Court filing
Exhibit PX8 — In re Bank of America California Unemployment Benefits Litigation (Dkt. 634-9, S.D. Cal. No. 3:21-md-02992)
Filed January 9, 2026 in In re Bank of America California Unemployment Benefits Litigation; one of 1415 filings from this case.
Record facts
| Court | U.S. District Court for the Southern District of California |
|---|---|
| Filed | 2026-01-09 |
U.S. District Court for the Southern District of California · No. 3:21-md-02992-GPC-MSB · Doc. 634-9 · 2026-01-09 · Docket on CourtListener
Full text
PX 8 Case 3:21-md-02992-GPC-MSB Document 634-9 Filed 01/09/26 PageID.52010 Page 1 of 37 UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF CALIFORNIA IN RE BANK OF AMERICA CALIFORNIA UNEMPLOYMENT BENEFITS LITIGATION Case No. 3:21-md-02992-GPC-MSB EXPERT REBUTTAL REPORT OF J. DANIEL KREIS April 4, 2025 REDACTED PUBLIC VERSION Case 3:21-md-02992-GPC-MSB Document 634-9 Filed 01/09/26 PageID.52011 Page 2 of 37 i Table of Contents Page I. ASSIGNMENT ................................................................................................................... 1 II. SUMMARY OF OPINIONS .............................................................................................. 2 III. STATEMENT AND EXPLANATION OF OPINIONS ................................................... 3 Case 3:21-md-02992-GPC-MSB Document 634-9 Filed 01/09/26 PageID.52012 Page 3 of 37 1 I. ASSIGNMENT 1. I have been retained by Plaintiffs’ counsel in In re Bank of America California Unemployment Benefits Litigation, Case No. 3-21-md-02992-GPC- MSB. On March 4, 2025, I issued an expert report on this matter (“Kreis Report”) which provided my qualifications, compensation, materials relied upon,1 analyses and opinions in this matter. That same day, Bank of America (“the Bank”) issued reports it had obtained from Russell Cronan (“Cronan Report”) and Teresa A. Pesce (“Pesce Report”). In this Rebuttal Report, I respond to statements and opinions in the Cronan Report and the Pesce Report. 2. This Rebuttal Report is provided in conjunction with the Kreis Report. None of Mr. Cronan’s or Ms. Pesce’s opinions change the opinions I provided in the Kreis Report. As set forth further below, many of the statements and opinions in the Cronan and Pesce Reports are incorrect and/or contradicted by information produced in this matter. 3. This Rebuttal Report addresses the following sections of the Cronan and Pesce Reports: a. Section IV.B. of Cronan Report i. “The Regulation E Investigative process” b. Section VI. of Cronan Report 1 Any additional materials considered in preparing this Rebuttal Report are set forth in footnotes and/or in Appendix A. Case 3:21-md-02992-GPC-MSB Document 634-9 Filed 01/09/26 PageID.52013 Page 4 of 37 2 i. “It was Reasonable for Bank of America to Believe that Its Response to the Explosion of Pandemic-Era Prepaid Card Fraud Would have been Acceptable to the Bank’s Regulators” c. Section I. of Pesce Report i. “California’s Employment Development Department” ii. “Bank of America’s Role in Distributing EDD Benefits” d. Section 2.c. of Pesce Report i. “The Bank Took Reasonable Steps to Analyze and Address Fraud” II. SUMMARY OF OPINIONS2 4. Mr. Cronan and Ms. Pesce’s emphasis on the Bank’s duty to control fraud losses and manage risk fails to take sufficient account of the Bank’s obligation to protect consumers under Reg E. The Bank’s responsibility to combat fraud does not excuse the Bank from complying with Reg E. 5. Mr. Cronan’s opinion that it was reasonable for the Bank to believe that the Bank’s implementation of the Claim Fraud Filter (“CFF”) and specifically the Bank’s implementation of CFF Indicator 1 (“CFF-1”) would have been acceptable to the Bank’s regulators is unfounded and ignores the reality of the Bank’s resources and its access to and relationship with its regulators. 2 All opinions stated in this report, including all opinions about what is consistent with or contrary to industry standards or contrary to industry standards, apply to the Class Period, unless otherwise indicated. Case 3:21-md-02992-GPC-MSB Document 634-9 Filed 01/09/26 PageID.52014 Page 5 of 37 3 6. Ms. Pesce’s opinion that the Bank could not verify that EDD prepaid cardholders were who they said they were, conflates enrollment fraud with transaction fraud, ignores the information the Bank did have, and is otherwise unfounded. 