Case 3:21-cv-00376-JCS Document 1 Filed 01/14/21 Page 1 of 67
`
`
`
`BRIAN DANITZ (SBN 247403)
`bdanitz@cpmlegal.com
`NOORJAHAN RAHMAN (330572)
`nrahman@cpmlegal.com
`ANDREW F. KIRTLEY (SBN 328023)
`akirtley@cpmlegal.com
`JULIA Q. PENG (SBN 318396)
`jpeng@cpmlegal.com
`COTCHETT, PITRE & McCARTHY, LLP
`840 Malcolm Road, Suite 200
`Burlingame, CA 94010
`Telephone: (650) 697-6000
`Fax: (650) 697-0577
`
`Attorneys for Plaintiff and
`the Proposed Class
`
`
`UNITED STATES DISTRICT COURT
`
`FOR THE NORTHERN DISTRICT OF CALIFORNIA
`
`
`JENNIFER YICK, on behalf of herself
`and all others similarly situated,
`
`
`Plaintiff,
`
`
`v.
`
`BANK OF AMERICA, N.A., and
`DOES 1-20, inclusive,
`
`
`Defendants.
`
`
`
`
`Case No.
`
`CLASS ACTION COMPLAINT:
`
`
`1. Violations of California Consumer
`Privacy Act
`
`2. Violations of California Unfair
`Competition Law
`
`3. Violations of Electronic Funds
`Transfer Act (15 U.S.C. § 1693 et seq.)
`
`4. Negligence
`
`5. Negligent Performance of Contract
`
`6. Negligent Failure to Warn
`
`7. Breach of Contract
`
`8. Breach of Implied Contract
`
`9. Breach of the Implied Covenant of
`Good Faith and Fair Dealing
`
`10. Breach of Contract (Third-Party
`Beneficiaries)
`
`DEMAND FOR JURY TRIAL
`
`
`
`
`Class Action Complaint
`Yick v. Bank of America, N.A.
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`

`

`Case 3:21-cv-00376-JCS Document 1 Filed 01/14/21 Page 2 of 67
`
`
`
`
`TABLE OF CONTENTS
`
`I.
`
`INTRODUCTION ................................................................................................................ 1
`
`1
`
`2
`
`3
`
`II.
`
`JURISDICTION AND VENUE .......................................................................................... 4
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`III.
`
`PARTIES ............................................................................................................................... 4
`
`A. Plaintiff ............................................................................................................................. 4
`
`B. Defendant ......................................................................................................................... 5
`
`C. Doe Defendants ................................................................................................................ 5
`
`D. Aiding And Abetting, Concert Of Action ........................................................................ 5
`
`IV.
`
`FACTUAL ALLEGATIONS .............................................................................................. 5
`
`A. Bank of America’s Contract with EDD ........................................................................... 5
`
`B. Bank of America’s Failure to Secure EDD Account Information ................................... 6
`
`C. Bank of America’s Use of Outdated, Vulnerable Magnetic Stripe Technology .............. 7
`
`D. Bank of America’s Promise of “Zero Liability” and “24/7” Customer Service .............. 9
`
`E. Economic Devastation and Unemployment During the Covid-19 Pandemic ................ 11
`
`F. Rampant Fraud on EDD Cards and Accounts ................................................................ 12
`
`G. Bank of America’s Evasive and Ineffective Response .................................................. 13
`
`H. Plaintiff’s Maddening Experience of Trying to Reach Bank of America ...................... 15
`
`V.
`
`CLASS ACTION ALLEGATIONS .................................................................................. 18
`
`17
`
`VI.
`
`CAUSES OF ACTION ....................................................................................................... 21
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`FIRST CAUSE OF ACTION
`
` Violation of the California Consumer Privacy Act ............................................................. 21
`
`SECOND CAUSE OF ACTION
`
` Violations of California’s Unfair Competition Law ........................................................... 23
`
`THIRD CAUSE OF ACTION
`
` Violations of the Electronic Funds Transfer Act ................................................................ 25
`
`FOURTH CAUSE OF ACTION
`
` Negligence .......................................................................................................................... 28
`
`FIFTH CAUSE OF ACTION
`
` Negligent Performance of Contract .................................................................................... 30
`
`- i -
`Class Action Complaint
`Yick v. Bank of America, N.A.
`
`

