such loss would not have occurred if [the consumer] had reported the omitted transfer within the statutory period.”). The Exarhoses do not dispute that they failed to timely report a number of the unauthorized transfers but argue that Chase bears the burden of establishing that the unauthorized transfers would not have occurred if the Exarhoses had timely notified Chase and

that whether Chase can meet that burden is a factual determination not appropriate at this stage. Rallis v. First Gulf Bank, N.A., No. 08cv102, 2008 WL 4724745, at *4 (N.D. Fla. Oct. 24, 2008) (“[The consumer] correctly points out that the financial institution bears the burden of proof in an EFTA action involving a consumer’s liability for unauthorized electronic transfers.”). In response, Chase primarily argues that it need not establish that it would have prevented the transfers because if a consumer fails to give timely notice, the EFTA and Regulation E place the risk of loss on the consumer. According to Chase, Regulation E provides two measurements for the consumer’s liability: “the consumer’s liability shall not exceed the amount [1] of the unauthorized transfers that occur after the close of the 60 days and before notice to the institution, and [2] that the institution establishes would not have occurred had the consumer

notified the institution within the 60-day period.” 12 C.F.R. § 205.6(b)(3). Chase argues that Regulation E measures the consumer’s loss in two ways: value of the time-barred claims and value of the preventable losses. Chase contends that because the Exarhoses’ claims are untimely, Chase does not need to show that the losses were preventable. The Court acknowledges that other courts have held that a consumer’s failure to timely report an error completely bars their EFTA claims. See, e.g., Overby v. Chase Manhattan Bank, 351 F. Supp. 2d 219, 225 (S.D.N.Y. 2005) (noting on summary judgment that “[the consumer] had a duty to notify Chase of any errors or unauthorized transactions within 60 days after receiving documentation of the electronic transfer. Because of [the consumer’s] failure to notify Chase within the required time period, he is now barred from asserting any of his banking claims.”); Schochet v. Bank of Am., N.A., No. 652058/2013, 2016 WL 75604, at *5 (N.Y. Sup. Ct. Jan. 7, 2016) (granting summary judgment for the bank and stating “when the customer would have become aware of the unauthorized transactions by reviewing his monthly statements,

failure to do so and the consequent failure to provide timely notice to the Bank bars a claim against the Bank”). However, given the statutory structure, the Court respectfully disagrees. Regulation E specifically sets forth the consequence of consumers failing to timely report unauthorized transfers: “If the consumer fails to do so, the consumer’s liability shall not exceed the amount of the unauthorized transfers that occur after the close of the 60 days and before notice to the institution, and that the institution establishes would not have occurred had the consumer notified the institution within the 60-day period.” 12 C.F.R. § 205.6(b)(3). It does not completely bar consumers’ EFTA claims; instead, in line with the EFTA’s primary objective of protecting consumers’ rights, it holds the consumer liable only to a certain extent. See Dorsey v. U.S. Bank Nat’l Ass’n, No. 11-cv-231, 2012 WL 13001917, at *3 (M.D. La. Apr. 2, 2012)

(“EFTA further protects consumers by limiting consumer liability for unauthorized transfers and also by providing consumers with an action for money damages and attorney’s fees against non- compliant financial institutions.”). The EFTA also explicitly places the burden on the financial institution to establish consumers’ liability for such transfers. 15 U.S.C. § 1693g(b); see New York v. Citibank, N.A., 537 F. Supp. 1192, 1194–95 (S.D.N.Y. 1982) (“And s 1693g sets out the circumstances in which a customer will be liable for an unauthorized transaction and places the burden of proving the customer’s liability on the financial institution in any action involving such liability.”). Here, Chase transmitted the first statement that contained an unauthorized transfer to the Exarhoses on October 16, 2019. The EFTA and Regulation E required the Exarhoses to report this unauthorized transfer by December 15, 2019, sixty days later. See 15 U.S.C. § 1693f(a); 12 C.F.R. § 205.6(b)(3). Because they failed to do so, they are liable for the subsequent

unauthorized transfers. See 12 C.F.R. § 205.6(b)(3). However, Regulation E limits the Exarhoses’ liability to the amount of the unauthorized transfers that occurred between December 15, 2019 and July 24, 2020, when the Exarhoses reported the transfers to Chase. Other than the first transfer, every unauthorized transfer on the First Chase Account occurred during that timeframe. Therefore, if Chase establishes that the remainder of the unauthorized transfers would not have occurred if the Exarhoses timely reported the October 2019 transfer, the Exarhoses would be liable for the transfers. See, e.g., Rusthoven v. TCF Nat’l Bank, No. 07- 3154, 2009 WL 2171105, at *3 (D. Minn. July 20, 2009) (granting bank’s motion for summary judgment “to limit [the consumer’s] recovery to losses incurred within sixty days of when [the bank] first transmitted an account statement listing one of the disputed transfers”); Binns v. BB &