7. Mr. Cronan and Ms. Pesce’s emphasis throughout their report on the unprecedented nature of the pandemic and its resultant challenges is misplaced. While the pandemic brought about a spike in claims volume, Bank of America is the second largest bank in the United States; it has tremendous resources and capabilities; and there were many other strategies that the Bank could have used to handle such a spike without implementing the CFF-1. III. STATEMENT AND EXPLANATION OF OPINIONS A. Regulators Expect Banks to Manage Risk While Complying with its Obligation to Protect Consumers Under Reg E 8. The Cronan and Pesce Reports emphasize the Bank’s duty to control fraud losses and manage risk. The Cronan Report states that regulators such as the OCC expect banks to identify, measure, monitor, and control risk through risk- management programs, and expect banks’ risk-management programs to adapt to changing circumstances and fraud losses. (Cronan Report ¶¶ 14, 16-17). The Pesce Report makes the same point, and states that “regulators do not expect banks merely to report repeated or egregious instances of criminal activity; regulators expect banks Case 3:21-md-02992-GPC-MSB Document 634-9 Filed 01/09/26 PageID.52015 Page 6 of 37 4 to have processes in place to close accounts and/or terminate relationships.” (Pesce Report ¶¶ 22-24). 9. This one-sided argument ignores the obligations the Bank owes to legitimate cardholders. While financial institutions have a responsibility to manage risk, they also have a responsibility to protect the interests and rights of legitimate cardholders who are themselves the victims of fraud, especially here, where the cardholders are vulnerable UI recipients. The Bank’s responsibility to combat fraud does not excuse the Bank from complying with Reg E and its duties to legitimate cardholders. 1. The Bank Acted Contrary to Industry Standards. 10. It is one thing to terminate a banking relationship after the Bank investigates and determines that there has been criminal activity; it is another to do what the Bank did here through its implementation of CFF-1: deny all UI cardholder claims, rescind credits and freeze accounts based on an uninvestigated suspicion based on the mere fact that the claim involved an ATM transaction. As discussed in my earlier Kreis Report and based on my decades of experience working with financial institutions claims processes, cardholder claims based on ATM transactions are common and, for that reason, are specifically addressed in industry-standard claims procedures such as the Case 3:21-md-02992-GPC-MSB Document 634-9 Filed 01/09/26 PageID.52016 Page 7 of 37 5 . These and other industry standards discussed in the Kreis Report have developed over time to balance the Bank’s responsibility to manage fraud with its legal and contracted responsibility to protect its legitimate cardholders. In my opinion, by implementing CFF-1, the Bank completely abandoned these reasonable industry standard procedures and substituted a blunt, over-inclusive fraud rule that did not consider the evidence in the Bank’s own records as required to evaluate claims and to protect the legitimate interests of these UI cardholders. 11. The Cronan Report also fails to consider the industry-standard practice that developed following the financial crisis of 2008 for large banks to have a disaster recovery plan in place for dramatic events that might impact a financial institution. Such a recovery plan should have provided vetted procedures for responding to a spike in the volume of unauthorized-transaction claims. Such as that which occurred during the pandemic. 2. The Bank Had Ample Resources to Handle Unauthorized Transaction Claims. 12. It is also my opinion, as stated further below (¶¶ 17-18, 40-43), that the Bank had ample resources and many alternative industry-standard options available to handle the number of unauthorized-transaction claims while mitigating fraud that, in my experience, would have been consistent with the Bank’s obligations. During my career, I directly managed the planning, solution development, business Case 3:21-md-02992-GPC-MSB Document 634-9 Filed 01/09/26 PageID.52017 Page 8 of 37 6 document development execution and rapid scaling of two financial institutions’ capabilities over short periods of time in response to extreme external pressures. These two operations involved business challenges that can be analogized to those faced by Bank of America during the COVID-19 pandemic. First, at First Omni Bank, I personally managed all aspects of the scaling of a Credit Operation, moving the bank from a manual process capable of handling fewer than 90 new accounts per day in August of 1985, to a semi-automated process capable of handling over 10,000 per day by December of 1985. In other words, I have direct experience scaling a bank operation by 11,000% in just four months. Second, working with the FDIC, I oversaw an operation that closed several hundred thousand accounts in a single day, and I developed the call center expansion to handle the resulting dramatic increase in calls. B. The Bank is Required to Comply with the Reg E Investigative Process 13. The Cronan Report states that Reg E applies only to prepaid card accounts established for personal, family, or household purposes. (Cronan Report ¶ 22). I strongly disagree with the implication that this scope-of-coverage provision somehow relieved the Bank of its obligations under Reg E to conduct a reasonable investigation of plaintiffs’ and class members’ unauthorized-transaction claims in the first instance. Case 3:21-md-02992-GPC-MSB Document 634-9 Filed 01/09/26 PageID.52018 Page 9 of 37 7 14. As explained in the Kreis Report, Reg E creates significant regulatory compliance obligations for banks and consumer-facing financial institutions because when a cardholder makes an unauthorized-transaction claim, Reg E automatically triggers a series of consumer rights and bank obligations under its “error resolution” procedures. Financial institutions cannot selectively comply with Reg E based on an uninvestigated “suspicion” based solely on the fact that the claim involved a disputed ATM transaction, as the Bank is alleged to have done here. It is known in the industry that a financial institution has the affirmative burden and obligation under Reg E to conduct a reasonable investigation based on its available records upon receiving an unauthorized-transaction claim. As detailed in the Kreis Report, in order to assist financial institutions in conducting their investigations of unauthorized-transaction claims, financial industry standards have developed to provide required procedures for conducting an adequate investigation of such claims that make full use of the institution’s own available records, such as those that would be indicated for review under the Bank’s , a procedure the Bank abandoned during the Class Period for all claims involving an ATM transaction. 15. If Reg E were interpreted in the way that Mr. Cronan suggests, a bank could simply opt out of Reg E’s investigation requirement entirely based on its vague suspicions regarding entire populations or groups of transactions, without ever having to conduct a reasonable investigation. This would undercut the entire purpose Case 3:21-md-02992-GPC-MSB Document 634-9 Filed 01/09/26 PageID.52019 Page 10 of 37 8 of Reg E’s error resolution procedure, which is to protect consumers. Mr. Cronan’s further assertion that he is aware of “no regulator that would have regarded it as consistent with the intent and purpose of Regulation E for its consumer protections to apply to criminals” (Cronan Report ¶ 23) is similarly flawed to the extent it suggests that financial institutions have discretion to deny any unauthorized- transaction claim (let alone tens of thousands of such claims over the course of six months until enjoined by federal court) without first conducting a reasonable investigation that complies with EFTA and Reg E. C. It was Not Reasonable for Bank of America to Believe that its Use of Claim Fraud Filter Indicator 1 to Decision Claims Would Have Been Acceptable to the Bank’s Regulators. 1. COVID-19 Was Not An Excuse To Abandon Industry Standards. 16. Mr. Cronan claims in his report that it was reasonable for the Bank to implement CFF-1 because of the extraordinary circumstances that existed during the COVID-19 Pandemic in the summer of 2020. (Cronan Report ¶¶ 34-42, 49). As stated in the Kreis Report, I understand that the Bank faced elevated claims volume and other operational challenges during the Class Period, but that did not entitle the Bank to summarily deny claims without conducting the required Reg E investigation. An elevated claims volume did not release the Bank from its obligations to legitimate cardholders. Case 3:21-md-02992-GPC-MSB Document 634-9 Filed 01/09/26 PageID.52020 Page 11 of 37 9 17. The Cronan Report asserts that given the “rapidly unfolding circumstances and emerging scale of the unprecedented fraud” at the start of the class period, the Bank risked regulatory action if it did not act to mitigate fraud. (Cronan Report ¶ 49). This opinion is flawed for several reasons. First, it is entirely speculative. I have seen no documents suggesting that the Bank faced pressure from its regulators requiring it to automatically deny unauthorized-transaction claims made by UI prepaid cardholders. Second, as stated in the Kreis Report and further below (Section E), mitigating fraud does not mean abandoning industry standards and statutory requirements; the Bank had many options available to it to handle the number of unauthorized-transaction claims it was receiving and to mitigate fraud, options that would have been entirely consistent with the Bank’s obligations under Reg E and other obligations, including its anti-money laundering obligations. Third, this assertion by Mr. Cronan ignores the Bank’s obligations towards its legitimate customers, in this case unemployment insurance beneficiaries who received UI benefits through the Bank’s prepaid cards during the COVID-19 Pandemic. 2. The Bank Could Have Sought, but Did Not Seek, Regulatory Approval of CFF-1. 