`

`Case 3:21-cv-00376-JCS Document 1 Filed 01/14/21 Page 3 of 67
`
`
`SIXTH CAUSE OF ACTION
`
`
`
` Negligent Failure to Warn .................................................................................................. 31
`
`SEVENTH CAUSE OF ACTION
`
` Breach of Contract .............................................................................................................. 32
`
`EIGHTH CAUSE OF ACTION
`
` Breach of Implied Contract ................................................................................................. 33
`
`NINTH CAUSE OF ACTION
`
` Breach of Implied Covenant of Good Faith and Fair Dealing ............................................ 36
`
`TENTH CAUSE OF ACTION
`
` Breach of Contract (Third-Party Beneficiaries) .................................................................. 37
`
`PRAYER FOR RELIEF ................................................................................................................ 38
`
`JURY DEMAND ............................................................................................................................ 39
`
`- ii -
`Class Action Complaint
`Yick v. Bank of America, N.A.
`
`
`
`
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`

`

`Case 3:21-cv-00376-JCS Document 1 Filed 01/14/21 Page 4 of 67
`
`
`
`1
`
`
`Plaintiff Jennifer Yick (“Ms. Yick” or “Plaintiff”), on behalf of herself and all others similarly
`
`2
`
`situated, alleges the following facts and claims against Defendant Bank of America, N.A. (“Bank of
`
`3
`
`America” or “Defendant”), relating to the company’s administration of California unemployment
`
`4
`
`insurance and other benefits. The allegations pertaining to Ms. Yick are based on personal
`
`5
`
`knowledge, and the allegations pertaining to all other matters are based on information and belief,
`
`6
`
`including investigations by her counsel and information learned from news reports. Plaintiff’s
`
`7
`
`investigation into the matters alleged herein is ongoing, and many relevant facts are known only to
`
`8
`
`Defendant and/or are exclusively within Defendant’s custody and control. Plaintiff believes that
`
`9
`
`substantial additional evidentiary support will exist for the allegations set forth herein after a
`
`10
`
`reasonable opportunity for discovery.
`
`11
`
`I.
`
`INTRODUCTION
`
`12
`
`1.
`
`Faced with the economic devastation of the Covid-19 pandemic, millions of
`
`13
`
`Californians now rely on unemployment insurance and other benefits issued by the California
`
`14
`
`Employment Development Department (“EDD”). For unemployed Californians struggling to
`
`15
`
`survive, these EDD benefits provide a lifeline that allow them to pay for basic necessities until they
`
`16
`
`find that next job. Despite the critical importance of EDD benefits, the financial institution with the
`
`17
`
`exclusive contract to administer them—Bank of America—is either unwilling or unable to stop
`
`18
`
`criminals from breaching Bank of America’s systems and controls, and from siphoning off millions
`
`19
`
`of dollars of EDD benefits one account at a time. Day after day, there are new stories of yet another
`
`20
`
`EDD benefits recipient with a Bank of America EDD prepaid debit card (an “EDD cardholder”)
`
`21
`
`who went to use their card only to discover that all
`
`22
`
`the money in their Bank of America EDD account
`
`23
`
`(“EDD account”)—oftentimes, the only money
`
`24
`
`that they had to survive—was suddenly gone.
`
`25
`
`2.
`
`Many defrauded EDD cardholders
`
`26
`
`have called Bank of America customer service,
`
`27
`
`desperate to figure out what is going on and how
`
`28
`
`
`
`- 1 -
`Class Action Complaint
`Yick v. Bank of America, N.A.
`
`

