12B — In re Bank of America California Unemployment Benefits Litigation (Dkt. 591-21, S.D. Cal. No. 3:21-md-02992)

Record facts

U.S. District Court for the Southern District of California · No. 3:21-md-02992-GPC-MSB · Doc. 591-21 · 2025-10-17 · Docket on CourtListener

Full text

DX 12B
REDACTED VERSION OF 
DOCUMENT SOUGHT TO 
BE SEALED PURSUANT TO 
STIPULATED 
PROTECTIVE ORDER 
Case 3:21-md-02992-GPC-MSB     Document 591-21     Filed 10/17/25     PageID.41163 
Page 1 of 28

CONFIDENTIAL 
UNITED STATES DISTRICT COURT 
SOUTHERN DISTRICT OF CALIFORNIA  
SAN DIEGO DIVISION 
 
IN RE: BANK OF AMERICA 
CALIFORNIA UNEMPLOYMENT 
BENEFITS LITIGATION 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 Case No. 1-MD-02992-GPC-MSB 
  
 
 
EXPERT REBUTTAL REPORT OF PAMELA JOSEPH 
April 4, 2025 
 
 
 
 
 
Case 3:21-md-02992-GPC-MSB     Document 591-21     Filed 10/17/25     PageID.41164 
Page 2 of 28

CONFIDENTIAL 
Page 2 of 25 
 
TABLE OF CONTENTS 
I. 
ASSIGNMENT ....................................................................................................................... 3 
II. 
SUMMARY OF OPINIONS .............................................................................................. 4 
III. 
EMV CHIPS WERE NOT INDUSTRY STANDARD FOR PREPAID DEBIT CARDS.. 6 
IV. 
IT WAS REASONABLE FOR THE BANK TO NOT MIGRATE THE EDD PREPAID 
DEBIT CARD PROGRAM TO EMV CHIPS UNTIL 2021 .......................................................... 8 
A. 
Ms. Cloninger Does Not Consider the Fact That the Bank Needed the State’s Approval to 
Migrate the Program to EMV Chip Technology ......................................................................... 9 
B. 
Ms. Cloninger’s Opinion That the Entire Program Should Have Been Converted to EMV 
Chip Technology at the Same Time Ignores Standard Operational Practice .............................11 
C. 
Ms. Cloninger’s Opinion Fails to Consider Other Factors Relevant to Implementation of 
EMV Chip Technology ............................................................................................................. 13 
V. 
THE TYPE OF FRAUD THAT OCCURRED IN 2020 WOULD NOT HAVE BEEN 
ANTICIPATED ............................................................................................................................. 15 
VI. 
EMV CHIPS WOULD NOT HAVE PREVENTED “ALL OR NEARLY ALL” OF THE 
UNAUTHORIZED ATM WITHDRAWALS REPORTED .......................................................... 19 
VII. 
A REASONABLE FINANCIAL INSTITUTION WOULD NOT HAVE ASSUMED 
THAT EVERY OR EVEN MANY OF THE REPORTS OF FRAUD WERE MADE BY “TRUE” 
VICTIMS OF COUNTERFEIT FRAUD ..................................................................................... 21 
VIII. 
CONCLUSION ................................................................................................................. 22 
 
 
 
 
 
 
 
 
 
 
 
Case 3:21-md-02992-GPC-MSB     Document 591-21     Filed 10/17/25     PageID.41165 
Page 3 of 28

CONFIDENTIAL 
Page 3 of 25 
 
I. 
ASSIGNMENT 
1. 
I was asked by Goodwin Procter LLP, on behalf of Bank of America, N.A. (“Bank 
of America” or the “Bank”), to review and respond to opinions expressed in the expert report of 
Jane Cloninger submitted on March 4, 2025 (the “Cloninger Report”), in connection with the 
above-referenced matter.  
2. 
My background and qualifications, which include more than 30 years in the 
electronic payments industry, are detailed in my expert report dated March 4, 2025 (“Initial 
Report”).1  I have not provided expert testimony or authored any publications since my Initial 
Report.  In preparing this report, I personally considered various documents produced in this 
litigation and other materials, which are identified in Appendix B to my Initial Report.  Any 
additional materials not identified in my Initial Report are listed in Appendix A to this report.  I 
also reviewed the materials listed in the Cloninger Report, as well as the other expert reports of 
Jane Cloninger in this matter dated August 29, 2024 (the “Cloninger Class Cert. Report”) and 
November 21, 2024 (the “Cloninger Class Cert. Rebuttal Report”).  I reserve the right to 
supplement or amend my report should new information become available. 
3. 
In conducting my work on this matter, I have been assisted by individuals at Ankura 
Consulting Group, LLC (“Ankura”),2 who worked at my direction and under my supervision.  All 
opinions expressed herein are my own. 
 
