Banks can't escape liability in app scams, judge rules

Michael Nagle/Bloomberg

Processing Content

• Key insight: Fraud victims do not give criminals "actual authorization" to their bank accounts, a judge ruled, allowing a suit against Bank of America to move forward.
• What's at stake: When scammers hijack a smartphone app and drain funds from a bank customer's account, federal consumer-protection safeguards apply, the judge found. 

A California judge refused to dismiss a proposed class-action lawsuit against Bank of America, filed by customers who were scammed out of $106,000 by a criminal posing online as a bank employee. 

U.S. District Judge Edward M. Chen denied BofA's motion to dismiss the suit brought by Ricky H. Chen and his wife, Amin Wu, according to court documents filed Thursday.  

BofA argued that because the stolen funds ultimately left the bank via an interbank wire transfer, the plaintiffs had no protection under the Electronic Fund Transfer Act, a 1978 law designed to protect consumers from fraud in electronic bank transfers.

The case is being closely watched by major financial institutions because wire transfers are not covered by EFTA. 

The lawsuit stems from a sophisticated phishing attack in 2024, in which scammers sent fake text alerts to the plaintiff about suspicious charges and then initiated a FaceTime call with him. The plaintiff believed he was sharing his screen with a BofA employee and unwittingly gave the fraudster remote control access to his iPhone.

The scammer then accessed the plaintiff's Bank of America app and transferred $78,000 from his checking account, plus $28,000 from his savings account, to another bank.

Within minutes of the theft, the plaintiffs alerted BofA about the fraud, explaining that a scammer impersonating a bank employee had hijacked their accounts.

But BoA repeatedly rejected their fraud claims, arguing that they authorized the transactions.

Deception is not authorization

In his ruling, the judge said that when a consumer gets tricked into granting screen access as part of an online scam, it doesn't mean the consumer gave "actual authority" to execute wire transfers. Granting remote access to a criminal under false pretenses does not satisfy EFTA's definition of an authorized transfer, the judge found.

"In this case, the fact that the plaintiffs' stolen funds were at one point transferred to another bank by wire is an incidental happenstance," the judge wrote. "The fact remains that the kind of alleged fraud in effecting the electronic transfer of the plaintiff's funds from their personal account is precisely the kind of harm Congress sought to address in enacting the EFTA." 

Because the fraud originated as an unauthorized electronic debit inside a mobile app, the judge ruled that EFTA applies. The judge found that while the wire transfer between financial institutions is exempt from EFTA, the initial unauthorized electronic debit from the customer's personal account is an intrabank transaction covered by EFTA.

BofA did not immediately respond Tuesday to a request for comment. 

Matthew Wessler, counsel for plaintiffs and a co-founder of the law firm Gupta Wessler, said he was pleased the court allowed the claims to move forward.

"The Electronic Fund Transfer Act was designed to protect consumers when someone gains unauthorized access to their accounts and steals their money. That's exactly what happened here," Wessler said in an emailed statement. "The decision is an important step toward holding Bank of America accountable and ensuring the Chens, along with other consumers who have faced similar treatment, have their day in court."