`

`Case 3:21-cv-00376-JCS Document 1 Filed 01/14/21 Page 5 of 67
`
`
`
`
`they can get the money credited back to their account ASAP. But “ASAP” is not how Bank of
`
`1
`
`2
`
`America customer service operates—at least not for EDD cardholders. In the words of one EDD
`
`3
`
`cardholder and a victim of the fraud:
`
`4
`
`5
`
`6
`
`7
`
`8
`
`“It’s kind of like a nightmare. . . . Every day I’m wondering what’s more
`important. Do I get on the phone with the bank and try again so I have a place to
`sleep tomorrow, or do I just accept that I’m going to be on the street and focus
`on my job search? Because you can’t do both.”
`
`– EDD cardholder and fraud victim1
`
`3.
`
`Even Bank of America’s own customer service representatives have voiced
`
`9
`
`frustration at being unable to tell defrauded EDD cardholders that help is on the way. As one
`
`10
`
`customer service agent recently stated:
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`We’re actually no longer allowed to tell them [defrauded EDD cardholders] a
`timeframe, because we have no clue . . . . Every day, I talk to 30 people with the
`same story. I just pray for them after my shift, honestly.
`
`
`
`– Bank of America customer service representative2
`
`And so defrauded EDD cardholders wait and they wait on Bank of America. And when they run out
`
`of money, they just have to wait some more.
`
`4.
`
`According to its own EDD cardholder agreement, Bank of America has a “Zero
`
`Liability” policy for cardholders in precisely this kind of situation. But contrary to that binding
`
`policy, Bank of America has failed to assist or even communicate with many of the countless
`
`defrauded EDD cardholders. Bank of America’s ineffectual response to the rampant fraud has taken
`
`various forms, including not answering the customer service phone lines it advises EDD debit
`
`cardholders to call; opening claims and then closing them so soon thereafter such that a full review
`
`could not have been done; crediting funds and then later debiting them without notice to the EDD
`
`cardholder; failing to extend provisional credit to EDD cardholders as required by law; and freezing
`
`
`1 Lauren Hepler & Stephen Council, “How Bank of America Helped Fuel California’s
`Unemployment Meltdown,” CalMatters (Nov. 20, 2020), available at https://calmatters.org
`/economy/2020/11/how-bank-of-america-helped-fuel-californias-unemployment-meltdown/.
`
`28
`
`2 Id.
`
`
`
`- 2 -
`Class Action Complaint
`Yick v. Bank of America, N.A.
`
`

`

`Case 3:21-cv-00376-JCS Document 1 Filed 01/14/21 Page 6 of 67
`
`
`
`
`EDD accounts unaffected by fraud. Pursuant to its exclusive agreement with the State of California,
`
`1
`
`2
`
`Bank of America is solely responsible for the administration of EDD benefits, and the EDD has no
`
`3
`
`ability to intervene in the company’s procedures.
`
`4
`
`5.
`
`As many people familiar with the situation say, the widespread fraud could easily
`
`5
`
`have been prevented if Bank of America had acted according to industry security standards by
`
`6
`
`securing the private financial information of EDD cardholders and accounts, and by issuing EDD
`
`7
`
`cards with “EMV chips,”3 rather than issuing cards with only outdated, fraud-prone “magnetic
`
`8
`
`stripe” technology. Since 2014 Bank of America has used the small, metallic EMV chips in its
`
`9
`
`consumer debit cards, touting the technology as “an important tool in increasing card security.”
`
`10
`
`Rather than using chips in its EDD cards, however,
`
`11
`
`Bank of America opted to issue hundreds of thousands
`
`12
`
`of EDD cards with magnetic stripe technology, which
`
`13
`
`when used at payment terminals openly transmit
`
`14
`
`sensitive card and account information and leave
`
`15
`
`cardholders vulnerable to fraud.
`
`16
`
`6.
`
`By failing to safeguard state benefits from fraud, failing to detect the fraud as it was
`
`17
`
`happening, and failing so spectacularly at resolving the issues caused by these failures, Bank of
`
`18
`
`America has violated the California Consumer Privacy Act, California’s Unfair Competition Law,
`
`19
`
`and Regulation E of the federal Electronic Funds Transfer Act; has breached its contract with EDD
`
`20
`
`cardholders; has negligently failed to warn EDD cardholders about the risks associated with its EDD
`
`21
`
`cards and accounts; and has negligently performed its contract with the California EDD, among
`
`22
`
`other violations of law. Bank of America’s unlawful conduct has resulted in significant harm to
`
`23
`
`recipients of EDD benefits, depriving them of their financial lifeline in the midst of a pandemic and
`
`24
`
`full-blown economic crisis.
`
`25
`
`26
`
`27
`
`28
`
`
`
`
`3 “EMV” stands for Europay, Mastercard, and Visa, after the companies that created the technology.
`- 3 -
`Class Action Complaint
`Yick v. Bank of America, N.A.
`
`

