IN THE UNITED STATES DISTRICT COURT FOR THE MIDDLE DISTRICT OF TENNESSEE NASHVILLE DIVISION
JAMEY LANAHAN and ) LORI LANAHAN, ) ) Plaintiffs, ) ) Case No. 3 :23-cv-00510 v. ) Judge Aleta A. Trauger ) REGIONS BANK, ) REGIONS FINANCIAL CORP., ) GARY A. ASHTON, INC., D/B/A THE ) ASHTON REAL ESTATE GROUP OF ) RE/MAX ADVANTAGE, and ) PAMELA KING, ) ) Defendants. )
MEMORANDUM Plaintiffs Jamey Lanahan and Lori Lanahan were the victims of wire fraud and, as a result, suffered substantial financial loss. While they have never been able to identify the perpetrator(s) of the fraud, they have filed suit against various other actors whose negligent or unauthorized acts and omissions, the plaintiffs claim, caused their loss. Now before the court are Motions to Dismiss the plaintiffs’ Amended Complaint (Doc. No. 42), filed by defendant Gary A. Ashton, Inc. d/b/a The Ashton Real Estate Group of Re/Max Advantage (“Re/MAX”) (Doc. No. 43) and defendant Pamela King (Doc. No. 48), seeking dismissal of the negligence claims asserted by the plaintiffs against those defendants. In addition, defendants Regions Bank and Regions Financial Corp. (hereinafter referred to collectively as “Regions”) have filed a Partial Motion to Dismiss (Doc. No. 45), seeking dismissal of only the state law negligence claim asserted against them. For the reasons set forth herein, Regions’ motion will be granted, leaving intact only the federal claim against it, but Re/MAX’s and King’s motions will be denied. I. FACTUAL AND PROCEDURAL BACKGROUND The plaintiffs filed suit in the Circuit Court for Davidson County, Tennessee on March 13, 2023. On May 19, 2023, with the consent of the other defendants, Regions removed the case to
this court, asserting that federal question jurisdiction existed because the original Complaint raised a substantial federal question. (Doc. No. 1.) Following removal, the defendants filed a first round of motions to dismiss, which eventually led to the filing of the plaintiffs’ Amended Complaint, now the operative pleading in this case. As alleged in the Amended Complaint, the plaintiffs are a married couple residing in Wilson County, Tennessee. (Doc. No. 42 ¶ 1.) In early 2022, they contacted defendant Re/MAX, requesting assistance with the sale of their home in Donelson, Tennessee and the purchase of a new home (“New Home”) in Hermitage, Tennessee. Re/MAX assigned defendant Pamela King, a realtor, to work with the plaintiffs. It also directed the plaintiffs to use Tennessee Title Services, LLC (“Tennessee Title”) to handle the closing process. (Id. ¶¶ 16–18.)
According to the plaintiffs, during their dealings with King and Tennessee Title for purposes of closing on the sale of their Donelson house and the purchase of the New Home, the email addresses for various real estate professionals were hacked or otherwise intercepted by an unknown fraudster. The fraudster monitored emails between Plaintiffs, Ashton, Pamela King, and Tennessee Title. The fraudster impersonated various real estate professionals by creating email addresses and digital signatures that were nearly identical to the real estate professionals’ legitimate email addresses and signatures. The fraudster strategically participated in various email conversations to cause confusion, misdirection, and otherwise manipulate the course of Plaintiffs’ transaction to the fraudster’s advantage. (Id. ¶ 19.) To close on the purchase of the New Home, the plaintiffs both transferred funds from their retirement or savings accounts to an account individually held by Jamey Lanahan at Regions Bank. (Id. ¶ 13.) On March 14, 2022, Mr. Lanahan met with Marithza Ellison at Regions’ Jackson Downs branch to arrange the transfer of the plaintiffs’ funds to the seller’s bank account at JP Morgan