18. Finally, if the Bank believed it was forced to take the unprecedented step of automatically denying every unauthorized-transaction claim involving an ATM transaction without first conducting a reasonable investigation due to other regulatory obligations, the Bank certainly could have reached out and asked for the Case 3:21-md-02992-GPC-MSB Document 634-9 Filed 01/09/26 PageID.52021 Page 12 of 37 10 guidance of its regulators, including regulators from the Office of the Comptroller of the Currency (“OCC”) and the Consumer Financial Protection Bureau (“CFPB”). As stated in the Kreis Report, seeking such approval from the OCC and CFPB would have been a reasonable and relatively effortless step for the Bank to take before abandoning its industry-standard AISOP procedures and implementing an unprecedented policy of automatically denying every unauthorized-transaction claim that involved an ATM, notwithstanding that the Bank knew that many legitimate cardholders would be adversely impacted.3 19. As stated in the Kreis Report at ¶ 49, institutions much smaller than the Bank have the ability to and do reach out to regulators to approve new systems for reviewing claims. If the Bank were truly concerned about potential regulatory action for a failure to mitigate fraud, it is surprising, in my experience, that the Bank chose not to seek to obtain any approvals for its implementation of the CFF.4 The Bank’s failure to seek approval for the unprecedented CFF that affected so many UI cardholders is even more extraordinary given that the Bank had OCC examiners permanently onsite and readily available in 2020.5 3 See, e.g., Holt Tr. 134:20-135:11 (“And there’s going to be legitimate people in this segment that will – that we knew that was going to happen. That was not a surprise.”), 94:11-95:25, 139:14-140, 226:21-227:1, 295:10-14; Ahmad Tr. 56:1-7; 61:5-24; 69:14-17; Martin Tr. 308:9- 18. 4 Letson Tr. 26:5-22. 5 See, e.g., Fox Tr. 19:7-20:9 (OCC examiners “were in space that the bank paid for that is very near”) Case 3:21-md-02992-GPC-MSB Document 634-9 Filed 01/09/26 PageID.52022 Page 13 of 37 11 3. The Bank Ignored Industry-Standard Methods for Dealing With Fraud. 20. The Cronan Report claims that the Bank was forced to modify its pre- pandemic investigation approach because of unprecedented levels of fraud, including “double dipping.” (Cronan Report ¶¶ 39-42). In my experience, and as stated in the Kreis Report, banks and financial institutions sometimes face unusual circumstances that cause substantial spikes in claim volume or increased concerns about fraudulent claims, but banking is an industry that has weathered many storms, including “natural disasters, system failures, distressed economic conditions” (Cronan Report ¶ 27). In my experience, these dramatic events all result in spikes in claims, and industry-standard methods have developed to deal with such challenges (Kreis Report ¶¶ 52-54). 21. Additionally, to the extent that the Cronan Report suggests that double- dipping was a new fraud scheme that the Bank had just “began to observe,” I disagree (Cronan Report ¶ 39). Double-dipping is a well-known risk in the financial services industry, which EFTA-compliant manual investigation protocols such as the Bank’s AISOP are designed to identify. In my opinion, if the Bank had continued to utilize the AISOP to manually investigate unauthorized-transaction claims on the scale that was necessary, it would have succeeded in identifying most of the transactions that involved double-dipping without unnecessarily harming tens of thousands of UI cardholders. Indeed, according to senior members within the Bank, Case 3:21-md-02992-GPC-MSB Document 634-9 Filed 01/09/26 PageID.52023 Page 14 of 37 12 the scenario of double-dipping is simply a “variation of the Reg E scam for [demand deposit accounts]”6 that the Bank was already familiar with where the Bank takes on the loss.7 In my experience, double-dipping is a known risk and one that the Bank knows, and should have been well-equipped to deal with. (i) CFF-1 was not an automated “detection mechanism” but a decisioning mechanism. 22. The Cronan Report further asserts that the Bank was justified in “leveraging automation and other tools to identify indicia of potential fraud.” (Cronan Report ¶ 47). The Pesce Report similarly claims that “automated detection mechanisms are routinely used by banks to attempt to detect and prevent fraud.” (Pesce Report ¶ 54). As stated in the Kreis Report at ¶ 44, however, the Bank did not use the CFF merely to identify or detect red flags indicative of fraud, which would require follow-up inquiries or investigation. Instead, it used CFF-1 for the unprecedented purpose of decisioning unauthorized-transaction claims for automatic denial without any further inquiry/investigation. As a general matter, Ms. Pesce and Mr. Cronan’s opinions conflate the use of automated tools as one step in a bank’s investigation, which is not unusual, with what the Bank did here, which was to rely on the CFF-1 to the exclusion of all other information available to the Bank as a 6 BANA_EDD_MDL-00169898 (“[EDD double-dipping is] a variation of the Reg E scam for DDAs that I think [Anne Holt and Michael Letson are] already familiar with. The bank eats the $ here, and it’s substantial.”); id. (Anne Holt writes that she “worked card cracking [another term for double-dipping] for years”). 