`

`Case 3:21-cv-00376-JCS Document 1 Filed 01/14/21 Page 7 of 67
`
`
`
`1
`
`II.
`
`
`JURISDICTION AND VENUE
`
`2
`
`7.
`
`This Court has subject matter jurisdiction over this action pursuant to each of the
`
`3
`
`following: (a) 28 U.S.C. § 1332(d) because this is a class action in which the amount in controversy
`
`4
`
`for the Class exceeds $5,000,000 exclusive of interest and costs, there are more than 100 putative
`
`5
`
`Class members as defined below, and minimal diversity exists because the majority of putative Class
`
`6
`
`members are citizens of a state different than that of Bank of America; (b) 28 U.S.C. § 1332(a)
`
`7
`
`because Plaintiff and Class members are citizens of California, Bank of America is incorporated
`
`8
`
`under the laws of Delaware and has its principal place of business in North Carolina, and the amount
`
`9
`
`in controversy exceeds $75,000 exclusive of interests and costs; and (c) 28 U.S.C. § 1331 with
`
`10
`
`respect to the cause of action arising under federal Electronic Funds Transfer Act (15 U.S.C. § 1693,
`
`11
`
`et seq.), and 28 U.S.C. § 1367 with respect to the causes of action arising under state law.
`
`12
`
`8.
`
`This Court has specific personal jurisdiction over Bank of America because Bank of
`
`13
`
`America has sufficient minimum contacts with California, has purposely availed itself of the
`
`14
`
`benefits and protection of California law, and does a substantial amount of business in and with the
`
`15
`
`State of California (including contracting with the State of California to provide services to
`
`16
`
`California citizens), such that the Court’s exercise of personal jurisdiction accords with due process.
`
`17
`
`9.
`
`Venue is proper in this District pursuant to 28 U.S.C. § 1391 because a substantial
`
`18
`
`portion of the acts or omissions giving rise to the claims in this Complaint occurred in this District,
`
`19
`
`and because Defendant is subject to the Court’s personal jurisdiction with respect to this action.
`
`20
`
`III.
`
`PARTIES
`
`21
`
`22
`
`A.
`
`Plaintiff
`
`10.
`
`Plaintiff Jennifer Yick is a person residing in San Francisco, California. She is a real
`
`23
`
`estate professional who found herself out of work during the Covid-19 pandemic. She applied for
`
`24
`
`and received EDD unemployment benefits; soon thereafter, she received a Bank of America EDD
`
`25
`
`Visa debit card with a magnetic stripe (no EMV chip) to access her benefits; she was then the victim
`
`26
`
`of unauthorized transactions on her card that emptied her account of her last $400; and despite its
`
`27
`
`28
`
`
`
`- 4 -
`Class Action Complaint
`Yick v. Bank of America, N.A.
`
`