T Bank, 377 F. Supp. 3d 487, 499 (E.D. Pa. 2019) (granting summary judgment for bank and finding that the bank would have taken preventative measures on the plaintiff’s account based on evidence that it had taken such measures after the plaintiff reported the unauthorized transfers). Chase argues that the fact that the unauthorized transfers on the First Chase Account stopped after the Exarhoses’ notification confirms that the subsequent transfers would not have occurred had the Exarhoses given timely notice of the October 2019 transfer. However, whether Chase would have prevented these transfers is a factual question not appropriate at this time. See In re Consol. Indus. Corp., 360 F.3d 712, 717 (7th Cir. 2004) (“[A] judge reviewing a motion to dismiss under Rule 12(b)(6) cannot engage in fact-finding.”). Therefore, for purposes of the pleading stage, the EFTA does not time-bar the Exarhoses’ claims regarding the First Chase Account. Accordingly, the Court denies Chase’s motion to dismiss the Exarhoses’ claims related to the First Chase Account. II. Second Chase Account Transfer

Chase next argues that the Exarhoses failed to provide proper notice of the single unauthorized transfer on the Second Chase Account because the provided notice did not adequately identify the transfer. The Exarhoses contend that despite listing the incorrect transfer amount, their notice and complaint still provided Chase with the “pertinent information” necessary to identify the unauthorized transfer and therefore fulfilled the notice requirements of the EFTA and Regulation E. The EFTA requires that a consumer who wishes to dispute an error provide oral or written notice that: “(1) sets forth or otherwise enables the financial institution to identify the name and account number of the consumer; (2) indicates the consumer’s belief that the documentation . . . contains an error and the amount of such error; and (3) sets forth the reasons for the consumer’s belief . . . that an error has occurred.” 15 U.S.C. § 1693f(a).

Regulation E contains a more relaxed standard for notice when determining a consumer’s liability for unauthorized transfers, providing that “[n]otice to a financial institution is given when a consumer takes steps reasonably necessary to provide the institution with the pertinent information.” 12 C.F.R. § 205.6(b)(5)(i). The Exarhoses’ second August 24 letter to Chase listed their names and account number, indicated their belief that the Second Chase Account statement contained an error, and explained their belief that they are victims of the July 2019 Capital One and Amazon data breach. The fact that a portion of the Exarhoses’ notice listed the incorrect transfer amount did not deny Chase the “pertinent information” necessary to identify the disputed transfer, 12 C.F.R. § 205.6(b)(5)(i), because the exhibits not only included the correct amount—the Exarhoses circled the correct amount in the exhibits, see Gale v. Hyde Park Bank, No. 02 C 3663, 2007 WL 541946, at *3 (N.D. Ill. Feb. 14, 2007) (“[T]he statute only requires notification that an error exists; it does not require identification of the error with any degree of specificity.”). Therefore, the Exarhoses have sufficiently pleaded that they notified Chase of the unauthorized transfer on the Second Chase Account, making dismissal of their claims inappropriate at this time. See, e.g., Lopez- Ortega v. Suntrust Bank, No. 12-cev-20182, 2012 WL 12896352, at *3 & n.3 (S.D. Fla. July 11, 2012) (finding consumer pleaded sufficient notice of unauthorized transfer where the complaint merely alleged he “called [the bank] and reported the unauthorized transactions”); Rallis, 2008 WL 4724745, at *4 (concluding that “the complaint’s allegations, taken together with the information contained in the attached exhibits, provide enough information to give [the bank] fair notice of the particular transactions that give rise to [the consumer’s] claims” and therefore meet the pleading requirements). CONCLUSION For the foregoing reasons, the Court denies Chase’s motion to dismiss [13].

Dated: July 20, 2021 BS MDI SARA L. ELLIS United States District Judge