LITTLE SEEDS CHILDREN'S CENTER, Case No. 25-cv-01517-HSG INC., et al., ORDER GRANTING IN PART AND Plaintiffs, DENYING IN PART MOTION TO v. Re: Dkt. No. 13 CITIBANK, N.A., Defendant. Pending before the Court is Defendant’s motion to dismiss Plaintiffs’ complaint. See Dkt. No. 13 (“Mot.”); Dkt. No. 17 (“Opp.”); Dkt. No. 18 (“Reply”). The Court finds this matter appropriate for disposition without oral argument and the matter is deemed submitted. See Civil L.R. 7-1(b). For the reasons discussed below, the Court GRANTS IN PART and DENIES IN PART the motion to dismiss. Plaintiffs Little Seeds Children’s Center, Inc. (“LSCC”), LSCC CEO Mahvash Kamrani, and LSCC CFO Hossein Kamrani filed a lawsuit against Defendant Citibank, N.A., in February 2025, bringing various state law actions arising out of a series of allegedly fraudulent wire transfers. See Dkt. No. 1-1 (“Compl.”) ¶¶ 1–2, 17. Plaintiffs Mahvash and Hossein Kamrani have held bank accounts with Defendant since 1999, and those accounts have been used to manage LSCC’s funds. See id. ¶¶ 12–13. Before July 2024, Plaintiffs conducted all their business in person. Id. ¶ 14. Plaintiffs allege that, between 1999 and 2024, Defendant’s standard practice was to contact Plaintiffs via email or text message and by phone regarding potential account interference and to “confirm any transaction that appeared out-of-the-norm.” Id. ¶¶ 15, 17. In one local branch manager contacted Plaintiffs to confirm the check was legitimate. Id. ¶ 16. In July 2024, Plaintiffs were allegedly convinced “over [their] initial reluctance” by Defendant’s agents at an Alameda branch to begin scanning their checks and to use a security key to authorize transactions remotely. Id. ¶¶ 19–20. The security key provided a one-time password used in combination with Plaintiffs’ username and password to log into Defendant’s website. Id. ¶ 21. Plaintiffs allege that they were told by the Alameda branch agents that the security key “would provide added protections on top of the ability to conduct important transactions in person and the account monitoring and the already agreed-upon security protocol of phone calls for potentially suspicious transactions.” Id. ¶¶ 71, 80. On October 1, 2024, Plaintiffs were allegedly called by “Jason B.,” an individual using a Citibank phone number and purporting to be an employee at Citibank’s fraud department. Id. ¶¶ 29–43. On the call, Jason B. alerted Plaintiffs to a dozen pending wire transfers that had been issued against Plaintiffs’ accounts and pretended to freeze them, but in actuality, he convinced Plaintiffs to use the security key to trigger completion of the wire transfers. See id. Plaintiffs claim they never provided any confidential personal information on this call, and “Jason B. already had all of this information before calling Plaintiffs.” Id. ¶ 43. In total, $717,293.08 was stolen across almost twenty wire transfers, many of which occurred within the span of an hour, and most of which went to recipients in Florida. Id. ¶¶ 27, 95–96, 100. Plaintiffs allege they had “no history of requesting or authorizing wire fund transfers of any kind . . . let alone multiple wire transfers in one day or for large sums of money.” Id. ¶ 26. Plaintiffs now seek to recover from Defendant on theories of negligent and intentional misrepresentation, violation of various California statutes, and negligent hiring.1 Defendant moved to dismiss all claims. Dkt. No. 13. 1 The first three claims (negligent misrepresentation, intentional misrepresentation, and violation of the California Commercial Code) are brought by Plaintiff LSCC. The fourth and fifth claims (violation of the California Consumer Privacy Act and the California Consumer Records Act) are brought by the Kamranis as individuals. The remaining two claims are brought by all Plaintiffs. Federal Rule of Civil Procedure 8(a) requires that a complaint contain “a short and plain statement of the claim showing that the pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). A defendant may move to dismiss a complaint for failing to state a claim upon which relief can be granted under Rule 12(b)(6). “Dismissal under Rule 12(b)(6) is appropriate only where the complaint lacks a cognizable legal theory or sufficient facts to support a cognizable legal theory.” Mendiondo v. Centinela Hosp. Med. Ctr., 521 F.3d 1097, 1104 (9th Cir. 2008). To survive a Rule 12(b)(6) motion, a plaintiff need only plead “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). A claim is facially plausible when a plaintiff pleads “factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). In reviewing the plausibility of a complaint, courts “accept factual allegations in the complaint as true and construe the pleadings in the light most favorable to the nonmoving party.” Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008). Nevertheless, courts do not “accept as true allegations that are merely conclusory, unwarranted deductions of fact, or unreasonable inferences.” In re Gilead Scis. Sec. Litig., 536 F.3d 1049, 1055 (9th Cir. 2008) (quotation omitted). Even if the court concludes that a 12(b)(6) motion should be granted, the “court should grant leave to amend even if no request to amend the pleading was made, unless it determines that the pleading could not possibly be cured by the allegation of other facts.” Lopez v. Smith, 203 F.3d 1122, 1127 (9th Cir. 2000) (en banc) (quotation omitted). Defendant seeks dismissal on several grounds, including (1) under the economic loss rule; (2) for failure to state a claim under Rule 9(b); (3) for failure to state a claim for negligent hiring and under various violations of the California Commercial Code, California Consumer Privacy Act, and California Consumer Records Act; and (4) for failure to plead an adequate remedy at law. Mot. at 8–9. i. Negligent Misrepresentation (Claim One) Plaintiffs allege that Defendant’s employees stated that the security key was an additional security measure on top of the existing phone and email notifications, and that Defendant knew or should have known that the security key was a replacement for these procedures. Compl. ¶¶ 71, 75. Defendant contends that the economic loss doctrine bars Plaintiffs’ negligent misrepresentation cause of action because Plaintiff LSCC’s relationship with Defendant is contractual, and Plaintiffs do not allege any physical injury or property damage. Mot. at 13. The “economic loss rule prevents the law of contract and the law of tort from dissolving one into the other.” Robinson Helicopter Co. v. Dana Corp., 34 Cal. 4th 979, 988 (2004) (internal quotation and alteration omitted). “The rule itself is deceptively easy to state: In general, there is no recovery in tort for negligently inflicted ‘purely economic losses,’ meaning financial harm unaccompanied by physical or property damage.” Sheen v. Wells Fargo Bank, N.A., 12 Cal. 5th 905, 922 (2022). This Court has previously interpreted the California Supreme Court’s holding in Robinson Helicopter to mean that “a negligent misrepresentation claim paralleling a contract claim that prays only for economic damages will be barred by the economic loss rule unless the plaintiff alleges both that the defendant made an affirmative misrepresentation, and that the defendant’s misrepresentation exposed the plaintiff to independent personal liability.” Crystal Springs Upland Sch. v. Fieldturf USA, Inc., 219 F. Supp. 3d 962, 970 (N.D. Cal. 2016); see also Farrales v. Ford Motor Co., No. 21-CV-07624-HSG, 2022 WL 1239347, at *9 (N.D. Cal. Apr. 27, 2022) (noting that “[i]n the absence of California Supreme Court authority, the Court continues to read Robinson Helicopter as a narrow exception to the economic loss rule”). In other words, “non-economic loss is a required element of a negligence cause of action alleged in a sale of goods case, and thus non- economic loss must be pleaded to survive a motion to dismiss.” Ladore v. Sony Comput. Ent. Am., LLC, 75 F. Supp. 3d 1065, 1075 (N.D. Cal. 2014). The California Supreme Court recently elaborated regarding the economic loss doctrine in Rattagan v. Uber Technologies., Inc., 17 Cal. 5th 1 (2024), when it considered whether fraudulent loss doctrine and held that fraudulent concealment claims are exempt from the doctrine, which “does not apply to limit recovery for intentional tort claims like fraud” and only applies when “the parties have entered into a contract; the plaintiff sues for tort damages, alleging defendant failed to perform as the contract requires; and [the defendant] negligently caused economic losses flowing from the breach,” not “physical damage or personal injury beyond the economic losses.” Id. at 38, 44. However, the court also clarified that the economic loss doctrine and the holding in Robinson Helicopter are just specific applications of the “independent tort principle,” which holds that “[b]roader tort liability only arises if a defendant violates an independent legal duty and the type of harm that ensues was not reasonably contemplated or accounted for by the contractual parties.” See id. at 26, 34, 37. Under this broader principle, courts must “(1) ascertain the full scope of the parties’ contractual agreement”; (2) “determine whether there is an independent tort duty to refrain from the alleged conduct”; and (3) “if an independent duty exists . . . consider whether the plaintiff can establish all elements of the tort independently of the rights and duties assumed by the parties under the contract.” Id. at 26. As a result, the Rattagan court ultimately held that “[a] plaintiff may assert a tort claim for fraudulent concealment based on conduct occurring in the course of a contractual relationship, if the elements of the cause of action can be established independently of the parties’ contractual rights and obligations and the tortious conduct exposes the plaintiff to a risk of harm beyond the reasonable contemplation of the parties when they entered into the agreement.” Id. at 38. Courts already differ in how they apply Rattagan. See Iwatani Corp. of Am. v. Nel Asa, No. 8:24-CV-00192-JVS-KES, 2024 WL 4800080, at *5–*6 (C.D. Cal. Oct. 18, 2024), corrected in relevant part sub nom. Iwatani Corp. v. Nel Asa, No. 8:24-CV-00192-JVS-KES, 2024 WL 4800078 (C.D. Cal. Oct. 29, 2024) (dismissing negligent misrepresentation claim but not intentional misrepresentation claims, and distinguishing between breaches of contractual promises and breaches of duties growing out of a contract); Dolby Lab’ys Licensing Corp. v. Roku, Inc., No. 