`

`Case 3:21-cv-00376-JCS Document 1 Filed 01/14/21 Page 8 of 67
`
`
`
`
`“Zero Liability” policy and Plaintiff’s repeated requests for help, Bank of America has been either
`
`1
`
`2
`
`unwilling or unable to restore the missing funds to her account.
`
`3
`
`4
`
`B.
`
`11.
`
`Defendant
`
`Defendant Bank of America, N.A., is one of the largest banking associations in the
`
`5
`
`United States. It is incorporated in the state of Delaware and, as set forth below, does significant
`
`6
`
`business in California through, among other things, its exclusive contract with the State of California
`
`7
`
`to administer EDD benefits.
`
`8
`
`9
`
`C.
`
`12.
`
`Doe Defendants
`
`The true names and capacities of Defendants DOES 1–20, inclusive, are currently
`
`10
`
`unknown to Plaintiff. Accordingly, Plaintiff sues each and every DOE Defendant by such fictitious
`
`11
`
`names. Each DOE Defendant, individually and collectively, is responsible in some manner for the
`
`12
`
`unlawful acts alleged herein. Plaintiff will seek leave of this Court to amend this Complaint to
`
`13
`
`reflect the true names and capacities of the DOE Defendants when their identities become known.
`
`14
`
`15
`
`D.
`
`13.
`
`Aiding and Abetting, Concert of Action
`
`Plaintiff alleges that at all times relevant to the events giving rise to this action, each
`
`16
`
`and every Defendant was acting as an agent or employee of each of the other Defendants. Plaintiff
`
`17
`
`further alleges that at all times relevant to those events, each and every Defendant was acting within
`
`18
`
`the course and scope of that agency or employment at the direction of or with the full knowledge,
`
`19
`
`permission, or consent of each and every other Defendant. In addition, each of the acts or omissions
`
`20
`
`of each and every Defendant was made known to, and ratified by, each of the other Defendants.
`
`21
`
`IV.
`
`FACTUAL ALLEGATIONS
`
`22
`
`23
`
`A.
`
`14.
`
`Bank of America’s Contract with EDD
`
`EDD issues a variety of benefits to California residents, including but not limited to
`
`24
`
`unemployment insurance benefits, disability insurance benefits, paid family leave benefits,
`
`25
`
`pandemic unemployment assistance benefits, and pandemic emergency unemployment
`
`26
`
`compensation benefits (collectively, “EDD benefits”).
`
`27
`
`28
`
`
`
`- 5 -
`Class Action Complaint
`Yick v. Bank of America, N.A.
`
`

`

`Case 3:21-cv-00376-JCS Document 1 Filed 01/14/21 Page 9 of 67
`
`
`
`1
`
`15.
`
`
`In 2010, Defendant entered into an exclusive contract with California EDD to issue
`
`2
`
`debit cards through which individuals entitled to EDD benefits could access their funds, replacing
`
`3
`
`distribution of EDD benefits through paper checks. EDD chose to contract with Bank of America,
`
`4
`
`in part, because it promised the EDD “best-in-class” fraud monitoring.4
`
`5
`
`16.
`
`In July 2011, EDD began distributing benefits through the Bank of America cards as
`
`6
`
`the default option for EDD benefits recipients.
`
`7
`
`17.
`
`In its successful 2015 proposal to EDD seeking to extend its exclusive contract, Bank
`
`8
`
`of America represented that, as part of its contract with EDD, it “fully intend[s] to apply the most
`
`9
`
`rigorous fraud detection procedures,” including “employ[ing] the highest level of security and fraud
`
`10
`
`safeguards” based on “multiple layers of extensive security” and a “multi-faceted approach to
`
`11
`
`combat fraud.” The proposal specifically promises that Bank of America would provide “fraud
`
`12
`
`monitoring” for all EDD cards and accounts, and to employ technology that Bank of America stated
`
`13
`
`would provide “immediate response to emerging fraud trends” and allow fraudulent transactions to
`
`14
`
`be “declined in real time.”
`
`15
`
`18.
`
`Under the contract, Bank of America retains exclusive control over fund processing,
`
`16
`
`account management, and fraud detection for EDD cards and accounts. Even if EDD were to
`
`17
`
`determine that an instance of fraud occurred, it has no authority to direct Bank of America to refund
`
`18
`
`the victim.
`
`19
`
`20
`
`B.
`
`19.
`
`Bank of America’s Failure to Secure EDD Account Information
`
`Upon information and belief, Bank of America has failed to store or transfer EDD
`
`21
`
`cardholder and account information in a secure manner, resulting in a massive security breach that
`
`22
`
`has resulted in millions of dollars stolen from EDD through unauthorized transactions.
`
`23
`
`20.
`
`For example, some EDD cardholders who have had money stolen from their EDD
`
`24
`
`account through unauthorized transactions report never having used their EDD card. Upon
`
`25
`
`26
`
`27
`
`28
`
`
`
`
`4 Lauren Hepler & Stephen Council,“How Bank of America Helped Fuel California’s
`Unemployment Meltdown,” CalMatters (Nov. 20, 2020), available at https://calmatters.org
`/economy/2020/11/how-bank-of-america-helped-fuel-californias-unemployment-meltdown/.
`- 6 -
`Class Action Complaint
`Yick v. Bank of America, N.A.
`
`

