Mohamed v. Bank of America N.A.

• Court: District Court, D. Maryland
• Decided: August 11, 2022
• Docket: 1:21-cv-01283
• Status: Unknown

Opinion

‘ IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF MARYLAND

YAGOUB M. MOHAMED, Individually and on Civil Action No. CCB-21-1283 behalf of all others similarly situated V. . BANK OF AMERICA, N.A., ef al.

. MEMORANDUM Yagoub M. Mohamed was eligible for unemployment benefits during the COVID-19 pandemic, but he lost access to nearly $15,000 in those benefits when an unauthorized user fraudulently used the Bank of America prepaid debit card that was meant to deliver his funds. He brought claims (ECF 1) against the Bank for violation of the federal Electronic Fund Transfer Act, violations of state privacy and consumer protection laws, and common-law breach of contract and negligence. He brought those claims individually and on behalf of a putative class of Maryland residents who were issued Bank of America prepaid debit cards for unemployment benefits. Bank of America filed a motion to dismiss (ECF 18), which Mohamed opposed (ECF

_ 22) and Bank of America supported in its reply (ECF 23). The issues have been briefed, and oral argument was held June 9, 2022. For the following reasons, the motion to dismiss will be granted as to Count One, for violation of the Electronic Fund Transfer Act. The court will decline to exercise supplemental jurisdiction over the remaining state law claims, which will therefore be dismissed without prejudice.

. 1

BACKGROUND In ruling.on a motion to dismiss,.this court “accept[s] as true all well-pleaded facts in a complaint and construe[s] them in the light most favorable to the plaintiff.” Wikipedia Found. v. □ Nat'l Sec. Agency, 857 F.3d 193, 208 (4th Cir. 2017) (citing SD3, LLC Black & Decker (U.S.) Inc., 801 F.3d 412, 422 (4th Cir. 2015)). Mohamed’s Experience Yagoub M. Mohamed was a mechanic and small business owner who suddenly lost his business (and significant income) in July 2020 due to the COVID-19 pandemic. That month, he

_ applied for unemployment benefits. While self-employed individuals might not normally have been eligible for state unemployment insurance, federal supplemental programs like Pandemic Unemployment Assistance (PUA) benefits also were administered by the Maryland state Division of Unemployment Insurance (DUI), an office of the state Department of Labor.’

_ Though Mohamed had the option to receive his disbursements via paper check, he signed up to receive his benefits on a Bank of America DUI Debit Card? that was to be mailed to his Baltimore home address. The Complaint is silent as to Mohamed’s decision calculus at the time. Between July and October 2020, Mohamed was entitled to receive $14,644 in benefits, but he had still not received his DUI Debit Card by the end of November 2020. He had called the

. DUI office regularly during those months, but DUI representatives advised him that he might experience a 45- or 90-day delay due to the high applicant volume. When he called in late November 2020, the representative advised that Mohamed should have already received the card, -

' Mohamed stated in his response brief that he “believes he received UI benefits [as opposed to PUTA benefits], but awaits proof from the Division of Unemployment Insurance (‘DUI!’).” (ECF 22, Opp. at 6). He has offered no proof of this assertion. . 2 As discussed below, the state DUI contracted with Bank of America, North America (BANA, or the Bank) to administer prepaid debit cards for its benefit recipients. ;

which would have been mailed by Bank of America, North America (BANA). He then called BANA, whose representative told him that the Bank had already mailed his card and that BANA □ would mail a new card. Around December 5, 2020, Mohamed received the DUI Debit Card. But when he tried to

activate the card, the activation code did not work. He called the customer service line and learned the card had a $0 balance. He waited a few days to give the Bank an opportunity to finish setup, and he called back on December 7, 2020; the Bank’s representative told him that although the account had received the full $14,644 disbursement, the funds from his account had already been spent. A Claims Department representative read aloud each transaction to Mohamed, who confirmed that he had not made or authorized any of them. Between August 20 and October 1 of that year, an unauthorized user had bought goods and made withdrawals in a wide range of locations, from Towson, Maryland, to Hollywood, California. None of the transactions were familiar, nor did Mohamed know who had made them. . After receiving a claim number from the Bank, Mohamed filed a police report and provided that information to BANA’s Claims Department as requested. The Claims Department told him he would receive a letter from BANA within 45 days. From late December into January, Mohamed called the Bank weekly and then daily to inquire about his claim; representatives told =