24-CV-04660-EJD, 2025 WL 2021803, at *12 (N.D. Cal. July 18, 2025) (applying Rattagan, and the reasonable contemplation of the parties). Most notably, multiple courts have suggested that fraudulent inducement claims can survive without conducting the full Rattagan inquiry, reasoning that these claims are controlled by a fraudulent inducement exception that the California Supreme Court declined to overturn from Dhital v. Nissan North America, Inc., 84 Cal. App. 5th 828 (2022). See, e.g., Moore v. Am. Honda Motor Co., No. 5:23-CV-05011-BLF, 2025 WL 948114 (N.D. Cal. Mar. 28, 2025) (“By expressly calling out the distinction between Rattagan’s facts and the fraudulent inducement cases and then dismissing the appeal of Dhital without vacating, reversing, or otherwise altering the court of appeal’s opinion, the California Supreme Court indicated that the reasoning in Dhital should guide [such] claims . . . .”); Ramos v. Ford Motor Co., No. 2:24-CV-04066-AH-(JPRX), 2025 WL 1606917, at *5 (C.D. Cal. Apr. 16, 2025). Dhital held that fraudulent inducement is an exception to the economic loss rule “because a defendant’s conduct in fraudulently inducing someone to enter a contract is separate from the defendant’s later breach of the contract or warranty provisions that were agreed to.” 84 Cal. App. 5th at 841. While Dhital discusses intentional omissions and misrepresentations, some recent cases have applied this “fraudulent inducement exception” to negligent misrepresentations, reasoning that negligent misrepresentation is a species of fraud that should be treated the same as intentional omissions. See Shared P’ship v. Meta Platforms, Inc., No. 22-CV-02366-RS, 2024 WL 4280936, at *5 (N.D. Cal. Sept. 23, 2024) (citing non-precedential case Kalitta Air, L.L.C. v. Cent. Texas Airborne Sys., Inc., 315 F. App’x 603, 607 (9th Cir. 2008)). Here, the Court must apply the test articulated in Rattagan. The Court agrees that Rattagan permits at least some claims for fraudulent inducement. Rattagan, 1 Cal. 5th at 41 (“[I]t has long been the rule that where a contract is secured by fraudulent representations, the injured party may elect to affirm the contract and sue for the fraud.”) (quotation omitted). But Rattagan also provides a controlling framework for analyzing tort liability, and the Court will not bypass this analysis and extend Dhital’s reasoning to a different cause of action absent clear guidance from the California Supreme Court. The Court is especially reluctant to do so because Rattagan’s extensive discussion of the independent tort principle and economic loss doctrine suggests that the contract and the principles underpinning contract and tort remedies.2 Nothing in Rattagan suggests that claims can be easily and categorically excluded: to the contrary, the court provided further clarification about when fraudulent concealment claims would be permitted in contractual disputes, even after determining that the narrower economic loss rule did not apply.3 Applying Rattagan, the Court finds that Plaintiffs may have adequately pleaded a violation of an independent tort duty to survive at this early pleading stage. Here, Plaintiffs do not allege that Defendant “use[d] its affirmative misrepresentations as a means of breaching its contract”; rather, they seem to allege that Defendant’s “affirmative misrepresentations were [used] to induce [them] to accept the [security key], something [Defendant] could not have accomplished independently without engaging in [allegedly] fraudulent conduct.” Rattagan, 17 Cal. 5th at 36 (discussing the holding of Robinson Helicopter) (emphasis in original). However, even assuming (without deciding) that they can clear the independent duty hurdle, Plaintiffs have not adequately pleaded that they were exposed to liability “beyond the reasonable contemplation of the parties that might result from a breach when they entered into their contract.” Id. Plaintiffs argue that the failure to use the agreed-upon security measures created a significant risk of reputational damage and future non-compliance with California regulations regarding childcare facilities. Opp. at 11. But those harms are not alleged in the complaint.4 All that remains is a purely economic loss—stolen funds—that falls within the
2 For similar reasons, the Court rejects Plaintiffs’ argument that it should not apply the economic loss doctrine because many courts in this circuit have held that the economic loss rule does not bar negligent misrepresentation claims. Opp. at 9–10. It is true that many courts have declined to extend the economic loss rule to negligent misrepresentation claims. See, e.g., Phillips v. Brooklyn Bedding LLC, No. 23-CV-03781-RFL, 2024 WL 2830663, at *7 (N.D. Cal. Mar. 28, 2024) (collecting cases). But none of the cases cited by Plaintiffs addressed Rattagan’s holding, which this Court is required to apply.
3 Moreover, Plaintiffs do not brief the issue of whether Dhital should apply to their claim for negligent misrepresentation, and the Court is not convinced from the existing allegations that this is a case—like Dhital—where a contract was secured by misrepresentation, as opposed to a case where a misrepresentation arose during the course of an existing contractual relationship.