`

`Case 3:21-cv-00376-JCS Document 1 Filed 01/14/21 Page 10 of 67
`
`
`
`
`information and belief, such unauthorized transactions could only have occurred if Bank of America
`
`1
`
`2
`
`failed to store or transfer EDD cardholder and account information in a secure manner.
`
`3
`
`21.
`
`The large proportion of EDD cardholders whose accounts have been subject to
`
`4
`
`fraudulent transactions also strongly indicates a wide-scale security breach of EDD cardholder and
`
`5
`
`account information in Bank of America’s possession, custody, and control, and which Bank of
`
`6
`
`America had a duty to secure.
`
`7
`
`8
`
`C.
`
`22.
`
`Bank of America’s Use of Outdated, Vulnerable Magnetic Stripe Technology
`
`To access their EDD benefits with a Bank of America card, a cardholder must send
`
`9
`
`the information on their card through a processing network operated by Visa. The first step in that
`
`10
`
`process occurs at the point of sale, where the cardholder either swipes or inserts their card into a
`
`11
`
`card reader. The reader obtains data from the card and transmits that data to the financial services
`
`12
`
`provider through a computer network, either at the time of the transaction or at a later time in a
`
`13
`
`“batch” of other transactions. The cardholder’s personal data is stored on the card.
`
`14
`
`23.
`
`From the 1960s through the last decade, magnetic stripes were the standard for
`
`15
`
`storing consumer information on debit and credit cards in the United States. A magnetic stripe
`
`16
`
`contains static data about the cardholder including their name, account number, and the card’s
`
`17
`
`expiration date. This sensitive data is printed directly on the outside of the card and recorded on the
`
`18
`
`magnetic stripe. When swiped through a reader, this data is collected and transmitted as part of the
`
`19
`
`transaction process.
`
`20
`
`24.
`
`But because the data on a magnetic stripe are static and easily readable, magnetic
`
`21
`
`stripe cards are highly susceptible to fraud. One common method of stealing information from
`
`22
`
`magnetic stripe cards is called “skimming,” a process by which a which a wireless transmitter
`
`23
`
`affixed to a card reader collects the information on the magnetic stripe and sends it to a nearby
`
`24
`
`computer. The recipient can then use the information to easily clone the consumer’s card, access
`
`25
`
`the consumer’s bank account, and perform online transactions.
`
`26
`
`25.
`
`Personal data on magnetic stripe cards can also be captured by hackers on a large
`
`27
`
`scale. For example, in 2013, hackers infiltrated the retailer Target’s payment terminals and
`
`28
`
`
`
`- 7 -
`Class Action Complaint
`Yick v. Bank of America, N.A.
`
`

`

`Case 3:21-cv-00376-JCS Document 1 Filed 01/14/21 Page 11 of 67
`
`
`
`
`systematically captured the information of every swiped card for weeks, ultimately gathering card
`
`1
`
`2
`
`information for tens of millions of people.5 Card data collected in this manner can be sold on an
`
`3
`
`underground market, where the stolen data can be used to make fraudulent purchases.
`
`4
`
`26.
`
`Over the past decade, in an effort to stem the consumer fraud enabled by magnetic
`
`5
`
`stripes, the financial services industry in the United States has adopted EMV chip technology as the
`
`6
`
`industry standard. While magnetic stripes are “static,” with the same card-identifying information
`
`7
`
`provided for every transaction, EMV chips are “dynamic,” meaning the data they contain can be
`
`8
`
`interacted with, altered, and updated. An EMV chip creates a unique electronic signature for each
`
`9
`
`transaction, making data from past EMV chip card purchases useless to would-be thieves, and
`
`10
`
`thereby significantly reducing the risk of fraudulent, unauthorized transactions.
`
`11
`
`27.
`
`In 2011, the same year it began issuing EDD debit cards, Bank of America
`
`12
`
`announced it would offer EMV chip corporate credit cards to a subset of U.S. business customers
`
`13
`
`who regularly traveled outside the United States.
`
`14
`
`28.
`
`On September 30, 2014, Bank of America announced that it would include chip
`
`15
`
`technology on “all new and reissued” consumer debit cards. When announcing this shift, a Bank
`
`16
`
`of America executive stated that “chip technology is an important tool in increasing card security,
`
`17
`
`and we want our customers to have the best possible experience when using their payment cards.”
`
`18
`
`The executive added that the “new chip-enabled cards will improve security of customers’
`
`19
`
`transactions.”6
`
`20
`
`29.
`
`In 2015, card issuers and processors began a nationwide shift to EMV chip cards.
`
`21
`
`By 2017, an estimated 855 million EMV chip cards had been issued to U.S. consumers, and today
`
`22
`
`such cards are standard in the industry.
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`
`5 Elise Hu, Target Hack a Tipping Point in Moving Away from Magnetic Stripes, NPR (Jan. 23,
`2014), available at https://www.npr.org/sections/alltechconsidered/2014/01/23/264910138/target-
`hack-a-tipping-point-in-moving-away-from-magnetic-stripes.
`
`6 Bank of America Press Release, “Bank of America Begins Rollout of Chip Debit Cards” (Sept. 30,
`2014), available at https://www.businesswire.com/news/home/20140930005292/en/Bank-of-
`America-Begins-Rollout-of-Chip-Debit-Cards (attached here as Exhibit A).
`- 8 -
`Class Action Complaint
`Yick v. Bank of America, N.A.
`
`

