123RF LLC v. HSBC Bank USA, N.A.

Background

123RF alleged that hundreds of unauthorized Automated Clearing House debits were made from its HSBC commercial bank account beginning in January or February 2020. The transactions totaled close to $1.5 million and went to credit card companies. 123RF alleged that its account was intended to receive proceeds and settlements from online credit-card sales, with transfers between related entities made by direct wire transfers through HSBCnet. It believed that ACH debits could not be made from the account.

According to the amended complaint, HSBC reimbursed 123RF $431,821.56 for transactions occurring during March and April 2021 but refused to reimburse $998,518.54 in other transactions. 123RF asserted eight causes of action: a claim under New York Uniform Commercial Code § 4-A-204(1), negligence, gross negligence, breach of contract, fraud, breach of fiduciary duty, breach of the implied covenant of good faith and fair dealing, and violation of New York General Business Law § 349.

HSBC moved to dismiss all claims, arguing that they were time-barred and that the individual claims were preempted by New York Uniform Commercial Code Article 4-A or failed to state a claim under Federal Rule of Civil Procedure 12(b)(6), which tests whether a complaint adequately alleges a legally valid claim.

Rulings

The court held that the account agreement contained an enforceable one-year contractual deadline for bringing legal claims. It rejected HSBC’s argument that all the unauthorized transactions were one “series of events” beginning with the first transaction. Because the transactions differed in amount, recipient, timing, and frequency, the court determined that each transaction had to be considered separately. As a result, claims based on transactions posted before October 15, 2020—the date one year before the complaint was filed—were time-barred.

The court held that the negligence and gross-negligence claims were preempted by Article 4-A. Article 4-A establishes rules for allocating losses from unauthorized commercial funds transfers, including the effect of commercially reasonable security procedures. The court also held that 123RF’s breach-of-contract claim was preempted because it was essentially the same claim as the Article 4-A claim and concerned the security procedures and unauthorized transactions covered by that statutory framework.

The court dismissed the General Business Law § 349 claim because the alleged conduct involved a private commercial banking relationship and the complaint did not adequately allege consumer-oriented conduct affecting the public. It dismissed the breach-of-fiduciary-duty claim because the court found no fiduciary relationship between a bank and depositor here. It dismissed the fraud claim because the alleged statements were not pleaded with the particularity required by Rule 9(b), including details about what was said, when it was said, and who made and received the statements. It dismissed the implied-covenant claim because it was based on the same facts as the breach-of-contract claim.

Disposition

The court dismissed all claims in the amended complaint except the claim under New York Uniform Commercial Code § 4-A-204(1) concerning unauthorized transactions that occurred after October 15, 2020. The court directed the Clerk of Court to close HSBC’s pending motion to dismiss. Judge Naomi Reice Buchwald signed the memorandum and order.