 
1 See my Initial Report at Section I. 
2 Ankura is a professional services and consulting firm that provides dispute-related, investigative, 
financial, and operational consulting services to various types of organizations. 
Case 3:21-md-02992-GPC-MSB     Document 591-21     Filed 10/17/25     PageID.41166 
Page 4 of 28

CONFIDENTIAL 
Page 4 of 25 
 
II. 
SUMMARY OF OPINIONS  
4. 
I have reviewed the Cloninger Report and continue to stand by the opinions 
expressed in my Initial Report.  In this report, I respond below to a number of issues raised in the 
Cloninger Report.   
5. 
First, Ms. Cloninger’s opinion that “by at least 2019, EMV had become the industry 
standard for payment card security in the United States”3 is overly broad and bears little relevance 
to the specific card product at issue in this matter -- prepaid debit cards.  As detailed in my Initial 
Report, EMV chip cards were not industry standard for prepaid debit cards at that time.4  Ms. 
Cloninger’s amalgamation of all card types, including credit cards and non-prepaid debit cards, 
fails to acknowledge fundamental differences in characteristics, purpose, and usage across 
different payment products and programs.  EMV chip cards were simply not industry standard for 
prepaid debit cards, which differ in significant ways from credit cards and non-prepaid debit cards.  
The Bank acted swiftly once it received approval from California Employment Development 
Department (“EDD”) to implement EMV chip technology. 
6. 
Second, Ms. Cloninger’s opinion that the Bank should have implemented EMV 
chip technology prior to July 2021 ignores certain practical realities, including the fact that the 
Bank could not do so without approval from the EDD program, which it did not receive until 
March 2021.  Ms. Cloninger’s focus on the incremental cost of adding chip technology to a card 
ignores the multifaceted considerations that impact the determination of whether to migrate a card 
product or program to EMV chip technology.   Ms. Cloninger’s view that EMV chip technology 
should have been immediately implemented throughout the EMV Prepaid Debit Card program at 
 
3 See Cloninger Report at ¶ 55. 
4 See my Initial Report at Section V.A. 
Case 3:21-md-02992-GPC-MSB     Document 591-21     Filed 10/17/25     PageID.41167 
Page 5 of 28

CONFIDENTIAL 
Page 5 of 25 
 
the beginning of the Covid-19 pandemic ignores the reality of how card technology changes are 
typically implemented from an operational perspective, as well as the formidable challenges 
associated with an immediate, wholesale replacement of millions of cards in the midst of a global 
pandemic, which would include, among other things, cardholder confusion, program disruption, 
increased fraud risk, and other transition costs. 
7. 
Third, Ms. Cloninger’s opinion that fraud in the EDD Prepaid Debit Card program 
during the Covid-19 pandemic was foreseeable ignores the low rates of fraud in the program prior 
to the pandemic, as well as the nature of the fraud that emerged during the pandemic.  Her opinion 
is also based on the assumption that the Bank should have foreseen both a historic global pandemic 
and an unprecedented U.S. governmental fiscal response to the pandemic.  Based on my more than 
30 years in the electronic payments industry, prior to the onset of the pandemic (and even then), it 
was not reasonable to anticipate the level and sophistication of fraud that would descend upon the 
EDD program, which included significant amounts of fraud that would not have been prevented 
by EMV chip technology.   
8. 
Fourth, Ms. Cloninger’s opinion that EMV chips “would have prevented virtually 
all the card-present counterfeit fraud (including unauthorized ATM withdrawals) that class 
members experienced”5 relies on her speculative assumption that all of the reported fraud was 
counterfeit fraud and that no meaningful amounts of benefits fraud, first-party fraud, or cardholder 
mistakes took place.  More specifically, she assumes that “virtually all” reported unauthorized 
ATM transactions resulted from cardholders’ EDD cards being surreptitiously skimmed and 
hidden pinhole cameras or keypad overlays capturing each cardholder’s PIN as they entered it. 
 
5 See Cloninger Report at ¶ 14(j). 
Case 3:21-md-02992-GPC-MSB     Document 591-21     Filed 10/17/25     PageID.41168 
Page 6 of 28

CONFIDENTIAL 
Page 6 of 25 
 
Those assumptions are implausible and counter to contemporaneous evidence gathered by the 
Bank, which indicated that much of the reported fraud they were observing was actually benefits 
fraud and first-party fraud.  They also ignore the many other ways in which card information can 
be compromised and fraud can occur. 
III. 
EMV CHIPS WERE NOT INDUSTRY STANDARD FOR PREPAID DEBIT 
CARDS 
9. 
Ms. Cloninger’s assertion that “by at least 2019, EMV had become the industry 
standard for payment card security in the United States”6 is inaccurate and inapplicable to the facts 
of this case, which specifically pertain to prepaid debit cards.  As explained in my Initial Report, 
EMV chip cards were demonstrably not industry standard for prepaid debit cards at that time.7 
10. 
In opining that “by at least 2019, EMV had become the industry standard for 
payment card security in the United States,” 8 the Cloninger Report improperly considers all 
payment card products as a whole, failing to acknowledge the differences and heterogeneity among 
them.  Indeed, at one point, Ms. Cloninger opines that EMV chips were standard for the “debit 
card market,”9 but throughout her report she treats all debit and credit card products and programs 
as a single market. 10   As explained in my Initial Report, there are myriad differences in 
characteristics, purpose, and usage across various payment products and programs, and one cannot 
look at them as a single group for purposes of assessing whether EMV chips were industry 
 