7 Id. Case 3:21-md-02992-GPC-MSB Document 634-9 Filed 01/09/26 PageID.52024 Page 15 of 37 13 basis for automatically denying UI cardholders’ claims. (Cronan Report ¶¶ 43-55; Pesce Report ¶¶ 20, 54-59). Moreover, as explained in the Kreis Report at ¶¶ 71-73, in my opinion any financial institution would have known that CFF-1 would impact large numbers of legitimate cardholders; and here, the Bank knew early on that CFF- 1 was overbroad in decisioning claims as fraudulent, 8 considerations that the Cronan and Pesce Reports ignore. 4. The Bank had Numerous Options to Deal With UI Cardholder Claims Other than Automatically Denying Claims with CFF-1 23. As discussed further below (Section E), the Bank had numerous tools available to it in 2020-2021 to handle the increased claims volumes in a manner that complied with industry standards under Reg E. In addition to substantially increasing the number of fraud analysts and customer service representatives through an industry provider such as Accenture, the Bank could have used other tools readily available to authenticate callers’ identities. As stated in the Bank’s own analysis when it switched from freezing UI prepaid cardholder accounts (under which the cardholder had to verify their identity with EDD) to blocking accounts 8 See e.g., BANA_EDD_MDL-00554835; BANA_EDD_MDL-00159110; BANA_EDD_MDL- 00876614. Bank’s assessment from December 2020 of CFF-1 uses reconsideration request rates as a proxy for CFF-1 effectiveness. See also BANA_EDD_MDL-00460916; BANA_EDD_MDL-00501938. Bank’s slide deck showing significant numbers of escalations received relating to accounts frozen and reconsiderations. See also Chestnut Tr. 154:11-157:14; BANA_EDD_MDL-00060514. The Bank knew by September 2020 that EDD’s call centers were so “overwhelmed” that no more than “1 in 1,000 people that are trying to reach [the EDD] call center on a given day are getting through,” resulting in “600,000 unique callers a month [] waiting on hold for hours without a statistically significant chance of being served.” Case 3:21-md-02992-GPC-MSB Document 634-9 Filed 01/09/26 PageID.52025 Page 16 of 37 14 (under which the cardholder could verify their identity with the Bank), the Bank’s agent could “[l]everage sophisticated tools to authenticate caller[s,]” which according to the Bank’s own documents include using “ ”9 Other steps include the Bank’s “ ” steps, which required the Bank to check the 10 The Bank also could have leveraged ANI data, which the Bank’s fraud expert stated was the “best indicator” for determining whether a claim was false.”11 The Bank also could have leveraged its own client database; as stated by the Bank’s fraud expert: “honestly, the best fraud detection we could do would be to leverage our client base, [F]aiz keeps saying they arent our clients but logically we are in 1 of 2 households, so 1/2 probably are.”12 In my 9 BANA_EDD_MDL-00090722 at -00090723; see also BANA_EDD_MDL-00405160. 10 Id. 11 BANA_EDD_MDL-00169898 12 BANA_EDD_MDL-00631444 at -00631445; and Holt Tr. 276:19-277:1. The expert testified that she could not recall this ever being implemented. Case 3:21-md-02992-GPC-MSB Document 634-9 Filed 01/09/26 PageID.52026 Page 17 of 37 15 opinion, these are just a few of the many sophisticated resources to detect fraud at the Bank’s disposal which were not deployed when the Bank decided to implement the unprecedented and CFF-1. 5. The Bank’s Decision Not to Conduct a Reasonable Investigation Would Not Be Considered by Regulators as an Exercise of Discretion Within Regulation E (i) CFF-1 involved no investigation. 