4 In light of this fact, the Court need not determine if these two harms were beyond the reasonable contemplation of the parties. But the Court is skeptical that these harms—variants of which could reasonable contemplation of an agreement to safeguard that money. The Court finds Rattagan’s description of Robinson Helicopter instructive: there, despite the fact that the plaintiff “would not have accepted delivery and used the nonconforming [parts]” if not for the defendant’s misrepresentations, the court still analyzed the “risk of harm far beyond the disappointment of its expectancy interest in contract fulfillment . . . including potential liability for personal injury or property damage and disciplinary action by the FAA.” Rattagan, 17 Cal. 5th at 33–34. Plaintiffs include no comparable allegations, so the Court DISMISSES this claim with leave to amend.5 ii. Intentional Misrepresentation (Claim Two) Defendant also moves to dismiss Plaintiff LSCC’s intentional misrepresentation claim, arguing that Plaintiffs fail to plead an actual misrepresentation, intent, reasonable reliance, and causation with the adequate particularity required by Rule 9(b). Mot. at 14–15.6 “The elements of a claim for intentional misrepresentation are (1) a misrepresentation; (2) knowledge of falsity; (3) intent to induce reliance; (4) actual and justifiable reliance; and (5) resulting damage.” Cisco Systems, Inc. v. STMicroelectronics, Inc., 77 F. Supp. 3d 887, 897 (N.D. Cal. 2014). When fraud is an essential element of a claim, Rule 9(b) imposes a heightened pleading standard. See Fed. R. Civ. P. 9(b) (“In alleging fraud or mistake, a party must state with particularity the circumstances constituting fraud or mistake.”); see also Vess v. Ciba–Geigy Corp. USA, 317 F.3d 1097, 1107 (9th Cir. 2003). A plaintiff must identify “the who, what, when, where, and how” of the alleged conduct to provide defendants with sufficient information to defend against the charge. Cooper v. Pickett, 137 F.3d 616, 627 (9th Cir. 1997) (quotation omitted). However, “[m]alice, intent, knowledge, and other conditions of a person’s mind may be alleged generally.” Fed. R. Civ. P. 9(b). Plaintiffs have met these requirements. First, Plaintiffs allege that “[i]n or about July
5 While Rattagan’s broader test appears to supersede the Court’s previous interpretation of Robinson Helicopter, the Court notes that the Robinson Helicopter test would yield the same result—Plaintiffs’ claim fails because they have not alleged any independent personal liability.
6 Defendant makes the same arguments against Plaintiffs’ negligent misrepresentation claim. 2024,” Defendant’s “agents at the Alameda branch” misrepresented that “the security token would provide added protections on top of . . . the agreed-upon security measure of account monitoring and phone calls . . . for potentially suspicious transactions,” when really “Defendant [silently] withdrew security support” once Plaintiffs signed up for the security token. Compl. ¶¶ 19, 80–82. Contrary to Defendant’s claims, this establishes enough detail about “who made any purported misrepresentations, what specifically was said, where it was said, [and] what was false about the representation” to satisfy Rule 9(b)’s particularity requirements. See Mot. at 15.7 Second, Plaintiffs allege that “Defendant did not intend to provide the same level of account monitoring it historically had provided,” “knew that the representation to Plaintiffs . . . was not true or Defendant made the statement with reckless disregard for its truth,” and “Defendant intended for Plaintiffs to rely on its statements.” Compl. ¶¶ 81, 83, 85. Plaintiffs may allege intent generally under Rule 9(b). Third, Plaintiffs specifically allege that they had relied on phone and email account alerts for years, were reluctant to adopt the security key, and only did so because the agents represented that the key would be a supplementary measure. Id. ¶¶ 14–15, 18, 20, 86. Finally, Plaintiffs allege that Defendant reduced its security support once Plaintiffs agreed to use the security key, which permitted the fraudulent wire transfers. Id. ¶ 87. Whether this alleged change in security procedures was a legally sufficient cause of Plaintiff LSCC’s injuries is not something the Court can decide as a matter of law at this early pleading stage. For these reasons, the Court DENIES Defendant’s motion with respect to the intentional misrepresentation claim.8 iii. Violation of California Commercial Code (Claim Three) Defendant moves to dismiss Plaintiff LSCC’s claim under the California Commercial 7 Defendant suggests Plaintiffs “[do] not allege with particularity what the anonymous Citibank employee actually said (as opposed to what LSCC believed).” Reply at 12 n.4. The Court disagrees. Plaintiffs plead that “Defendant, by and through [the Alameda branch employees], stated that the security token would provide added protections.” Compl. ¶ 80. This describes a statement, not a belief. Plaintiffs are not required to specifically quote the July 2024 statement to provide sufficient notice to Defendant and satisfy the Rule 9(b) standard.