Chase Bank (“Chase Bank”). (Id. ¶¶ 15, 21.) Mr. Lanahan completely filled out Regions’ standard Domestic Wire Transfer Request form and gave it directly to Ms. Ellison. ( Id. ¶ 22.) Ms. Ellison did not initiate the wire transfer, however. Instead, she observed that Mr. Lanahan had two sets of wire instructions in his possession, and she advised him to contact Tennessee Title to verify the correct wire instructions. (Id. ¶¶ 23, 25.) She also notified him that wire transfers are common targets of fraud. (Id. ¶ 24.) Both Ms. Ellison and Mr. Lanahan attempted to contact Emily Kornbau, the individual at Tennessee Title who was handling the transaction, by telephone and email, but were unable to reach her. (Id. ¶¶ 27, 28.) When they were unable to reach Kornbau, Mr. Lanahan confirmed with Ellison that the wire transfer request had not been processed, and he verbally instructed her to hold the request
until he confirmed the correct wiring instructions with Tennessee Title. Ms. Ellison agreed that the request had not been processed and would not be processed until Mr. Lanahan provided further instructions. (Id. ¶¶ 29–30.) They specifically agreed that Mr. Lanahan would obtain confirmation of the correct wire instructions from Kornbau or some other trustworthy person at Tennessee Title and that Regions would not take further action on any wire transfer until after hearing directly from him. (Id. ¶¶ 32, 34–35.) Mr. Lanahan also told Ellison that he intended to drive to Tennessee Title’s offices to obtain the wire instructions in person. (Id. ¶ 33.) Ellison acknowledged that she understood, and she reconfirmed that she would take no further action until Mr. Lanahan returned with correct wire instructions. (Id. ¶ 35.) While Mr. Lanahan was on his way to Tennessee Title to obtain the correct instructions, however, Ms. Ellison received a call from someone who claimed to be calling from Tennessee Title, and whom she later described as “male with . . . a heavy foreign accent.” (Id. ¶¶ 36, 37.) Ms. Ellison did not ask the caller his name, did not attempt to verify his identity, and did not ask Mr.
Lanahan or anyone else to confirm the caller’s legitimacy. (Id. ¶¶ 38–40.) Instead, based solely on verbal instructions from this unidentified caller, Ms. Ellison wired the purchase funds for the plaintiffs’ New Home—the entire $447,203.55— from Mr. Lanahan’s account to the fraudster’s account at JP Morgan. The plaintiffs were unaware that the transfer had taken place until later that afternoon, when Ms. Ellison called Mr. Lanahan to report that she had proceeded with the wire transfer based on the phone call that she had received. Mr. Lanahan was surprised that she had done so without his authorization, but Ms. Ellison reassured him that it was fine. Mr. Lanahan, believing that Ms. Ellison had taken the necessary steps to confirm the correct wire instructions, relayed Ms. Ellison’s confirmation to Tennessee Title, who informed the seller’s title company that the purchase was
completed. (Id. ¶ 42–46.) All the parties involved at that point believed that the transfer had gone through and that the transaction had closed properly, and the plaintiffs moved into the New Home. (Id. ¶ 47.) A few days later, Tennessee Title called the plaintiffs to ask where they had sent the funds, and the plaintiffs explained their interactions with Ellison. They then contacted Regions to investigate the matter further. At that point, Regions informed them that “a cyber-criminal had become involved in the transaction and may have stolen their funds.” (Id. ¶ 51.) Regions told the plaintiffs that it would attempt to trace the funds, and the plaintiffs filed a complaint for the fraudulent transfer with the Internet Crime Complaint Center. As of the time they filed suit, they had recovered approximately $11,000. In addition, to mitigate their losses and avoid breaching the purchase agreement for the New Home, they withdrew additional funds from their retirement account to cover the purchase of the New Home, incurring penalties, taxes, and lost investment income, as well as attorney’s fees and accountant’s fees. (Id. ¶¶ 52–59.)