him to call back, or he received messages stating the office was too busy to accept his call. Without any financial resources, Mohamed maxed out his business and personal credit cards. He incurred late fees, sending his credit score from 750 to 500, and he fell behind on his monthly payments. He struggled with depression, sleeplessness, and stress-induced vomiting. On December 27, he experienced a panic attack exacerbated by exhaustion and dehydration, requiring an urgent care visit.

3 .

Around January 5, 2021, Mohamied received a Freeze Letter (ECF 1-5, Exhibit 3) from BANA, a letter BANA sent to Maryland DUI recipients who had filed fraud claims. The letter observed that BANA had determined there might be unauthorized activities involved with his card, so his account had been frozen. When he logged into his account, he saw a new identification verification requirement, which he satisfied. About a month later, on February 3, the Bank emailed him to notify him of a $1,050 deposit into his account. While his account had been frozen, the Bank had stopped processing his fraud claim. Mohamed and other similarly affected unemployment insurance claimants who experienced fraud received confusing, conflicting messaging from the Bank and DUI about who was responsible for account freezes.

Continued calls to the Bank through the rest of February yielded little meaningful assistance. On March 3, he received an Update-Letter (ECF 1-6, Exhibit 4) stating that the freeze had been lifted and his card was active once again. Again, he received mixed messages about his fraud claim and whether it remained active or was eligible for reconsideration. When Mohamed filed this lawsuit in late May of 2021, BANA had not given him either a provisional or permanent credit for his $14,644 in lost unemployment funds, though he had

received notice from the State requiring him to pay taxes on the full amount. On June 25, 2021, the Bank informed Mohamed that it would credit him the full amount. (ECF 18-2, Daniels Decl. { 5). The Bank filed its motion to dismiss on August 2, 2021. Bank of America and the Maryland Division of Unemployment Insurance Well before the pandemic, Bank of America contracted with DUI to administer prepaid debit cards for electronic payment of unemployment insurance benefits. The 2013 Request for Proposal stated that it sought a disbursement solution to “ensure cardholders receive the UI benefits to which they are entitled, efficiently, timely, accurately, and securely.” (ECF 1 § 15).

The RFP? required the contractor to have in place reasonable security procedures and to make sure information about cardholders and their accounts is secured to ensure its confidentiality. It also included provisions that DOL would not indemnify the Contractor (eventually, the Bank) for any claims or losses arising out of the Contract and requiring that the Contractor indemnify and hold harmless DOL. In 2013, Bank of America accepted the contract with DUI, and Mohamed incorporates that state contract into the complaint by reference. (ECF 1 4 19; ECF 1-3, Exhibit 1, Contract). The RFP and Contract also required information about fraud detection and prevention services. Bank of America also published a separate webpage tailored to Maryland UI debit cardholders. Cardholders were subject to a Bank of America Cardholder Agreement (“Account Agreement’) that contained several relevant provisions. (ECF 1-4, Ex. 2, Cardholder Agreement). First, it contained BANA’s “Zero Liability” Policy for Unauthorized Transactions, a- policy that limits a cardholder’s liability for unauthorized transactions to the amount of the transaction, so long as the cardholder notifies BANA within a reasonable time. The policy specifies that even if the claim does not meet the Zero Liability conditions, the cardholder still retains their consumer rights under federal law:

_ Your Rights under Regulation E. If your claim does not meet the prescribed conditions for reimbursement under the above policy, you still retain any consumer rights you may have under Regulation FE, as described in Sections 10 and 11 below, and we will automatically re-examine the claim in accordance with those rights. (ECF 1-4, Ex. 2, Cardholder Agreement at 8).