`

`Case 3:21-cv-00376-JCS Document 1 Filed 01/14/21 Page 12 of 67
`
`
`
`1
`
`30.
`
`
`Also in 2015, card-issuing banks and payment networks collectively stopped
`
`2
`
`absorbing liability for fraudulent transactions. On October 1, 2015, merchants who did not have
`
`3
`
`certified EMV chip readers became liable for the fraudulent transactions if the consumer presented
`
`4
`
`an EMV chip card. In essence, this meant liability for consumer card fraud would fall on either the
`
`5
`
`retailer or card issuer, whichever was the least compliant with EMV protocol.
`
`6
`
`31.
`
`As stated on Bank of America’s own website, EMV chip technology “has been
`
`7
`
`around for over 20 years and is the credit and debit card security standard in many countries around
`
`8
`
`the world. When purchases are made using the chip feature at chip-enabled terminals, the
`
`9
`
`transaction is more secure because of the process used to determine if the card is authentic. This
`
`10
`
`makes the card more difficult to counterfeit or copy.” Bank of America also assures its account
`
`11
`
`holders on its website that “whether you use the magnetic stripe or the chip to make your purchase,
`
`12
`
`you can have confidence in the protection and security features we provide for all credit and
`
`13
`
`debit accounts.”
`
`14
`
`32.
`
`Despite the fact that Bank of America was well aware that EMV chip cards are
`
`15
`
`significantly more secure than magnetic stripe cards, the company chose to issue EDD debit cards
`
`16
`
`using old, vulnerable stripe technology to hundreds of thousands of the most financially vulnerable
`
`17
`
`Californians. Bank of America did so notwithstanding its announcement that it would include chip
`
`18
`
`technology on all consumer debit cards. Predictably, the unsecure cards led to rampant fraud,
`
`19
`
`resulting in the ongoing loss of millions of dollars in benefits that EDD has issued to assist
`
`20
`
`Californians who lost their jobs, including during the Covid-19 pandemic.
`
`21
`
`22
`
`D.
`
`33.
`
`Bank of America’s Promise of “Zero Liability” and “24/7” Customer Service
`
`Bank of America represents to EDD benefits recipients that they will not be
`
`23
`
`responsible for unauthorized transactions. On a webpage listing FAQs about its EDD cards, Bank
`
`24
`
`of America responds to the question “Am I responsible for transactions that I did not make?” by
`
`25
`
`explaining that its “Zero Liability” policy “protects you against fraudulent transactions.” In the
`
`26
`
`“Quick Reference Guide” EDD cardholders receive with their card, Bank of America prominently
`
`27
`
`28
`
`
`
`- 9 -
`Class Action Complaint
`Yick v. Bank of America, N.A.
`
`