Based on these facts, the Amended Complaint asserts a claim for unauthorized wire transfer, apparently on behalf of Mr. Lanahan only, against Regions, under 12 C.F.R. § 210.25 (“Regulation J, Subpart B”), which incorporates Article 4A of the Uniform Commercial Code governing electronic wire transfers. The plaintiffs also assert common law negligence claims against Regions, Re/MAX, and Pamela King.1 As discussed in greater detail below, the defendants seek dismissal or, in Regions’ case, partial dismissal of the claims against them. The plaintiffs have filed Responses in opposition to each motion (Doc. Nos. 54, 55, 57); Regions and Re/MAX filed Reply briefs (Doc. Nos. 56, 58). II. RULE 12(b)(6) STANDARD OF REVIEW In deciding a motion to dismiss for failure to state a claim under Rule 12(b)(6), the court will “construe the complaint in the light most favorable to the plaintiff, accept its allegations as
true, and draw all reasonable inferences in favor of the plaintiff.” Directv, Inc. v. Treesh, 487 F.3d 471, 476 (6th Cir. 2007); Inge v. Rock Fin. Corp., 281 F.3d 613, 619 (6th Cir. 2002). “Federal Rule of Civil Procedure 8(a)(2) requires only ‘a short and plain statement of the claim showing that the pleader is entitled to relief,’ in order to ‘give the defendant fair notice of what the . . . claim is and the grounds upon which it rests.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007) (quoting Conley v. Gibson, 355 U.S. 41, 47 (1957)). The court must determine only whether “the
1 Tennessee Title was also initially named as a defendant, but the plaintiffs have voluntarily dismissed their claims against Tennessee Title based upon their having reached a settlement with that party. (See Doc. No. 36.) claimant is entitled to offer evidence to support the claims,” not whether the plaintiff can ultimately prove the facts alleged. Swierkiewicz v. Sorema N.A., 534 U.S. 506, 511 (2002) (quoting Scheuer v. Rhodes, 416 U.S. 232, 236 (1974)). The complaint’s allegations, however, “must be enough to raise a right to relief above the
speculative level.” Twombly, 550 U.S. at 555. To establish the “facial plausibility” required to “unlock the doors of discovery,” the plaintiff cannot rely on “legal conclusions” or “[t]hreadbare recitals of the elements of a cause of action,” but, instead, the plaintiff must plead “factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678–79 (2009). “[O]nly a complaint that states a plausible claim for relief survives a motion to dismiss.” Id. at 679; Twombly, 550 U.S. at 556. According to the Supreme Court, “plausibility” occupies that wide space between “possibility” and “probability.” Iqbal, 556 U.S. at 678. If a reasonable court can draw the necessary inference from the factual material stated in the complaint, the plausibility standard has been satisfied. Generally, if “matters outside the pleadings are presented to and not excluded by the court,
the motion must be treated as one for summary judgment under Rule 56.” Fed. R. Civ. P. 12(d). At the same time, however, it has long been the rule that a court may consider, not only the complaint and exhibits attached to it, but also exhibits attached to a defendant’s motion to dismiss, “so long as they are referred to in the Complaint and are central to the claims contained therein.” Brent v. Wayne Cty. Dep’t of Human Servs., 901 F.3d 656, 694 (6th Cir. 2018) (citation omitted). A court may also consider public records without converting a Rule 12(b)(6) motion into a Rule 56 motion. Jones v. City of Cincinnati, 521 F.3d 555, 562 (6th Cir. 2008) (citation omitted). III. ANALYSIS A. Regions’ Motion for Partial Dismissal As set forth above, following removal, the plaintiffs amended their Complaint to include a new cause of action under Regulation J. Although there is limited authority as to whether Regulation J actually gives rise to a private cause of action, the parties presume that it does, and there is caselaw from the Fourth Circuit and Eleventh Circuits, at least, concluding or presuming
that it does.2 This court will presume likewise in this case. Moreover, Regions does not seek dismissal of the plaintiffs’ claim under Regulation J. Instead, the question before the court is whether the plaintiffs’ common law negligence claim is preempted by Regulation J. Regulation J was enacted by the Federal Reserve Board to provide “rules to govern funds transfers through the Fedwire Funds Service.” 12 C.F.R. § 210.25(a). The Fedwire Funds Service (“Fedwire”) is a “funds-transfer system owned and operated by the Federal Reserve Banks that is used primarily for the transmission and settlement of payment orders governed by [Regulation J].” 12 C.F.R. § 210.26. Subpart B of Regulation J applies to wire transfers that occur via Fedwire. See 12 C.F.R. §§ 210.25–210.32. Subpart B of Regulation J
“incorporates the provisions of Article 4A [of the U.C.C.] set forth in appendix A” and “governs the rights and obligations of the . . . parties” to a “funds transfer any part of which is carried out through Fedwire.” 12 C.F.R. §§ 210.25(b)(1), 210.25(b)(2), 210.25(b)(2)(v).