> Request for Proposals for Electronic Payment Card Services for Department of Labor, Licensing and Regulation, Division of Unemployment Insurance, RFP #-DLLR-EPC-01172013.” (“RFP”) at 13 4 3.05.5, https://www.treasurer.state.md.us/media/52202/dllr_epc_01172013_rfp.pdf, (last accessed Aug. 1, 2022) (“Contractor must have in place reasonable security procedures . . .”).

That federal law is the subject of the second relevant provision. The Zero Liability policy refers to Regulation E, a federal regulation that implements the Electronic Fund Transfer Act and is administered by the Consumer Finance Protection Bureau. This law and its regulation concem dispute resolution for certain accounts. The Account Agreement outlined Bank of America’s dispute resolution services: BANA would determine whether there was an error within 10 days □

and correct it promptly. If they need more time, however, they could take up to 45 days to investigate, in which case they would provisionally credit the disputed amount within 10 days so

the Cardholder would have the money during the investigation. BANA would reveal the results within three days of completing the investigation. ~ The DUI announced in 2021 that it would move away from Bank of America prepaid debit cards in favor of a new contract for direct deposit through Wells Fargo. Card Technologies _ The nature of the Bank of America debit cards is particularly noteworthy here. □ Mohamed’s card — like all other UI debit cardholders’ but unlike the Bank’s non-UI debit cardholders’ — featured a magnetic stripe and no EMV.chip. EMV chips are an anti-fraud technology that have become more common over time as the industry standard for card security. Magnetic stripes encode user information, like the cardholder’s name, card number, and card expiration date, but magnetic stripes are highly susceptible to fraud. While EMV chip cards also a magnetic stripe, their stripes are two-way and are encoded in a more sophisticated fashion. Bank of America’s website assures cardholders of their cards’ security. The Class Action . Mohamed was not the only Maryland unemployment claimant to experience fraud. In July 2020, the DOL uncovered a criminal enterprise involving 47,500 fraudulent employment

6 .

claims using identity theft totaling over $501 million, where many claimants believe their debit cards were cloned. He brings his suit individually and as a proposed class action, seeking damages on behalf of a class defined as follows:

All Maryland Residents who were issued or who used a Bank of America debit card for the purpose of accessing DUI benefits deposited into a Bank of America account, at any time within three years prior to the filing of this complaint through the present (“Class Period”). . □ LEGALSTANDARD To survive a motion to dismiss, the factual allegations of a complaint “must be enough to raise a right to relief above the speculative level on the assumption that all the allegations in the complaint are true (even if doubtful in fact).” Bell Atlantic Corp. □ Twombly, 550 U.S. 544, 555 (2007) (internal citations omitted), “To satisfy this standard, a plaintiff need not ‘forecast’ evidence sufficient to prove the elements of the claim. However, the complaint must allege sufficient facts to establish those elements.” Walters v. McMahen, 684 F.3d 435, 439 (4th Cir. 2012) (citation omitted). “Thus, while a plaintiff does not need to demonstrate in a complaint that the right to relief is ‘probable,’ the complaint must advance the plaintiff's claim ‘across the line from conceivable to plausible.”” Id. (quoting Twombly, 550 U.S. at 570). Additionally, although courts “must view the facts alleged in the light most favorable to the plaintiff,” they “will not accept ‘legal conclusions couched as facts or unwarranted inferences, unreasonable conclusions, or arguments’” in deciding whether a case should survive a motion to dismiss. U.S. ex rel. Nathan v. Takeda Pharm. North Am., Inc., 707 F.3d 451, 455 (4th Cir. 2013) (quoting Wag More Dogs, LLC v. Cozart, 680 F.3d 359, 365 (4th Cir. 2012)),

ANALYSIS I. Violations of EFTA (Count I) Mohamed alleges that the Bank violated the Electric Fund Transfer Act, and this claim is the only federal claim in his lawsuit. The Electronic Fund Transfer Act (EFTA)isaconsumer’ protection statute that regulates the terms of certain transactions. 15 U.S.C. § 1693 ef. seq. The purpose of the EFTA is to establish “individual consumer rights” in the context of electronic fund transfer (EFT) transactions. Jd. § 1693(b). Accordingly, the EFTA is a remedial consumer protection standard that courts read “liberally” to achieve the goal of protecting consumers. Curtis v. Propel Property Tax Funding, LLC, 915 F.3d 234, 239 (4th Cir. 2019) (citations omitted). Regulation E implements the EFTA. 12 C.F.R. §§ 1005.1-1005.20.