`

`Case 3:21-cv-00376-JCS Document 1 Filed 01/14/21 Page 13 of 67
`
`
`
`
`states: “Zero liability: If your card is stolen, Bank of America will reimburse you for any
`
`1
`
`2
`
`unauthorized card transactions subject to certain terms and conditions.”
`
`3
`
`34.
`
`In its California Employment Development Department Debit Card Account
`
`4
`
`Agreement (“Agreement”) (attached here as Exhibit B), to which all EDD cardholders must agree,
`
`5
`
`Bank of America sets forth these promises in greater detail. The Agreement states: “Under the Bank
`
`6
`
`of America ‘zero liability’ policy, you may incur no liability for unauthorized use of your Card
`
`7
`
`up to amount of the unauthorized transaction, provided you notify us within a reasonable time . . . .”
`
`8
`
`The Agreement advises the cardholder to “contact us at the number listed below AT ONCE if you
`
`9
`
`believe your Card has been lost or stolen or if you believe that someone may use of has used your
`
`10
`
`PIN assigned to your card without your permission. Telephoning is the best way of keeping your
`
`11
`
`possible losses down.” The Agreement requires that cardholders call or write to report an
`
`12
`
`unauthorized transaction “no later than 60 days” after Bank of America sent the statement on which
`
`13
`
`the error appeared.
`
`14
`
`35.
`
`The Agreement promises that Bank of America “will determine whether an error
`
`15
`
`occurred within 10 business days” after an
`
`16
`
`unauthorized
`
`transaction
`
`is
`
`reported.
`
` The
`
`17
`
`Agreement reserves the right to “take up to 45 days
`
`18
`
`to investigate” if the company “need[s] more
`
`19
`
`time.” However, Bank of America promises, in
`
`20
`
`that event, “we will credit your Account within
`
`21
`
`10 business days for the amount you think is in
`
`22
`
`error, so that you will have the money during the
`
`23
`
`time it takes us to complete our investigation.”
`
`24
`
`36.
`
`Bank of America also represents to
`
`25
`
`EDD cardholders that the company’s customer service is continuously available to assist with
`
`26
`
`suspected fraud. On Bank of America’s EDD card FAQ webpage, in response to the question “What
`
`27
`
`are the Bank of America EDD Debit Card Customer Service hours?” Bank of America claims that
`
`28
`
`
`
`- 10 -
`Class Action Complaint
`Yick v. Bank of America, N.A.
`
`

`

`Case 3:21-cv-00376-JCS Document 1 Filed 01/14/21 Page 14 of 67
`
`
`
`
`“[f]or your convenience,” Bank of America’s “dedicated customer service representatives are
`
`1
`
`2
`
`available 24 hours [a] day, 7 days a week” by phone. The webpage further explains that customer
`
`3
`
`service representatives can help with the following: “Resolve a question about your account
`
`4
`
`statement,” “Investigate transactions,” “Process lost/stolen/damaged card reports,” “Request an
`
`5
`
`emergency cash transfer.” The reference guide which accompanies EDD debit cards likewise claims
`
`6
`
`that “customer service is available 24/7.” In the Agreement, Bank of America advises EDD
`
`7
`
`cardholders that “Telephoning is the best way of keeping your possible losses down.”
`
`8
`
`9
`
`E.
`
`37.
`
`Economic Devastation and Unemployment During the Covid-19 Pandemic
`
`In Spring of 2020, the Covid-19 pandemic devasted California’s economy, and
`
`10
`
`millions of workers lost their jobs due to business closures and mass layoffs. The state’s
`
`11
`
`unemployment rate skyrocketed from 3.9% in January 2020 to 16.4% in April 2020, following the
`
`12
`
`closure orders issued by Governor Gavin Newsom. Industries such as hospitality, food service,
`
`13
`
`retail trade, and educational services have been especially hard hit.
`
`14
`
`38.
`
`As a result, millions of Californians turned to the EDD unemployment benefits
`
`15
`
`programs administered by Bank of America to pay their bills. Since the start of the Covid-19
`
`16
`
`pandemic in March 2020, EDD has received at least 18.5 million claims for various unemployment
`
`17
`
`benefits. In the first week of December 2020, EDD received 341,813 claims