2 See, e.g., Donmar Enters., Inc. v. S. Nat. Bank of N. Carolina, 828 F. Supp. 1230, 1234 (W.D.N.C. 1993) (“Based on the arguments of the parties . . . and the Court’s independent review of the law, the Court is satisfied that 12 C.F.R. § 210 et seq. does establish a private cause of action.”), aff’d, 64 F.3d 944, 946 (4th Cir. 1995) (affirming that conclusion without analysis); Grossman v. Nationsbank, N.A., 225 F.3d 1228, 1232 (11th Cir. 2000) (“The district court held, and the parties agree, that the provisions of Regulation J exclusively apply to the fund transfer in this case . . . .” (citing Donmar Enters., 64 F.3d at 948)). But see Clayton v. Dollar Bank, No. 2:21- CV-843, 2021 WL 4552966, at *7 (W.D. Pa. Oct. 5, 2021) (concluding that the “better view” is that Regulation J does not create a private cause of action). In other words, the provisions of Article 4A, as incorporated by Regulation J, apply to fund transfers using Fedwire. Accord Grossman v. Nationsbank, N.A., 225 F.3d 1228, 1232 (11th Cir. 2000) (“[T]he parties agree . . . that the provisions of Regulation J exclusively apply to the fund transfer in this case because it was effected by the use of Fedwire, the Federal Reserve Banks’
wire-transfer system. Regulation J applies U.C.C. Article 4A to wire transfers conducted using Fedwire.” (citing generally 12 C.F.R. §§ 210.25–210.32)); see also Wright v. Citizen’s Bank of E. Tenn., 640 F. App’x 401, 407 n.7 (6th Cir. 2016) (“When the wire transfers are made through Fedwire, separate federal regulations apply.” (citing 12 C.F.R. §§ 210.25–210.32)). In the instant case, the wire transfer of funds at issue was completed via Fedwire. (Doc. No. 42 ¶ 61.) Consequently, “Regulation J exclusively governs the rights and obligations of parties” relating to that transfer. Fin. Ne. Corp. v. Angelo, 116 F.3d 483 (Table), 1997 WL 341792, at *1 (9th Cir. June 19, 1997). Those courts that have considered the issue have generally held that common law negligence claims that fall directly within the purview of Regulation J are preempted or displaced by Regulation J and UCC Article 4A.3 See, e.g., Donmar Enters., Inc. v. S. Nat. Bank
of N. Carolina, 64 F.3d 944, 950 (4th Cir. 1995) ( “[A]ny state causes of action based on negligence or unlawful payment on the facts of this case are pre-empted by Regulation J.”); Fin. Ne. Corp.,
3 To be clear, the preemption at issue here is “ordinary” or “defensive” preemption, rather than complete preemption. The Sixth Circuit has held that Regulation J, as “a federal regulation promulgated by the Federal Reserve Board, a federal agency,” could not completely preempt state law claims, because “only Congress can completely preempt a state cause of action.” AmSouth Bank v. Dale, 386 F.3d 763, 776 (6th Cir. 2004). Accordingly, removal of the original Complaint in this case on the basis of complete preemption would have clearly been improper. Regions did not seek removal on that ground, however, and instead relied on the “substantial federal question doctrine.” (Doc. No. 1, at 3 (citing Grable & Sons Metal Prods., Inc. v. Darue Eng’g & Mfg., 545 U.S. 308, 312 (2005)).) At least one other federal district court has concluded that removal of a case implicating Regulation J was appropriate on the basis of this doctrine, where the plaintiff confirmed post-removal that its claims were brought “pursuant to UCC Article 4A as codified in Regulation J,” rather than under Texas’s version of the UCC. Tex. Brand Bank v. Luna & Luna, LLP, No. 3:14-CV-1134-P, 2014 WL 11515857, at *3 (N.D. Tex. Aug. 29, 2014). 1997 WL 341792, at *1 (“Because [the plaintiff’s] negligence claims all have to do with the rights of the parties to the wire transfer, they are preempted by Regulation J.” (citing 12 C.F.R. § 210.25(b)(2) and Donmar Enters. 64 F.3d at 949–50)); AlphaVets, Inc. v. JPMorgan Chase Bank, N.A., 651 F. Supp. 3d 810, 816 (D.S.C. 2023) (holding that the determination of whether “a state