8 Defendant cites several cases to support its arguments, but these cases are distinguishable. See, e.g., White v. J.P. Morgan Chase, Inc., 167 F. Supp. 3d 1108, 1115 (E.D. Cal. 2016), aff’d sub nom. White v. JPMorgan Chase & Co., 702 F. App’x 642 (9th Cir. 2017) (dismissing largely Code. Plaintiffs allege that Defendant (1) incorrectly processed the wire transfers, citing Cal. Com. Code § 11201(b); (2) failed to use commercially reasonable security procedures, see id. § 11202; (3) failed to provide Plaintiff LSCC with proper notification of any errors, see id. § 11204; (4) failed to return the fraudulently wired funds with interest, see id. § 11204; and (5) engaged in unauthorized actions that caused the loss or misdirected the funds, see id. § 11205. Compl. ¶ 90. Defendant first argues that California Commercial Code section 11201(b) does not exist. Mot. at 16. Plaintiffs concede that this was a “typographical error.” Opp. at 21. Plaintiff LSCC’s claim is DISMISSED without leave to amend to the extent it brings an action under section 11201(b). Defendant next argues that California Commercial Code section 11205 only “addresses . . . errors in payment orders related to misdescription of the beneficiary, an error in the amount of the transfer, or a duplicate transfer.” Mot. at 17. Plaintiffs agree. Opp. at 26. Plaintiff LSCC’s claim is DISMISSED without leave to amend to the extent it brings an action under section 11205. Defendant next argues that California Commercial Code section 11202 does not itself impose liability. Mot. at 16. The Court agrees: section 11202 defines authorized and effective payment orders. It states that a payment order is authorized if “[the customer] authorized the order or is otherwise bound by it under the law of agency.” Cal. Com. Code § 11202(a). An unauthorized order may nevertheless be effective if “a bank and its customer have agreed that the authenticity of payment orders . . . will be verified pursuant to a security procedure,” “the security procedure is a commercially reasonable method of providing security against unauthorized payment orders,” and “the bank proves that it accepted the payment order in good faith and in compliance with the bank’s obligations under the security procedure and any agreement or instruction of the customer, evidenced by a record, restricting acceptance of payment orders issued in the name of the customer.” Id. § 11202(b). However, Plaintiffs properly bring their cause of action under section 11204 for failure to return the fraudulently wired funds, Compl. ¶ 90(d), so the Court need not dismiss on this ground. “If a receiving bank accepts a payment order issued in the name of its customer as sender which is (i) not authorized and not effective as the order of the customer under Section 11202, or (ii) not enforceable, in whole or in part, against the customer under Section 11203, the bank shall refund any payment of the payment order received from the customer to the extent the bank is not entitled to enforce payment and shall pay interest on the refundable amount calculated from the date the bank received payment to the date of the refund.” Plaintiffs allege that they did not authorize the wire transfers. Compl. ¶¶ 38, 42. They also allege that the wire transfers were not effective under section 11202(b) because Defendant did not have a commercially reasonable security procedure. Id. ¶¶ 90(b), 91–105. “If a payment order was neither authorized nor verified pursuant to a commercially reasonable security procedure that the bank followed in good faith, the bank must bear the loss.” See 800 Columbia Project Co., LLC v. CMB Wing Lung Bank, Ltd., 2022 WL 17884221, at *6 (C.D. Cal. Sept. 19, 2022). Defendant argues that Plaintiffs have not alleged that the use of a security token to confirm authorization for an online transaction is commercially unreasonable or that Defendant failed to follow its security procedures in good faith. Mot. at 16. “Commercial reasonableness of a security procedure is a question of law to be determined by considering the wishes of the customer expressed to the bank, the circumstances of the customer known to the bank, including the size, type, and frequency of payment orders normally issued by the customer to the bank, alternative security procedures offered to the customer, and security procedures in general use by customers and receiving banks similarly situated.” Cal. Com. Code § 11202(c). Plaintiffs allege enough facts to support an inference at the pleading stage that Defendant’s security procedures were not commercially reasonable. For example, Plaintiffs allege that Defendant allowed twelve wire transfers to be completed in an hour, draining more than $300,000 from accounts that had never made a wire transfer before, and allege that, “[h]ad Defendant employed adequate security procedures and tools to effectively monitor and respond to anomalous account activity,” Defendant would have noticed this and frozen the accounts. Compl. ¶ 95. Plaintiffs also allege that Defendant had previously alerted Plaintiffs any time there was “anomalous or ahistorical account activity” in the last twenty years. Id. ¶¶ 15, 17, 98. The Court supports a plausible inference that these security procedures were commercially unreasonable.9 Whether this actually proves to be true is for a later stage of the case. Finally, Defendant argues that it cannot be liable under section 11204, because Plaintiffs provided their information to the imposter via the security key, and this provision only requires a bank to refund a wire transfer “if the customer proves that the order was not caused . . . by a person . . . who obtained, from a source controlled by the customer . . . information facilitating breach of the security procedure.”10 Mot. at 16–17 (quoting Cal. Com. Code § 11203(a)(2)). But that rule only applies to payment orders that are unauthorized under section 11202(a), but effective under section 11202(b). See Cal. Com. Code § 11203(a). As discussed above, Plaintiffs have plausibly