6 See Cloninger Report at ¶ 55. 
7 See my Initial Report at Section V.A. 
8 See Cloninger Report at ¶ 55. 
9 See Cloninger Report at ¶ 14(c). 
10 See e.g., Cloninger Report at Heading VI.C, ¶¶ 55, 57.   
Case 3:21-md-02992-GPC-MSB     Document 591-21     Filed 10/17/25     PageID.41169 
Page 7 of 28

CONFIDENTIAL 
Page 7 of 25 
 
standard.11  Credit cards and non-prepaid debit card products present different considerations when 
evaluating conversion to EMV chip technology than do prepaid debit cards.12   
11. 
It is therefore improper to consider the “industry standard” for all payment cards; 
rather, one must consider the industry standard for the particular product at issue—in this case, 
prepaid debit cards.  Prepaid debit cards are different from other debit cards (and other payment 
cards) for the reasons I cited in my Initial Report, and present different considerations that impact 
a determination of whether to implement EMV chip technology.13 
12. 
Ms. Cloninger fails to address whether EMV chips were industry standard for 
prepaid debit cards.  She does not consider or even acknowledge the differences between prepaid 
debit cards and other debit cards that affect the decision whether to implement EMV chips.  She 
makes no attempt to distinguish prepaid debit cards from other payment card products.  Rather, in 
forming her opinions, Ms. Cloninger relies on data and information that are primarily about credit 
cards and other non-prepaid debit card payment products,14 and does not consider data specific to 
prepaid debit cards, such as the data I cited in my Initial Report regarding the use of chips in card-
present transactions made with prepaid debit cards.15  Data and information pertaining to credit 
cards and non-prepaid debit cards cannot be relied upon to determine industry standards for 
prepaid debit cards.   
 
11 See my Initial Report at ¶¶ 29-34. 
12 Id. 
13 See my Initial Report at Section V.A. 
14 See e.g., Cloninger Report at ¶¶ 48, 50.   
15 See my Initial Report at Appendix C.1-C.3. 
Case 3:21-md-02992-GPC-MSB     Document 591-21     Filed 10/17/25     PageID.41170 
Page 8 of 28

CONFIDENTIAL 
Page 8 of 25 
 
13. 
The only information about prepaid debit cards that Ms. Cloninger references is the 
Executive Order regarding cards for federal government benefit programs.16  But the conclusion 
reached by a single decision-maker is still only one data point, regardless of how many cards that 
decision-maker can control, and it does not and cannot determine industry standard.  
14. 
As explained in my Initial Report, EMV chips were not industry standard for 
prepaid debit cards during the relevant period. 
IV. 
IT WAS REASONABLE FOR THE BANK TO NOT MIGRATE THE EDD 
PREPAID DEBIT CARD PROGRAM TO EMV CHIPS UNTIL 2021  
15. 
As discussed in my Initial Report, and despite Ms. Cloninger’s assertion otherwise, 
the Bank’s decision to migrate the EDD Prepaid Debit Card program to EMV chip technology in 
2021 was reasonable and consistent with industry standard.  Ms. Cloninger’s opinion that “the 
Bank’s decision not to include EMV chips in EDD debit cards at least as of January 2020 was 
highly inconsistent with how [she] would expect a sophisticated financial institution in the 
payments industry to make decisions regarding payment card security”17 ignores the differences 
between payment card products, as described above.  Ms. Cloninger’s opinion also ignores the 
many considerations in the EDD Prepaid Debit Card program that made it reasonable for the Bank 
to not begin implementation of EMV chip technology until 2021.18 
 
16 See Cloninger Report at ¶ 53. 
17 See Cloninger Report at ¶ 58. 
18 See my Initial Report at Section V.B. 
Case 3:21-md-02992-GPC-MSB     Document 591-21     Filed 10/17/25     PageID.41171 
Page 9 of 28

Case 3:21-md-02992-GPC-MSB     Document 591-21     Filed 10/17/25     PageID.41172 
Page 10 of 28

Case 3:21-md-02992-GPC-MSB     Document 591-21     Filed 10/17/25     PageID.41173 
Page 11 of 28