24. The Cronan Report claims that neither the statute (EFTA) nor Reg E set specific parameters on what an investigation should entail. (Cronan Report ¶ 25). While I agree that neither the statute nor regulation prescribes a specific list of investigative parameters, it is well understood in the financial industry that EFTA and Reg E require the financial institution to conduct a reasonable investigation before a claim may be denied. While financial institutions are afforded some latitude in determining the scope of a reasonable investigation that is compliant with EFTA and Reg E, they are not afforded latitude to decide whether to conduct an investigation at all. 25. The Cronan Report further asserts that the reasonableness of a bank’s investigative process depends on the conditions and circumstances in which the investigation was conducted. (Cronan Report ¶ 29). I agree that banks are required to conduct a reasonable review of relevant information within the financial institutions’ own records or readily available to it and that banks are expected to Case 3:21-md-02992-GPC-MSB Document 634-9 Filed 01/09/26 PageID.52027 Page 18 of 37 16 exercise a degree of judgment in interpreting the results of their investigations. However, in my opinion, the Bank’s use of CFF-1 to automatically decision claims for denial without first conducting a reasonable case-by-case investigation, such as is required by industry standards and the Bank’s own AISOP procedures, was not an exercise of such discretion. As stated in the Kreis Report, the Bank’s AISOP had numerous investigation points for claim analysts to review. Each investigation point could reveal information that was relevant or potentially outcome-dispositive. Under industry standards and the Bank’s own AISOP procedures, the Bank was required to exercise judgment after reviewing all available details to determine whether there has been an error. 26. It is my opinion that there is a clear difference between a bank exercising discretion and judgment after conducting a reasonable investigation, and a bank deciding not to conduct any case-specific investigation at all based solely on the fact that the claim involved an ATM transaction. The Bank’s own documents show that it knew that “[i]f we do not consistently review all available details, we risk missing information vital to the investigation, resulting in an incorrect decision made.”13 Indeed, as explained in the Kreis Report, where the Bank conducts a reasonable investigation and consequently denies the claim, the Bank must continue to follow Reg E procedures, which requires the Bank to provide the claimant notice 13 BANA_EDD_MDL-00004542; Kreis Report ¶ 37. Case 3:21-md-02992-GPC-MSB Document 634-9 Filed 01/09/26 PageID.52028 Page 19 of 37 17 and the reasons for denial (Kreis Report ¶¶ 77-80). In order to provide such a notice to claimants, the Bank must first investigate the claim to develop a factual basis for its decision. In my opinion, the Bank’s decision to implement CFF-1 and to resolve claims solely on the basis of CFF-1 would not have been regarded by regulators as an exercise of discretion allowed within Reg E, but rather as an unprecedented procedure that was inconsistent with industry standards as well as the Bank’s own practices for complying with Reg E’s investigation requirement. (ii) CFF-1 was a rule; other industry standard methods were available to handle increased claims volume. 27. The Cronan Report asserts that regulatory agencies expect institutions’ risk management systems to adapt to changing circumstances, and that regulators expect institutions to innovate to respond to dynamic and novel challenges. (Cronan Report ¶¶ 14, 26, 50, 51, 60). As stated above (¶ 3) and in the Kreis Report at ¶¶ 52- 54, and as Mr. Cronan also recognizes, the financial and banking industry is resilient. The Cronan Report explicitly confirms that “some of the very real challenges banks faced included natural disasters, system failures, distressed economic conditions, and the scarcity of qualified personnel, among several others.” (Cronan Report ¶ 27). In my opinion, industry-standard methods have developed to deal with those difficult challenges that large financial institutions inevitably have to face. It would be an untenable situation if large financial institutions, such as the Bank of America, were permitted to abandon well-developed industry standards and forego investigating Case 3:21-md-02992-GPC-MSB Document 634-9 Filed 01/09/26 PageID.52029 Page 20 of 37 18 claims for an entire population—as it did in implementing and using the CFF-1— each time it encountered a “very real challenge” simply by asserting that it was “innovating.” 28. The Cronan Report posits that “if a bank introduces a new card product that, based on the sheer volume of new transactions, results in a surge in the number of error claims, regulators will expect the bank to adapt its processes in order to effectively handle the increased volume of claims.” (Cronan Report ¶ 26). I agree and as set out in Kreis Report and below, there were various industry standard options available to the Bank to adapt accordingly. However, the Cronan Report goes further to assert that one way a bank might adapt “would be to automate aspects of the investigative process to increase the efficiency of its claims-handling process.” (Cronan Report ¶ 26). This is a mischaracterization of what the Bank did and is contrary to the documents produced by the Bank. The Bank did not automate