pleaded that these payment orders are both unauthorized and ineffective, and section 11203(a)(2) does not apply. Accordingly, Defendant’s motion is DENIED with respect to the remainder of Plaintiffs’ California Commercial Code claim. iv. Violation of California Consumer Privacy Act (Claim Four) Defendant argues that Plaintiffs’ claim under the California Consumer Privacy Act (“CCPA”), Cal. Civ. Code §§ 1798 et seq., “do[es] nothing more than restate the statutory elements of a CCPA claim” and should be dismissed. Mot. at 18. The CCPA creates a cause of action for “[a]ny consumer whose nonencrypted and nonredacted personal information . . . is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business’ violation of the duty to implement and maintain reasonable security procedures and practices.” Cal. Civ. Code § 1798.150(a)(1). Plaintiffs allege that Defendant’s “failure to implement a reasonable security procedure to protect [Plaintiffs’] personal information, including their names, birth dates, and other security information . . . allowed either negligently hired employees or third-party actors to access sufficient information” to call Plaintiffs and access their bank accounts. Compl. ¶ 114. 9 These allegations are much more detailed than the conclusory allegations in Chen v. JPMorgan Chase Bank, N.A., 745 F. Supp. 3d 1025, 1032–33 (C.D. Cal. 2024), which Defendant relies on to support its argument. Mot. at 16. Courts are split on what is required to adequately plead that a defendant failed to maintain reasonable security procedures. See, e.g., Tian v. Bank of Am., N.A., No. 2:24-CV-09877-MCS- PD, 2025 WL 1377767, at *3 (C.D. Cal. Apr. 2, 2025) (collecting cases and dismissing claim); Doe v. MKS Instruments, Inc., No. SACV 23-00868-CJC (KESX), 2023 WL 9421115, at *3 (C.D. Cal. Nov. 3, 2023) (collecting cases and denying dismissal on these grounds). As Defendant notes, several courts have dismissed claims where “[p]laintiffs’ conclusory allegations . . . simply restate the statutory requirements,” even where the plaintiffs alleged that defendants did not monitor their systems to identify suspicious activity. Chen v. JPMorgan Chase Bank, N.A., 745 F. Supp. 3d 1025, 1033–34 (C.D. Cal. 2024); see also Anderson v. Kimpton Hotel & Rest. Grp., LLC, No. 19-CV-01860-MMC, 2019 WL 3753308, at *5 (N.D. Cal. Aug. 8, 2019). Other courts permit claims similar to Plaintiffs’ to survive. See Alexander v. Wells Fargo Bank, N.A., No. 23-CV-617- DMS-BLM, 2023 WL 5109532, at *2 (S.D. Cal. Aug. 9, 2023); Mehta v. Robinhood Fin. LLC, No. 21-CV-01013-SVK, 2021 WL 6882377, at *8 (N.D. Cal. May 6, 2021). Plaintiffs sufficiently identify the type of information that can be subject to an unauthorized access or exfiltration under the CCPA. Plaintiffs allege that either (1) their first and last name, account security code, and social security number, driver’s license number, or account number, see Cal. Civ. Code § 1798.81.5(d)(1)(A)(3); or (2) username or email address in combination with a password or security question and answer that permits access to an online account, see id. § 1798.150(a)(1), were improperly accessed or stolen. Compl. ¶¶ 109, 112. The Court can reasonably infer from Plaintiffs’ allegations that “Jason B.” knew about the Plaintiffs’ accounts and had already initiated allegedly fraudulent wire transfers when he called them, Compl. ¶¶ 29–43, 114, that he or his conspirators had access to this personal information. But Plaintiffs do not sufficiently allege that any access or exfiltration was the result of Defendant’s violation of the duty to implement and maintain reasonable security procedures. Plaintiffs assert that Defendant’s “failure to implement a security procedure” allowed Jason B. to access their accounts and initiate wire transfers, Compl. ¶ 114, but this allegation just restates the statutory elements of a CCPA claim. See Maag v. US Bank, Nat’l Ass’n, No. 21-CV-00031-H-LL, did not implement and maintain reasonable security procedures and practices, failed to effectively monitor its systems, and had lax security). Plaintiffs allege that they took “reasonable precautions” to protect their account access by “using passwords, and other security measures provided by Defendant,” Compl. ¶ 28, but they do not sufficiently allege that Jason B. accessed Plaintiffs’ personal information from Defendant, rather than from another source.11 Cf. Udo v. Wells Fargo Bank, N.A., No. 23-CV-02935-JSW, 2023 WL 8600791, at *3 (N.D. Cal. Dec. 12, 2023) (noting plaintiff only recited elements of the statute and failed to explain why the theft was not the result of his own action of losing his briefcase). Additionally, at least some cases denying dismissal of a CCPA claim did so only where the defendant had admitted there was a broad data breach, which is not alleged here. Cf. Mehta, 2021 WL 6882377, at *1. Plaintiffs argue that they adequately pleaded four facts that establish that unreasonable security procedures resulted in the data breach: (1) a Citibank phone number was able to be hacked by an “outside agent”; (2) Plaintiff was directed to call the “imposter” number one day later by Citibank’s actual fraud department; (3) Defendant’s agents “cannot explain the reason for possible infiltration”; and (4) Defendant allowed criminals to drain $600,000 from Plaintiffs’ accounts to banks in another state in less than a day without identifying or alerting Plaintiffs to any abnormal activity. Opp. at 28–29 (citing Compl. ¶¶ 29–34, 47, 51–52). Defendant correctly observes that none of these allegations are direct evidence that its security procedures for protecting personal information were deficient, see Reply at 15—only the allegations that the funds were depleted in a day without alert and that Jason B. was able to spoof a fraud phone number clearly implicate security procedures at all, and both of those allegations relate to the improper wire transfers rather than the alleged pre-transfer data breach. Given this, the Court DISMISSES Plaintiffs’ CCPA claim with leave to amend.