CONFIDENTIAL 
Page 11 of 25 
 
32  In my experience, it typically takes at least this long, if not much longer, to 
migrate a card program to new technology.  As discussed in my Initial Report, there are many 
steps involved in this process that require time to complete.33 
19. 
Based on the EDD’s approval in March 2021, EMV chip technology 
implementation beginning in July 2021 was a reasonable timeline.  Ms. Cloninger suggests that 
the adoption of EMV chip technology was due to the Court’s preliminary injunction in June 
2021.34  This conclusion ignores the agreement with EDD that was signed in March 2021, as well 
as 
 
.35   
B. Ms. Cloninger’s Opinion That the Entire Program Should Have Been Converted 
to EMV Chip Technology at the Same Time Ignores Standard Operational 
Practice  
20. 
Ms. Cloninger seems to suggest that the Bank should have immediately migrated 
all existing payment cards to EMV technology at the outset of the pandemic.  She ignores how 
implementation of EMV chip technology is done by any reasonable financial institution in the real 
world.  Migration of any card program to EMV chip technology is typically accomplished over a 
 
32 Bank presentation, BANA_EDD_MDL-00104742-BANA_EDD_MDL-00104746 at 
BANA_EDD_MDL-00104746.  
 
 BANA_EDD_MDL-00624545-BANA_EDD_MDL-00624547 at BANA_EDD_MDL-
00624545.  See Email from C. Webb re Meeting Minutes: California EDD EMV Kickoff, March 2, 2021, 
BANA_EDD_MDL-00447117- BANA_EDD_MDL-00447118. 
33 See my Initial Report at ¶ 61. 
34 See Cloninger Report at footnote 77; ¶ 77. 
35 See Email from C. Webb re Meeting Minutes: California EDD EMV Kickoff, March 2, 2021, 
BANA_EDD_MDL-00447117- BANA_EDD_MDL-00447118.  See Email from B. Chestnut re Weekly Touch 
Point, February 1, 2021, BANA_EDD_MDL-00624540-BANA_EDD_MDL-00624544 at BANA_EDD_MDL-
00624542. See Email from C. Webb re Meeting Minutes (3/19): California EDD EMV Key Stakeholders Weekly 
Forum, March 23, 2021, BANA_EDD_MDL-00539518-BANA_EDD_MDL-00539519 at BANA_EDD_MDL-
00539518. 
Case 3:21-md-02992-GPC-MSB     Document 591-21     Filed 10/17/25     PageID.41174 
Page 12 of 28

CONFIDENTIAL 
Page 12 of 25 
 
period of time and on a gradual basis as cards become expired, damaged, or lost, and new or 
replacement cards need to be issued.  In my experience, financial institutions do not replace all of 
the cards in a program at once, which would include active unexpired cards that have not been 
reported as lost or stolen, or otherwise needing replacement.   
21. 
Indeed, the
that Ms. Cloninger cites refers to the 
 
 
.36  Ms. Cloninger’s reliance on the 
 
 
.37  There would be 
much more significant cost involved in migrating the entire card program to EMV chip technology 
at the same time, instead of waiting for a need for new and replacement cards to arise. 
22. 
In addition, based on my experience, implementing EMV chip technology across 
the entire program at once would cause significant issues for both cardholders and the Bank.  
Cardholders would not be expecting the arrival of new cards, which creates risk of cardholder 
confusion, disruption, and fraud.  Customers may not notice if the replacement cards are stolen 
and used fraudulently, as they are not expecting the cards to be issued in the first place.  There is 
also disruption and confusion for cardholders, for example, if the original cards are being used for 
auto-pay and saved for other payments.   
 
36 See Cloninger Report at ¶ 63. 
37 See Cloninger Report at ¶ 62. 
Case 3:21-md-02992-GPC-MSB     Document 591-21     Filed 10/17/25     PageID.41175 
Page 13 of 28

CONFIDENTIAL 
Page 13 of 25 
 
C. Ms. Cloninger’s Opinion Fails to Consider Other Factors Relevant to 
Implementation of EMV Chip Technology 
23. 
Ms. Cloninger’s opinion that the Bank should have migrated the EDD Prepaid 
Debit Card program to EMV chip technology by January 202038 appears to be based solely on the 
 
.39  Ms. Cloninger’s view that the decision whether to 
transition to EMV chip technology is solely a cost-based assessment (which, as explained above, 
is also erroneous and misleading in this case) is an oversimplification and is not consistent with 
how financial institutions actually operate.  The considerations surrounding the implementation of 
EMV chip technology in a particular card program involve more than just the cost of adding an 
EMV chip.  Ms. Cloninger fails to consider the multifaceted nature of this decision.   
24. 
Ms. Cloninger does not consider the other features of the program, which I note in 
my Initial Report, that made it reasonable to not implement chip cards at the time.  She does not 
consider the 
 