BANA concedes that if Regulation E applies to this case, then Mohamed has a claim at least for statutory penalties, but according to BANA, Regulation E does not apply, primarily because Mohamed received pandemic unemployment assistance rather than traditional unemployment insurance. BANA argues that the EFTA’s and Regulation E’s definition of a covered “account” excludes various types of prepaid accounts, including those established by a bank and loaded with government disaster funds. BANA offers the following analysis: 1. For the EFTA to apply, Mohamed’s account must qualify as an account under the EFTA’s definition of “account,” which refers to the regulations of the Consumer Financial Protection Bureau. EFTA, 15 U.S.C. § 1693a(2). 2. The relevant CFPB regulations defines “account” to include a prepaid account. 12 C.F.R. 1005.2(b)(3). But for the purposes of paragraphs (b)(3)(i)(C) and (D) of the regulation, the term “prepaid account” excludes any “account that is directly or indirectly established

through a third party and loaded only with qualified disaster relief payments[.]” 12 C.F.R. § 1005.2(b)(3)(ii)(B). □ 3. As the CFPB officially interprets the regulation, “[flor purposes of § 1005.2(b)(3)Gi)(B),

. ‘qualified disaster relief funds? means funds made available through a qualified disaster relief program as defined in 26 U.S.C. 139(b).” Official Interpretation of Paragraph 2(b)(3)(ii) at J 2, Interactive Bureau Regulations / 12 CFR Part 1005 (Regulation E) / § ‘ 1005.2 Definitions, Consumer F ‘nancial Protection Bureau, available at https://www.consumerfinance. gov/rules-policy /regulations/ 1005/2/ (last accessed

July 29, 2022). 4, The Internal Revenue Code, 26 US.C. § 139(b), defines a qualified disaster relief payment as “any amount paid to or for the benefit of an individual . . . if such amount is paid by a Federal, State, or local government, or agency or instrumentality thereof, in connection with a qualified disaster in order to promote the general welfare[.]” 26 U.S.C. § 139(b)(4). . 5. The Internal Revenue Code goes on to define “qualified disaster” as “a federally declared disaster (as defined in section 165(i)(5)(A)).” 26 U.S.C. § 139(c)(2). 6. Under § 165, a federally qualified disaster means “any disaster subsequently determined by the President of the United States to warrant assistance by the Federal Government _under the Robert T. Stafford Disaster Relief and Emergency Assistance Act” 26 USC. §

165(i)(5)(A). 7. President Trump declared on March 13, 2020, that the COVID-19 pandemic was a disaster warranting federal assistance. Letter from Pres. Donald J. Trump on Emergency Determination Under the Stafford Act (Mar. 13, 2020),