law claim is preempted by Regulation J turns on whether the challenged conduct in the state claim would be covered under Subpart B as well” and, therefore, that any claim that “directly relate[d] to the transfer itself and [was not merely] incidental to the transfer” was preempted (quoting Eisenberg v. Wachovia Bank, N.A., 301 F.3d 220, 223 (4th Cir. 2002)); Util. Supply Co. v. AVB Bank, No. 10-CV-124-JHP, 2010 WL 4941506, at *4 (N.D. Okla. Nov. 30, 2010) (“USC has challenged actions which are part of a ‘funds transfer’ accomplished through use of the Fedwire fund-transfer system; therefore Regulation J applies and preempts the duplicative Oklahoma state law.”). Similarly, in Wright, where the plaintiffs asserted claims under Tennessee’s version of Article 4A, Tenn. Code Ann. Title 47 Ch. 4A, rather than purporting to state a federal claim under
Regulation J, the Sixth Circuit was called upon to consider whether the common law claims were preempted by the Tennessee Uniform Commercial Code. The court held that the common law negligence and fraud claims asserted in that case, arising out of a situation addressed by particular provisions of Article 4A, were displaced by Article 4A and that a plaintiff’s “exclusive remedy for [such a] claim must be found in Article 4A.” Wright, 640 F. App’x at 407 (citation omitted); see id. at 409–10 (“Because the Wrights’ claims fit squarely within Article 4A, Counts I and IV are displaced by Article 4A. . . .”). The court also observed that, because Regulation J “incorporate[s] Article 4A,” the analysis under federal or state law would be essentially the same. Id. at 407 n.7. In support of their claim of unauthorized wire transfer under Regulation J, the plaintiffs allege that: (1) the “wire transfer at issue was transmitted through Fedwire and is therefore governed by 12 C.F.R. § 210.25 et seq. more commonly called Regulation J, Subpart B”; (2) Mr. Lanahan’s wire transfer request form that he gave to Ms. Ellison constitutes a “payment order”
under Regulation J and UCC § 4A-103; (3) Mr. Lanahan’s express direction not to process the wire transfer constitutes a “cancellation” of the payment order, under UCC § 4A-211; (4) Mr. Lanahan issued the cancellation before the payment order was accepted, giving Regions ample time to honor the cancellation; and (5) at the time Regions processed the wire, it lacked authority to do so, making Regions liable for damages, “including a return of funds to [Mr. Lanahan] with interest.” (Doc. No. 42 ¶¶ 61–70.) The plaintiffs’ negligence claim is based on the same unauthorized transfer, but, in support of this claim, the Amended Complaint further alleges that (1) Ellison was an employee of Regions acting within the course and scope of her employment, such that Regions is responsible for her negligent acts or omissions under the doctrine of respondeat superior; (2) Ellison knew that the
funds at issue were marital funds belonging to both Mr. and Ms. Lanahan and that Mr. Lanahan was acting on his own behalf and on behalf of his spouse; (3) Regions, through Ellison, assumed a “h[e]ightened duty of care” when Ellison noticed the suspicious wire transfer instruction, advised Mr. Lanahan to seek confirmation of the instruction, and agreed to postpone initiating the wire transfer until she received confirmation from Mr. Lanahan; (4) Regions, through Ellison, breached its duty of care when Ellison initiated the wire transfer following receipt of an unverified, inbound telephone call without making any attempt to verify the identity or authority of the caller; (5) as a result of her actions, the plaintiffs suffered the loss of their funds and interest, as well as consequential damages in the form of taxes, interest, and penalties when they were forced to withdraw retirement funds prematurely, as well as lost investment income, attorney’s fees, and accountant’s fees. (Id. ¶¶ 72–83.) In response to Regions’ preemption argument, the plaintiffs acknowledge that the wire transfer is governed by Regulation J, but they assert that Regions, through Ms. Ellison, voluntarily