40  Nor does she consider the 
 
.41   
25. 
She cites to the 
 
 
.42  She does not, however, consider or acknowledge the 
 
 
38 See Cloninger Report at ¶¶ 58-60. 
39 Email from B. Garfield re EMV Cost Benefit Analysis, January 10, 2020, BANA_EDD_MDL-
00351839-BANA_EDD_MDL-00351840. 
40 See my Initial Report at ¶ 48. 
41 Id. 
42 See Cloninger Report at ¶ 84. 
Case 3:21-md-02992-GPC-MSB     Document 591-21     Filed 10/17/25     PageID.41176 
Page 14 of 28

CONFIDENTIAL 
Page 14 of 25 
 
 
.43  
A program with significant overall load value would be less of a target for fraud if the average 
balances and average loads were low, as was the case here. 
26. 
Ms. Cloninger also relies on a 
 
44   However, financial institutions do not make decisions about 
implementing EMV chip technology for a product or program based simply on whether “some” 
fraud will be avoided.  As discussed in my Initial Report, financial institutions consider many other 
factors when evaluating whether to convert a product or program to EMV chip technology 
including low balances, short program duration, and low incidence of card-present fraud, among 
others.45 
27. 
Without providing any specific examples, Ms. Cloninger opines that “for many 
markets,” other institutions moved forward with adoption of EMV chip technology based on a 
break-even point of four to seven years.46  She makes no mention of other considerations in those 
programs (such as those discussed in my Initial Report) which would weigh in favor of 
implementing EMV chip technology.  In my experience, if an issuer was willing to undertake a 
significant financial commitment despite an up to seven-year break-even point, that is likely 
because there were other reasons to adopt EMV chip technology, such that the decision was not 
made based on the cost of the EMV chip alone. 
 
43 See my Initial Report at ¶ 48. 
44 See Cloninger Report at ¶ 65. 
45 See my Initial Report at Section IV.C.3. 
46 See Cloninger Report at ¶ 67. 
Case 3:21-md-02992-GPC-MSB     Document 591-21     Filed 10/17/25     PageID.41177 
Page 15 of 28

CONFIDENTIAL 
Page 15 of 25 
 
28. 
Ms. Cloninger’s opinion that the Bank “did not act swiftly” to implement EMV 
chip technology “[e]ven after witnessing historic fraud on EDD debit cards in 2020 during the 
COVID-19 pandemic” also ignores the evidence, as described herein and in my Initial Report, that 
significant amounts of the fraud reported to the Bank did not involve fraud that would have been 
prevented by EMV chips.  That included the evidence of benefits fraud and other first-party fraud.  
Ms. Cloninger also ignores testimony that the Bank did not believe skimming to be a significant 
problem, even during the pandemic.47   
V. 
THE TYPE OF FRAUD THAT OCCURRED IN 2020 WOULD NOT HAVE BEEN 
ANTICIPATED  
29. 
Ms. Cloninger’s opinion that it was “highly foreseeable” that the absence of EMV 
chips would lead to counterfeit fraud48 is based on a number of erroneous assumptions.   
30. 
Ms. Cloninger cites publications noting that fraud would eventually migrate to 
magstripe-only cards.49  While it is generally true that fraudsters will target what they perceive to 
be weaknesses, that does not mean that the EDD Prepaid Debit Card program was at significant 
risk of fraud.  In fact, Ms. Cloninger cites publications from 2017 and 2018, yet as discussed in 
my Initial Report, the 
 
50 This was due to the various features of the program that I noted in 
my Initial Report, including low balances and short duration.51  Ms. Cloninger’s opinions about 
 
47 See Anne Holt deposition, January 8, 2025, 296:1 – 297:9. 
48 See Cloninger Report at Section VI.F. 
49 See Cloninger Report at ¶¶ 80-82. 
50 See my Initial Report at ¶ 48. 
51 Id. 
Case 3:21-md-02992-GPC-MSB     Document 591-21     Filed 10/17/25     PageID.41178 
Page 16 of 28

CONFIDENTIAL 
Page 16 of 25 
 
the risk of fraud are broad and theoretical and they are not supported by the actual EDD Prepaid 
Debit Card program data, which she does not consider. 
31. 
As discussed above, Ms. Cloninger opines that the pre-pandemic load values made 
the EDD Prepaid Debit Card program an “attractive target for counterfeiting,” 
 
.52  Ms. Cloninger ignores the evidence 
that I addressed in my Initial Report, 
 
 – and thus hardly an 
“attractive target,” as Ms. Cloninger asserts.53  As discussed in my Initial Report, and ignored by 
Ms. Cloninger, the 
 