https://trumpwhitehouse.archives. gov/briefings-statements/letter-president-donald-j- trump-emergency-determination-stafford-act/ (last accessed Mar. 11, 2022). 8. Congress created Pandemic Unemployment Assistance in the CARES Act in late March 2020. PUA provided federally financed unemployment benefits to non-employees (including business owners, gig workers, etc.) like Mohamed. 9. Mohamed’s card was established through a third party (BANA) and loaded with only qualified disaster relief payments (PUA and no regular state unemployment insurance,. because Mohamed did not qualify for regular Maryland UJ). Therefore, his account is excluded from the definition of “prepaid account.” BANA’s argument hinges on step two, which excludes certain accounts from the definition of “prepaid account” under 12 C.F.R. § 1005.2(b)(3)Gi)(B) — specifically, accounts both established through a third party and loaded only with qualified disaster relief payments. The parties debate whether Mohamed’s PUA account is a “prepaid account” covered under EFTA or whether it is carved out of the definition of “prepaid account” according to step two — that is, Regulation E’s exclusion of any “account that is directly or indirectly established - through a third party and loaded only with qualified disaster relief payments.” 12 C.F.R. § 1005.2(b)(3)(4i)(B). If the PUA payments are qualified disaster relief payments, then Mohamed’s account is carved out of the definition of “prepaid account” under EFTA, and he cannot bring his federal EFTA claim. Mohamed argues that, while the pandemic was in March 2020 declared by President Trump a disaster warranting federal assistance under the Stafford Act, PUA payments were actually authorized by Congress in the CARES Act for the “COVID-19 public health emergency” rather than a disaster. Specifically, it was tied initially to the public health

emergency declared by the Secretary of Health and Human Services in January 2020 rather than

the March 2020 disaster declaration by President Trump. 15 U.S.C. §§ 9021(a)(2) (defining “COVID-19 public health emergency” in terms of the January 2020 HHS declaration), (c)(1)(A) . (making PUA available beginning the same date as the January 2020 HHS declaration rather

_ than the March 2020 presidential declaration). According to Mohamed, the CARES Act showed a Democratic House and Senate explicitly acting separately from President Trump and not tying their measures to his prospective declaration. The Internal. Revenue Code, however, favors BANA’s argument. A qualified disaster relief payment is “any amount paid to or for the benefit of an individual ...1f such amount is paid by a Federal, State, or local government, or agency or instrumentality thereof, in connection with a qualified disaster in order to promote the general welfare[.]” 26 U.S.C. § 139(b)(4)

(emphasis added). A “qualified disaster” is a “federally declared disaster,” 26 U.S.C. § 139(c)(2),

which is “any disaster subsequently determined by the President of the United States to warrant assistance by the Federal Government under the Robert T. Stafford Disaster Relief and Emergency Assistance Act.” 26 U.S.C. § 165(i)(5)(A) (emphasis added). Even if the CARES Act was tied initially to the January 2020 HHS declaration, the CARES Act nonetheless referred to the pandemic itself, which was subsequently declared a disaster warranting Stafford Act assistance. The pandemic is therefore a “federally qualified disaster” under 26 U.S.C. § 165(i)(5)(A) and a “qualified disaster” under IRC § 139(c)(2), meaning PUA payments were “qualified

* Mohamed also points to 15 U.S.C. § 9021(h), which specifies that 20 C.F.R. § 625’s Stafford disaster unemployment assistance regulations should apply to § 9021 PUA as if “COVID-19 public health emergency” and “pandemic” were substituted for “major disaster” and “disaster” in the regulation. Mohamed urges a reading of this provision that Congress specifically chose pandemic language rather than Stafford disaster language in the □ CARES Acct, but it may also be read to show the interchangeability of the two. 11

disaster relief payments” under IRC § 139(b)(4). The payments therefore satisfy the CFPB’s official interpretation of Regulation E § 1005.2(b)(3)(ii)(B) and are excluded from the definition of “prepaid account,” therefore falling outside of EFTA’s definition of covered “accounts,” 15 U.S.C. § 1693a(2). Count I must therefore be dismissed. II. State Law Claims To the extent Mohamed alleges BANA has violated state law in counts II-VI, the court declines to exercise supplemental jurisdiction and will dismiss the state claims without prejudice.° See 28 U.S.C. § 1367(c)(3) (district court may decline to exercise supplemental jurisdiction over state law claims when “the district court has dismissed all claims over which it has original jurisdiction.”); see also Carnegie-Mellon Univ. v. Cohill, 484 U.S. 343, 350 (1988). CONCLUSION For the reasons discussed herein, Bank of America, N.A.’s motion to dismiss will be granted. A separate Order follows.

22 C To Dat Catherine C. Blake United States District Judge

5 Mohamed therefore may present his claims in the appropriate state forum. 12