assumed a duty of care above and beyond what Regulation J imposed, giving rise to a separate and distinct cause of action. As Regions points out, however, and as the plaintiffs allege in the Amended Complaint, the cancellation of a wire transfer is expressly covered by Regulation J and Article 4A. See Appendix A to Part 210, Section 4A-211(a) (“A communication of the sender of a payment order canceling or amending the order may be transmitted to the receiving bank orally, electronically, or in writing.”); id. § 4A-211(b) (“Subject to subsection (a), a communication by the sender canceling or amending a payment order is effective to cancel or amend the order if notice of the communication is received at a time and in a manner affording the receiving bank a reasonable opportunity to act on the communication before the bank accepts the payment order.”). In addition, if a “receiving bank”—Regions, in this case—“accepts a payment order issued in the
name of its customer as sender which is . . . not authorized and not effective as the order of the customer under section 4A–202, . . . the bank shall refund any payment of the payment order . . . and shall pay interest on the refundable amount calculated from the date the bank received payment to the date of the refund.” Id. § 4A-204. In other words, it is clear that the plaintiffs’ negligence claim “fits squarely within Article 4A” and, therefore, is “displaced” by Regulation J and Article 4A. Wright, 640 F. App’x at 409. Insofar as the plaintiffs seek to recover damages beyond those authorized by the UCC, they may not do so. See id. (holding that, as a result of this displacement, the plaintiffs were “unable to recover the consequential damages they seek” in their negligence and fraud claims arising from a delayed wire transfer). Because the plaintiffs’ negligence claim arising out of an allegedly unauthorized wire transfer is preempted by Article 4A, it must be dismissed. B. Re/MAX’s Motion to Dismiss Re/MAX moves for dismissal on the grounds that (1) the plaintiffs signed a disclaimer from Re/MAX, warning them of the risks associated with wiring funds in the purchase of real
estate and (2) the facts in the Amended Complaint, accepted as true, contain only conclusory assertions regarding Re/MAX’s purported “breach[] [of] its duty of care by failing to implement and maintain cybersecurity systems and protocols sufficient to ensure the security of its electronic correspondence with Plaintiffs and exchange of other sensitive transaction-related information” (Doc. No. 44, at 8 (quoting Doc. No. 42 ¶ 91)); (3) the facts as alleged in the Amended Complaint establish that the “direct actions of Regions and Ms. Ellison are the cause of the harm [the plaintiffs] suffered” (id.); (4) the Amended Complaint fails to allege facts establishing Re/MAX’s respondeat superior liability for the actions of Pamela King, an independent contractor; and (5) Re/MAX had no duty to implement cybersecurity protocols to protect the communications of its independent contractors.
The plaintiffs respond that they have adequately alleged all of the requisite elements of their negligence claim against Re/MAX, that Re/MAX has relied on matters outside the pleadings in support of its Motion to Dismiss, and that its waiver and causation arguments are affirmative defenses that are improperly raised at this stage in the proceedings. (Doc. No. 54.) In its Reply, Re/MAX clarifies that it is not actually arguing waiver or that it owed no duty of care to the plaintiffs. (Doc. No. 56, at 2.) Instead, it is arguing that it satisfied any duty it had by warning the plaintiffs about the potential for cybercrime and that, even if it breached any duty, no action or inaction by Re/MAX (or Pamela King) caused the plaintiffs’ damages. (Id. at 2–4.) To establish a prima facie claim of negligence under Tennessee law, a plaintiff must prove the following essential elements: “(1) a duty of care owed by defendant to plaintiff; (2) conduct below the applicable standard of care that amounts to a breach of that duty; (3) an injury or loss; (4) cause in fact; and (5) proximate, or legal, cause.” Cotten v. Wilson, 576 S.W.3d 626, 637 (Tenn.