 
.54 
32. 
Ms. Cloninger goes on to cite 
 
  But as the record shows, and as I discuss 
in my Initial Report, 
 
; the State later confirmed 
that billions of dollars of benefits fraud had been committed.55  Ignoring this, Ms. Cloninger 
concludes that “the most likely explanation” for the reported fraud is use of counterfeit cards 
created as a result of skimming, but cites no data to support that conclusion.56  She does not even 
address any other type of fraud or other possibility, including benefits fraud, first-party fraud, or 
 
52 See Cloninger Report at ¶ 84. 
53 See my Initial Report at ¶ 48. 
54 Id. 
55 See my Initial Report at Section V.C.1. 
56 See Cloninger Report at ¶ 96. 
Case 3:21-md-02992-GPC-MSB     Document 591-21     Filed 10/17/25     PageID.41179 
Page 17 of 28

CONFIDENTIAL 
Page 17 of 25 
 
cardholder mistakes, despite the evidence in the record that significant amounts of benefits fraud 
and first-party fraud were occurring. 
33. 
As explained in my Initial Report, none of that fraud would have been prevented 
by a chip.57  In my opinion, a reasonable financial institution would not respond to first-party fraud 
and other fraud that would not be prevented by EMV chip technology by implementing EMV chip 
technology.   
34. 
Also, prior to the pandemic and even in its early days, the Bank could not have 
foreseen the explosion of benefits fraud and first-party fraud to come. 
35. 
Ms. Cloninger states “[b]ecause prepaid cards with high load values and low 
security are particularly attractive to criminals and because the COVID-19 pandemic was projected 
to result in a large increase of the EDD debit card load, it was also highly foreseeable that fraud 
targeting EDD cards would continue to increase during the pandemic.”58  Again, Ms. Cloninger 
ignores the data showing that the EDD Prepaid Debit Card program was not experiencing 
significant fraud prior to the pandemic.  Further, the Bank could not have anticipated the various 
changes that led to increased account balances during the Covid-19 pandemic, including the influx 
of federal funds into unemployment benefits programs.  Based on my more than 30 years of 
experience in the electronic payments industry, I would not expect banks to anticipate and prepare 
for the series of interrelated events that began in 2020 with the onset of a global pandemic and 
which was followed by a massive spike in unemployment and the U.S. government’s response, 
including unprecedented lockdowns and a flood of unemployment benefits.  In my experience, it 
 
57 See my Initial Report at Section VI. 
58 See Cloninger Report at ¶ 14(f). 
Case 3:21-md-02992-GPC-MSB     Document 591-21     Filed 10/17/25     PageID.41180 
Page 18 of 28

CONFIDENTIAL 
Page 18 of 25 
 
is unreasonable to expect a financial institution to anticipate and plan in advance for what the 
government response might be to an unprecedented global event like the Covid-19 pandemic.  
36. 
Additionally, the rapid increase in both the number of unemployment benefits 
recipients and the average balance of the EDD Prepaid Debit Cards during the pandemic, which 
Ms. Cloninger argues made the program more attractive for counterfeit fraud, also made the EDD 
program more attractive to benefits fraud, which EMV chips would not prevent, and which the 
Bank could not have reasonably anticipated. 
37. 
Once the pandemic was underway and the impacts on the EDD program began to 
manifest, including the increase in both beneficiaries and card balances, it remained reasonable for 
the Bank to not implement EMV chip technology at that time, given the conditions and factors 
described in my Initial Report.59  Conversion of the entire program at that time, which is what Ms. 
Cloninger seems to suggest the Bank should have done, would also have presented a number of 
other challenges, as discussed above.   
38. 
Ultimately, the Bank could not have reasonably anticipated the pandemic or the 
government’s response to it.  I therefore disagree with Ms. Cloninger’s opinion that a 
“sophisticated financial institution like Bank of America”60 would, at the start of the pandemic, 
have been aware of the risks caused by the pandemic and the resulting government response.  I 
also disagree that these risks would have been avoided with EMV chip technology. 
 
59 See Initial Report at Section V. 
60 See Cloninger Report at ¶ 85. 
Case 3:21-md-02992-GPC-MSB     Document 591-21     Filed 10/17/25     PageID.41181 
Page 19 of 28

Case 3:21-md-02992-GPC-MSB     Document 591-21     Filed 10/17/25     PageID.41182 
Page 20 of 28

CONFIDENTIAL 
Page 20 of 25 
 
 
65  
iv) Fourth, she assumes that none of the transactions occurred at a non-chip-enabled  
ATM.  Fallback rules do not apply at such ATMs.  As discussed in my Initial Report, there 
continue to be non-chip-enabled ATMs.66 
v) Fifth, she assumes that internal Bank emails about fraud losses that could have been 
avoided if EDD Prepaid Debit Cards had EMV chips refer to avoidance of fraud, rather than 
the avoidance of fraud loss.  As explained in my Initial Report, even if adding an EMV chip 
resulted in the shifting of fraud loss for a particular transaction, the underlying fraud would 
not have been avoided.67 
40. 
Ms. Cloninger’s opinions that EMV chip technology is “extremely effective” in 
preventing counterfeit fraud68 and that the absence of a chip made EDD Prepaid Debit Cards 
“highly vulnerable”69 also erroneously assume that all of the reported fraud was counterfeit fraud 
resulting from skimming accompanied by PIN compromise.  As explained in my Initial Report, 
not all fraud is counterfeit, and EMV chip technology does not prevent all fraud.70 
 