11 Plaintiffs allege that only Defendant knew that they had a security key. See Opp. at 27 (citing Compl. ¶ 24). Even if this were sufficient to overcome the other deficiencies, Plaintiffs’ CCPA theory appears to be that Defendant’s security procedures allowed Jason B. to access personal v. Violation of California Consumer Records Act (Claim Five) Defendant next moves to dismiss Plaintiffs’ California Consumer Records Act claim. Plaintiffs alleges that Defendant violated California Civil Code section 1798.81.5 “by failing to implement reasonable security procedures and practices to protect [Plaintiffs’] personal information.” Compl. ¶ 119. Defendant argues that it is exempt from this provision as a financial institution. Mot. at 18–19. Section 1798.81.5(e)(2) exempts “[a] financial institution as defined in Section 4052 of the Financial Code and subject to the California Financial Information Privacy Act.” Plaintiffs concede that financial institutions are exempt and do not dispute that Defendant qualifies. Opp. at 22. The Court thus DISMISSES this claim without leave to amend. Cf. Shah v. Cap. One Fin. Corp., 768 F. Supp. 3d 1033, 1049 (N.D. Cal. 2025) (dismissing similar claim without leave to amend); Chen v. JPMorgan Chase Bank, N.A., 745 F. Supp. 3d 1025, 1034 (C.D. Cal. 2024) (same). Plaintiffs also allege that Defendant violated California Civil Code section 1798.82(a) “by failing to notify Plaintiffs when [Defendant’s] security system was breached and that Plaintiffs’ personal data, which should have been encrypted by Defendant but which was not, was obtained by unauthorized persons.” Compl. ¶ 120. Defendant argues that Plaintiff has not adequately alleged that a security breach occurred or when Defendant first discovered the purported breach. Mot. at 19–20. Section 1798.82(a) requires businesses to “disclose a breach of the security of the system following discovery or notification of the breach . . . without unreasonable delay.” Cal. Civ. Code § 1798.82(a). Plaintiffs must plead a breach of security. See Shah, 768 F. Supp. 3d at 1050. Additionally, because these claims are actionable “for the harms resulting from unreasonably delayed notification, a plaintiff must state when a defendant learned of the relevant breach.” Chen, 745 F. Supp. 3d at 1034; Shah, 768 F. Supp. 3d at 1049–50. As it stands, Plaintiffs plead that “negligently hired employees or third-party actors [accessed] Plaintiff LSCC’s accounts . . . before ever speaking to Plaintiff [Kamrani].” Compl. ¶ 122. Plaintiffs do not dispute Defendant’s characterization and agree that they are required to plead specific facts “related to whether the unauthorized wire transfers constitute security breaches pursuant to Cal. Civ. Code § 1798.82(a)” and that “allege when Defendant became aware of the breaches.”12 Opp. at 22. The Court thus DISMISSES this claim with leave to amend. vi. Violation of UCL (Claim Six) Defendant argues that Plaintiffs do not sufficiently plead that they lack an adequate remedy at law. Mot. at 20. Defendant relies on the Ninth Circuit’s ruling in Sonner v. Premier Nutrition Corp, 971 F.3d 834 (9th Cir. 2020), which held that “federal courts must apply equitable principles derived from federal common law to claims for equitable restitution under” California’s Unfair Competition Law (“UCL”). Id. at 837. One established equitable principle is that equitable remedies will not be awarded when there is an “adequate remedy at law.” Id. at 842. “[T]he fundamental thing that Sonner, by its own terms, requires at the pleadings stage is that the complaint ‘allege that [the plaintiff] lacks an adequate legal remedy.’” Johnson v. Trumpet Behav. Health, LLC, No. 3:21-CV-03221-WHO, 2022 WL 74163, at *3 (N.D. Cal. Jan. 7, 2022) (quoting Sonner, 971 F.3d at 844). Courts differ as to what Sonner requires at the pleading stage. While some courts have required plaintiffs to articulate why damages are an inadequate remedy, other courts decline to mandate substantiation. Compare Watkins v. MGA Entertainment, Inc., 550 F. Supp. 3d 815, 837–38 (N.D. Cal. 2021), with Murphy v. Olly Pub. Benefit Corp., 651 F. Supp. 3d 1111, 1129 (N.D. Cal. 2023). This Court has recently held that explicitly alleging the absence of an adequate remedy at law is sufficient at the pleading state. Law. v. Homary Int’l Ltd., No. 24-CV-04113- HSG, 2025 WL 1571856, at *7 (N.D. Cal. June 2, 2025); see also Johnson, 2022 WL 74163, at *3 (“[I]f a plaintiff pleads that she lacks an adequate legal remedy, Sonner will rarely (if ever) require more this early in the case.”). Here, while Plaintiffs do not explain “why monetary damages would be inadequate to make [them] whole,” they do explicitly plead that they “lack[] an adequate remedy at law, as