2019) (quoting Giggers v. Memphis Hous. Auth., 277 S.W.3d 359, 364 (Tenn. 2009)). Re/MAX does not actually dispute that it owed a duty of due care to the plaintiffs. Instead, it argues that it satisfied its duty of care by providing a warning to the plaintiffs of the existence of cybercrime and the need to be vigilant against it when conducting wire transfers. Insofar as Re/MAX relies on matters outside the pleadings, the court declines to consider the waiver form to which it refers. Moreover, this purported warning did not actually mitigate or address the negligent failures alleged by the plaintiffs. The plaintiffs contend that the risk posed by cybercriminals was foreseeable and that, in light of that foreseeability, Re/MAX owed the plaintiffs a duty of reasonable care to ensure the confidentiality and security of communications between the plaintiffs and Re/MAX agents. They
allege that Re/MAX breached that duty of care by “failing to implement and maintain cybersecurity systems and protocols sufficient to ensure the security of its electronic correspondence” with the plaintiffs and other “sensitive, transaction-related information.” (Doc. No. 42 ¶¶ 87, 91.) They also allege that Re/MAX is vicariously liable for the acts of Pamela King, because, as either an employee or an independent contractor, she “exclusively operated pursuant to such protocols, training, systems, and management established by [Re/MAX],” such that Re/MAX is “liable for the failure of Pamela King or other employees to exercise reasonable care by implementing and maintaining adequate cybersecurity systems.” (Id. ¶¶ 89–90, 92.) Finally, the plaintiffs allege that Re/MAX’s negligence was the “direct and proximate cause” of cybercriminals’ gaining access to sensitive information and correspondence relating to the plaintiffs’ purchase of the New Home, their successfully impersonating Emily Kornbau and Pamela King, and the plaintiffs’ being defrauded of nearly $450,000. (Id. ¶ 93.) At this juncture, the court finds that the plaintiffs have adequately pleaded their negligence
claim against Re/MAX. Re/MAX does not dispute that it owed the plaintiffs a duty of care to prevent foreseeable injury, and the question of whether it satisfied that duty by simply warning the plaintiffs about cybercriminals is one for a jury. The allegations in the Amended Complaint also give rise to a reasonable inference that the security protocols that Pamela King was to follow were those established by Re/MAX and that those protocols were not adequate. As for causation, the law in Tennessee is clear that cause in fact (also called “actual cause”) and legal cause (traditionally called “proximate” cause),4 Cotten, 576 S.W.3d at 638, are “distinct concepts that are not interchangeable,” Troup v. Fischer Steel Corp., 236 S.W.3d 143, 150 (Tenn. 2007) (citing Kilpatrick v. Bryant, 868 S.W.2d 594, 598 (Tenn. 1993)). Both are “ordinarily jury questions, unless the uncontroverted facts and inferences to be drawn from them make it so clear
that all reasonable persons must agree on the proper outcome.” Id. (quoting Haynes v. Hamilton Cty., 883 S.W.2d 606, 612 (Tenn. 1994)). As the Tennessee Supreme Court has explained, “[c]ause in fact or ‘actual cause’ means that the injury or harm would not have occurred ‘but-for’ the defendant’s negligent conduct.” King v. Anderson Cty., 419 S.W.3d 232, 246 (Tenn. 2013) (quoting Kilpatrick, 868 S.W.2d at 598). Cause in fact “refers to the cause and effect relationship between the tortious conduct and the injury.” Kilpatrick, 868 S.W.2d at 598.
4 The Tennessee Supreme Court has clarified that “legal cause” and “proximate cause” are synonymous. Cotten, 576 S.W.3d at 638 n.17. Legal cause, also known as proximate cause, on the other hand, is merely the limitation which the courts have placed upon the actor’s responsibility for the consequences of the actor’s conduct. . . . [T]he consequences of an act go forward to eternity, and the causes of an event go back to the dawn of human events, and beyond. But any attempt to impose responsibility upon such a basis would result in infinite liability . . . . Doe v. Linder Constr. Co., 845 S.W.2d 173, 181 (Tenn. 1992) (quoting W. Page Keeton et al., Prosser and Keeton on the Law of Torts § 41, at 264 (5th ed. 1984)). Proximate cause, that is, “connotes a policy decision made by the judiciary to establish a boundary of legal liability and to deny liability for conduct that could otherwise be actionable.” Cotten v. Wilson, 576 S.W.3d 626, 638 (Tenn. 2019) (citation omitted). To constitute proximate cause of an injury, (1) the tortfeasor’s conduct must have been a “substantial factor” in bringing about the harm being complained of; and (2) there is no rule or policy that should relieve the wrongdoer from liability because of the manner in which the negligence has resulted in the harm; and (3) the harm giving rise to the action could have reasonably been foreseen or anticipated by a person of ordinary intelligence and prudence. Id. (quoting McClenahan v. Cooley, 806 S.W.2d 767, 775 (Tenn. 1991)). The plaintiffs’ allegations at this juncture are sufficient to establish that Re/MAX’s allegedly inadequate cybersecurity protocols was an actual cause of their losses, but for which the wire fraud could not have occurred. And