65 See my Initial Report at ¶ 114.  See Email from M. Gargagliano re Action Required: CA Transition to 
EMV Cards: Fraud Workstream Status Report, July 23, 2021, BANA_EDD_MDL-00166750-BANA_EDD_MDL-
00166754. 
66 See my Initial Report at ¶ 110. 
67 See my Initial Report at Section VI.A. 
68 See Cloninger Report at Section VI.B. 
69 See Cloninger Report at Section VI.A. 
70 See my Initial Report at Section VI. 
Case 3:21-md-02992-GPC-MSB     Document 591-21     Filed 10/17/25     PageID.41183 
Page 21 of 28

Case 3:21-md-02992-GPC-MSB     Document 591-21     Filed 10/17/25     PageID.41184 
Page 22 of 28

CONFIDENTIAL 
Page 22 of 25 
 
also be skimmed at other places, such as payment terminals that do not require PINs, in which case 
it would be impossible to obtain the cardholder’s PIN as it is not entered during the transaction.  
Further, not every ATM skimmer is accompanied by a keypad overlay, pinhole camera, or other 
device that would successfully capture the PIN. 
44. 
In my opinion, it is implausible that all of the ATM fraud reported in 2020 and 2021 
could be a result of skimming given that skimming alone does not compromise the cardholder’s 
PIN.  Ms. Cloninger’s assumption is also directly contradicted by the evidence in the record of 
benefits fraud and first-party fraud.  Generally, the only terminals that require cardholders to enter 
PINs are ATMs, so Ms. Cloninger’s opinion assumes that virtually all of the compromised cards 
were compromised at ATMs through ATM skimmers and separate PIN capture devices.  Not only 
does that assumption seem unreasonable for the reasons stated above, but it is contradicted by the 
fact that, in the United States, cash usage itself dropped from 26% of all transactions in 2019 to 
19% of all transactions in 2020, and remained low at 20% of all transactions in 2021.75  In my 
experience, given the volume of fraud reported during the pandemic, including unauthorized ATM 
transactions, there was no reason for the Bank to believe that all or nearly all of the fraud being 
reported was counterfeit fraud as a result of card skimming at ATMs, particularly in light of the 
information indicating significant benefits fraud and first-party fraud. 
VIII. 
CONCLUSION 
45. 
Ms. Cloninger’s opinion that “by at least 2019, EMV had become the industry 
standard for payment card security in the United States”76 is overly broad and bears little relevance 
 
75 Federal Reserve Bank of San Francisco, “2022 Findings from the Diary of Consumer Payment Choice, 
May 5, 2022, https://www.frbsf.org/research-and-insights/publications/fed-notes/2022/05/2022-findings-from-the-
diary-of-consumer-payment-choice/ (Last visited on April 4, 2025). 
76 See Cloninger Report at ¶ 55. 
Case 3:21-md-02992-GPC-MSB     Document 591-21     Filed 10/17/25     PageID.41185 
Page 23 of 28

CONFIDENTIAL 
Page 23 of 25 
 
to the specific card product at issue in this matter -- prepaid debit cards.  As detailed in my Initial 
Report, EMV chip cards were not industry standard for prepaid debit cards at that time.77   
46. 
Ms. Cloninger’s opinion that the Bank should have implemented EMV chip 
technology prior to July 2021 ignores certain practical realities, including the fact that the 
 
  Ms. 
Cloninger’s focus on the incremental cost of adding chip technology to a card ignores the 
multifaceted considerations that impact the determination of whether to migrate a card product or 
program to EMV chip technology and also ignores the reality of how card technology changes are 
typically implemented.  Further, Ms. Cloninger’s view that EMV chip technology should have 
been immediately implemented throughout the EMV Prepaid Debit Card program at the beginning 
of the Covid-19 pandemic ignores the formidable challenges associated with an immediate, 
wholesale replacement of millions of cards in the midst of a global pandemic, which would 
include, among other things, cardholder confusion, program disruption, increased fraud risk, and 
other transition costs.  The Bank acted swiftly when it received approval from EDD to implement 
EMV chip technology. 
47. 
Ms. Cloninger’s opinion that fraud in the EDD Prepaid Debit Card program during 
the Covid-19 pandemic was foreseeable ignores the low rates of fraud in the program prior to the 
pandemic.  Her opinion is also based on the tenuous assumption that the Bank should have foreseen 
both a historic global pandemic and an unprecedented U.S. governmental fiscal response to the 
pandemic.  Based on my more than 30 years in the electronic payments industry, prior to the onset 
of the pandemic (and even then), it was not reasonable to anticipate the level and sophistication of 
 