12 This quote from Plaintiffs’ opposition is somewhat at odds with the allegations in the complaint, as the former implies the unauthorized wire transfers were the security breach, while the latter suggests the security breach (as in Plaintiffs’ CCPA claim) is what enabled Jason B. to initiate the actual damages cannot be recovered.” Compl. ¶ 138; Smith v. Apple, Inc., No. 21-CV-09527- HSG, 2023 WL 2095914, at *3 (N.D. Cal. Feb. 17, 2023). Such a statement would normally be sufficient at the pleading stage. Defendant disputes this by citing to this Court’s recent decision to dismiss an equitable claim in Lopez v. Mead Johnson Nutrition Co., No. 24-CV-03573-HSG, 2025 WL 895213 (N.D. Cal. Mar. 24, 2025), but the plaintiff there had not alleged that she lacked an adequate remedy at law or otherwise explained how an award of damages under any of her remaining claims would be inadequate. Id. at *6. Similarly, in Smith v. Apple, Inc., No. 21-CV- 09527-HSG, 2023 WL 2095914, at *3 (N.D. Cal. Feb. 17, 2023), the plaintiffs had sought equitable claims in the alternative, if there was no adequate remedy at law. Cf. Johnson, 2022 WL 741336, at *3 (similarly dismissing claims with purely conditional language). In contrast, Plaintiffs explicitly allege that they lack an adequate remedy at law. However, Plaintiffs specifically plead that they lack an adequate remedy at law because “actual damages cannot be recovered,” citing Bank of the West v. Superior Court, 2 Cal. 4th 1254, 1266 (1992). Compl. ¶ 138. That citation states that damages are not available under the UCL. But the relevant inquiry considers the other causes of action that Plaintiffs have available. See Guzman v. Polaris Indus. Inc., 49 F.4th 1308, 1313 (9th Cir. 2022) (“Sonner’s holding applies to equitable UCL claims when there is a viable CLRA damages claim . . . .”). Because Plaintiffs have chosen to clearly articulate their basis for concluding that there is no adequate remedy at law, and because the Court can determine that this basis is defective as a matter of law, these allegations are insufficient. Moreover, the Court must dismiss this claim for lack of standing. Plaintiffs only seek injunctive relief under the UCL. Compl. at 36–37. To have standing to seek injunctive relief under Article III, a plaintiff must “demonstrate a real and immediate threat of repeated injury in the future.” Chapman v. Pier 1 Imports (U.S.) Inc., 631 F.3d 939, 946 (9th Cir. 2011) (quotation omitted). So once a plaintiff has been wronged, they are entitled to injunctive relief only if they can show that they face a “real or immediate threat . . . that [they] will again be wronged in a similar way.” Mayfield v. United States, 599 F.3d 964, 970 (9th Cir. 2010) (quotation omitted). Citibank. But Plaintiffs have not alleged anything about their current relationship with Defendant or what specific injunctive relief they seek from which the Court can determine that Plaintiffs face a risk of future injury. The Court thus DISMISSES the UCL claim with leave to amend.13 vii. Negligent Hiring (Claim Seven) Defendant argues that Plaintiffs fail to allege that Citibank hired an unfit employee or that it knew or should have known that it created a risk or hazard by hiring a particular employee. See Mot. at 23–24. Plaintiffs concede that they have failed to state a claim for negligent hiring. Opp. at 32. The Court DISMISSES this claim with leave to amend. Defendant’s motion to dismiss, Dkt. No. 13, is GRANTED IN PART and DENIED IN PART. The Court DENIES the motion with respect to Plaintiffs’ claims for intentional misrepresentation (Count Two) and violation of California Commercial Code section 11204 (Count Three). The Court GRANTS the motion with respect to the remainder of the claims. All claims are dismissed WITH LEAVE TO AMEND, except Plaintiffs’ claims under California Civil Code section 1798.81.5 and California Commercial Code sections 11201(b), 11205. Any amended complaint must be filed within 21 days of the date of this order, and may not add any new claims or defendants. The Court further SETS a case management conference on December 9, 2025 at 2:00 p.m. The hearing will be held by Public Zoom Webinar. All counsel, members of the public, and media may access the webinar information at https://www.cand.uscourts.gov/hsg. All attorneys and pro se litigants appearing for the case management conference are required to join at least 15 minutes before the hearing to check in with the courtroom deputy and test internet, video, and audio capabilities. The parties are further DIRECTED to file a joint case management statement by December 2, 2025. // // 2 Dated: 11/10/2025 3 Alayerl 5 HAYWOOD S. GILLIAM, JR. 4 United States District Judge 5 6 7 8 9 10 1] as 12
13 «14
Oo Z 18 19 20 21 22 23 24 25 26 27 28