Re/MAX fails to identify any policy argument for relieving it of liability for harm allegedly caused, at least in part, by its negligence. What Re/MAX really appears to be attempting to argue is that Marithza Ellison’s negligence in sending an unauthorized wire was an intervening, superseding cause that interrupted the causal chain and relieved Re/MAX of any possible liability. The Tennessee Supreme Court discussed superseding cause at some length in 2019 in Cotten v. Wilson, explaining as follows: At times, an intervening event may interrupt the chain of proximate causation between the defendant's negligence and the victim’s injury. . . . An independent, intervening cause of the ultimate injury may relieve a negligent actor from liability. The intervening cause doctrine is a common-law liability shifting device. It provides that a negligent actor will be relieved from liability when a new, independent[,] and unfor[eseen] cause intervenes to produce a result that could not have been foreseen. The terms “intervening” and “superseding” are not interchangeable. Traditional terminology used in the First and Second Restatement of Torts referred to “intervening acts” and “superseding causes.” Any event, whether it be an outside force or an act by a third party, that is a factual cause of the injury and occurs after the defendant’s allegedly tortious conduct is an “intervening” force or act. However, not every intervening force or act is superseding. A “superseding cause” is an intervening force or act that is deemed sufficient to prevent liability for an actor whose tortious conduct was a factual cause of harm. Cotten, 576 S.W.3d at 638–39 (internal quotation marks and citations omitted). Re/MAX certainly has a solid basis for arguing that Ellison’s acts of noticing the dueling wire instructions, accepting Mr. Lanahan’s timely cancellation of the wire order, but then transmitting the wire anyway, without authorization, constitute intervening cause. As for whether her acts constitute superseding cause, the Tennessee Supreme Court has also stated that a defendant asserting superseding cause as an affirmative defense to liability must establish that (1) the harmful effects of the superseding cause . . . occurred after the original negligence; (2) the superseding cause must not have been brought about by the original negligence; (3) the superseding cause must actively work to bring about a result which would not have followed from the original negligence; and (4) the superseding cause must not have been reasonably foreseen by the original negligent party. Id. at 639 (citations omitted). Re/MAX here has not addressed any of these factors, and not all of them are plain from the face of the Amended Complaint. The plaintiffs had no obligation to anticipate the affirmative defense. The court, therefore, rejects Re/MAX’s causation argument and finds, at this juncture, that the Amended Complaint adequately states a negligence claim against Re/MAX. C. Pamela King’s Motion to Dismiss King, for her part, moves for dismissal of the negligence claim against her on the basis that (1) the Purchase and Sale Agreement the plaintiffs’ signed in connection with their purchase of the New Home contains a waiver of liability; (2) King had no duty to protect the plaintiffs from the criminal acts of third parties; and (3) to the extent she had any such duty, she complied with it by putting the plaintiffs on notice of the potential for cybercrime. The court is not persuaded by these arguments. First, to the extent King relies on the
Purchase and Sale Agreement and other documents in support of her Motion to Dismiss, these documents were not attached as exhibits to the plaintiffs’ pleadings and are neither referred to in the Amended Complaint nor “central to the claims contained therein.” Brent v. Wayne Cty. Dep’t of Human Servs., 901 F.3d 656, 694 (6th Cir. 2018). The court declines to consider the matters outside the pleadings attached to King’s Motion to Dismiss and will not convert King’s motion into one for summary judgment. Second, as for whether King had a duty to protect the plaintiffs from criminal acts by third parties, the Tennessee Supreme Court has held that businesses have a duty to take reasonable measures to protect their customers from foreseeable criminal attacks. McClung v. Delta Square Ltd. P’ship, 937 S.W.2d 891, 899–900 (Tenn. 1996). While the criminal attack at issue in McClung
was physical in nature, the court sees no impediment to extending the principle to protection from foreseeable cybercrime. And there appears to be no dispute in this case that attempts by cybercriminals to insert themselves into the wire transfer process in real estate transactions are foreseeable. And finally, as set forth above, the question of whether simply warning the plaintiffs about the possibility of cybercrime satisfied that duty is not one the court will resolve on a motion to dismiss. IV. CONCLUSION For the reasons set forth herein, Regions’ motion, seeking dismissal only of the common law negligence claim against it as preempted or displaced by Regulation J and UCC Article 4A 18
will be granted. Re/MAX’s and Pamela King’s Motions to Dismiss will be denied. An appropriate Order is filed herewith.
ALETA A. TRAUGER United States District Judge