77 See Initial Report at Section V.A. 
Case 3:21-md-02992-GPC-MSB     Document 591-21     Filed 10/17/25     PageID.41186 
Page 24 of 28

CONFIDENTIAL 
Page 24 of 25 
 
fraud that would descend upon the EDD program, which included significant amounts of fraud 
that would not have been prevented by EMV chip technology.   
48. 
Ms. Cloninger’s opinion that EMV chips “would have prevented virtually all the 
card-present counterfeit fraud (including unauthorized ATM withdrawals) that class members 
experienced”78 relies on her speculative assumption that all of the reported fraud was counterfeit 
fraud and that no meaningful amounts of benefits fraud, first-party fraud, or cardholder mistake 
took place.  Her assumptions are implausible and counter to contemporaneous evidence gathered 
by the Bank, which indicated that much of the reported fraud they were observing was actually 
benefits fraud and first-party fraud, as well as the reports from the State Auditor regarding the 
significant amounts of benefits fraud that occurred during the Covid-19 pandemic.  Ms.  
Cloninger’s assumptions also ignore the many other ways in which card information can be 
compromised and fraud can occur. 
 
 
 
 
 
 
 
 
 
 
 
 
 
78 See Cloninger Report at ¶ 14(j). 
Case 3:21-md-02992-GPC-MSB     Document 591-21     Filed 10/17/25     PageID.41187 
Page 25 of 28

Case 3:21-md-02992-GPC-MSB     Document 591-21     Filed 10/17/25     PageID.41188 
Page 26 of 28

 
 
Appendix A 
 
 
CONFIDENTIAL  
 
In RE Bank of America California Unemployment Benefits Litigation 
Expert Rebuttal Report of Pamela Joseph 
List of Materials Considered 
 
I incorporate by reference the materials listed in Appendix B to my Initial Report dated March 4, 
2025.  In addition, I considered the following additional materials in preparing this rebuttal 
report. 
 
1. Expert Reports 
 
Expert Report of Jane Cloninger dated March 4, 2025 
 
2. Depositions and Exhibits 
 
Anne Holt Deposition Transcript 
 
Robert Chestnut Deposition Transcript 
 
3. Other Produced Documents 
 
BANA_EDD_MDL-00002286 
 
BANA_EDD_MDL-00100634 
 
BANA_EDD_MDL-00125177 
 
BANA_EDD_MDL-00152968 - BANA_EDD_MDL-00152971 
 
BANA_EDD_MDL-00153566 
 
BANA_EDD_MDL-00154042 
 
BANA_EDD_MDL-00166345 
 
BANA_EDD_MDL-00166750 - BANA_EDD_MDL-00166754 
 
BANA_EDD_MDL-00433180 
 
BANA_EDD_MDL-00464666 
Case 3:21-md-02992-GPC-MSB     Document 591-21     Filed 10/17/25     PageID.41189 
Page 27 of 28

 
 
 
 
 
CONFIDENTIAL  
Page 2 of 2 
 
 
BANA_EDD_MDL-00520383 
 
BANA_EDD_MDL-00539518 - BANA_EDD_MDL-00539519 
 
BANA_EDD_MDL-00592324 
 
BANA_EDD_MDL-00624540 - BANA_EDD_MDL-00624544 
 
BANA_EDD_MDL-00678774 - BANA_EDD_MDL-00678775 
 
BANA_EDD_MDL-00678776 - BANA_EDD_MDL-00678777 
 
BANA_EDD_MDL-00678778 - BANA_EDD_MDL-00678782 
 
BANA_EDD_MDL-00698454 - BANA_EDD_MDL-00698455 
 
4. Publicly Available Documents 
 
Federal Reserve Bank of San Francisco, “2022 Findings from the Diary of Consumer 
Payment Choice,” May 5, 2022, available at https://www.frbsf.org/research-and-
insights/publications/fed-notes/2022/05/2022-findings-from-the-diary-of-consumer-
payment-choice/ 
 
 
Note: I also reviewed the materials listed in Appendix B of the Expert Report of Jane 
Cloninger dated March 4, 2025. 
 
 
Case 3:21-md-02992-GPC-MSB     Document 591-21     Filed 10/17/25     PageID.41190 
Page 28 of 28

File and source

File

gov.uscourts.casd.709615.591.21.pdf

Size

1,965,199 bytes

SHA-256

6768948d533ac36c04dbf1a19fefe609123b07597b8ca88beac0dd0bbdbb0e25

Our copy

gov.uscourts.casd.709615.591.21.pdf

Original

PACER (login required)