Weulander v. North Star Credit Union

Background

Kathy Weulander alleged that an unknown third party accessed her North Star Credit Union accounts and made 68 unauthorized electronic fund transfers between November 8 and December 13, 2022. The transfers, which were linked to an Internet Protocol address in Indonesia, moved $187,380 to another bank and effectively depleted her accounts. Weulander alleged that the third party made multiple incorrect password attempts, reset the account password, logged into the accounts 53 times over four days, and then carried out the transfers over approximately five weeks.

Weulander notified North Star Credit Union and demanded an accounting and explanation. The credit union later paid $45,000 into her savings account, but Weulander alleged that it did not provide the results of any investigation or respond to her written notices. Her account documents included an Electronic Fund Transfers Agreement and Disclosure and incorporated the credit union’s policies, including an E-Commerce Policy requiring the credit union to safeguard member data and describing protections for electronic commerce activities.

Motion to Dismiss

North Star Credit Union moved to dismiss five of the ten counts in the amended complaint under Federal Rule of Civil Procedure 12(b)(6). At this stage, the court considered whether the complaint alleged facts making each challenged claim plausible, accepting factual allegations as true and drawing reasonable inferences for Weulander.

Claims Allowed to Proceed

The court held that Weulander plausibly alleged a claim for treble damages under the Electronic Fund Transfers Act. She alleged that the credit union did not provide information about any investigation, did not fully recredit the $187,380, and should have recognized the suspicious nature of the transfers. The court concluded that these allegations were sufficient to proceed, even though Weulander could not provide more detail about an investigation to which she had not been given access.

The court also held that Weulander plausibly alleged a breach of contract based on the E-Commerce Policy. The Membership and Account Agreement incorporated the credit union’s policies, and the court found that the E-Commerce Policy was therefore part of the contract’s terms even though it was not itself a separate contract.

Finally, the court allowed the aiding-and-abetting claim to proceed. Weulander alleged that North Star Credit Union knew about the third party’s fraud and substantially assisted it by processing the 68 transfers. The court found that the repeated password attempts, account access, transfers from Indonesia, and depletion of the accounts plausibly supported knowledge and substantial assistance. It concluded that a jury could find that processing the transfers was not routine professional service under the alleged circumstances.

Claims Dismissed

The court dismissed the negligence claim under Minnesota’s independent-duty rule. That rule generally prevents recovery in tort when the alleged duty arises from the parties’ contract, unless an independent tort duty exists. The court found that the duty alleged in the negligence claim—to safeguard Weulander’s funds—was the same duty supporting the E-Commerce Policy contract claim.

The court reached the same conclusion for conversion. Weulander alleged that the credit union converted her funds by failing to fully recredit her accounts, while her contract claim alleged that the credit union failed to credit the accounts as required by the agreement. Because the alleged duties were the same and Weulander did not identify an independent duty, the court dismissed the conversion claim.

Disposition

The court denied North Star Credit Union’s first motion to dismiss as moot because Weulander filed an amended complaint. It granted in part and denied in part the renewed motion to dismiss. The renewed motion was granted as to Counts VIII and IX, negligence and conversion, and those claims were dismissed with prejudice. The motion was denied as to Count IV, treble damages; Count VII, breach of contract concerning the E-Commerce Policy; and Count X, aiding and abetting tortious conduct.