aspects of the investigative process, as stated in Kreis Report. In my opinion, the Bank substituted a blunt automated rule for the investigative process: if an EDD cardholder claimed that there was an unauthorized transaction involving an ATM, the Bank would deny the claim, rescind credits, and freeze the account without any further factual investigation. In my opinion, CFF-1 was not part of an investigative process; but a blunt, overbroad rule that denied any claim that involved an ATM transaction without investigation. Case 3:21-md-02992-GPC-MSB Document 634-9 Filed 01/09/26 PageID.52030 Page 21 of 37 19 29. The Cronan Report’s reference at ¶ 28 to comments made by the Board of Governors of the Federal Reserve System (“FRB”) clarifying that the scope of an investigation may vary and that institutions have flexibility to determine what information is relevant to a meaningful investigation does not change or undermine my opinion in any way. The FRB comments support my opinion as they clearly assume that a reasonable and meaningful investigation must still take place. 6. CFF-1 was Not an Automated Feature of a Reasonable Investigation 30. The Cronan Report states that banks had “automated various elements of the investigation process.” (Cronan Report ¶ 30). The Cronan Report further claims that use of automation in conducting Reg E investigations would not be a per se violation of Reg E. However, as explained above at ¶ 28, the Bank did not automate elements of the Reg E investigation process; instead, the Bank replaced the entire investigative process for ATM claims with CFF-1. Prior to the CFF’s implementation, the only automated process the Bank had used was to automatically pay claims,14 which is consistent with their obligation not to deny claims before conducting a reasonable investigation. In my long experience in claims processing, I am aware of no use of an automated process to evade a financial institution’s reasonable investigation requirement under Reg E and to deny a claim automatically without looking into the bank’s own records. Indeed, the examples of permissible 14 See Ehresman Tr. 18:18-19:12 Case 3:21-md-02992-GPC-MSB Document 634-9 Filed 01/09/26 PageID.52031 Page 22 of 37 20 automation provided in the Cronan Report—automated information gathering through web interfaces, automated calculation of provisional credits and consumer liability, and automated generation of consumer communications—are all examples of automation that merely assists and complements a manual investigation. (Cronan Report ¶ 30). These examples are completely different than CFF-1, which automatically decisioned ATM claims for denial without any investigation. 31. The Cronan Report’s reliance on the existence of companies that sell automated solutions is inapt for these same reasons. (Cronan Report ¶ 32). Automated products that assist institutions in organizing or conducting Reg E compliant investigations are not analogous to the use of CFF-1 to auto-deny tens of thousands of claims without conducting any investigation. Notably, Mr. Cronan does not point to any vendor that offered a product that simply automatically denied all ATM claims, as CFF-1 did. 32. The Pesce Report also claims that the CFF created friction that “fraudsters encountered” when they were required to verify their identities with the EDD after triggering CFF-1. (Pesce Report ¶ 58). Ms. Pesce’s opinion, however, is circular, as it presupposes that everyone who triggered CFF-1 was a fraudster. The Pesce Report does concede that any fraud strategy has false positives. (Pesce Report ¶ 59) However, in the same paragraph of her report, Ms. Pesce claims that a “wide net must be cast to prevent true criminal activity from going undetected” even if the Case 3:21-md-02992-GPC-MSB Document 634-9 Filed 01/09/26 PageID.52032 Page 23 of 37 21 casting of that net would result in a “significant number of false positive alerts.” This view appears to ignore the Bank’s obligations to protect its legitimate EDD cardholders. It also ignores that the Bank used CFF-1 to automatically deny all ATM claims, not to merely “detect” or flag claims for further investigation to identify any that actually involved “true criminal activity.” 7. The Bank Easily Could Have Consulted With Regulators Prior to Implementing CFF-1 but Chose Not To 33. The Cronan Report acknowledges the consent orders with the Bank’s regulators, which made specific factual findings regarding the impropriety of the Bank’s unilateral actions and resulted in the Bank being fined $225 million in connection with its implementation of the CFF (Cronan Report ¶¶ 33 and 54). Mr. Cronan argues that because these regulatory actions were taken after the fact, they have no bearing on whether the Bank had a reasonable basis to believe it was complying with regulations. (Cronan Report ¶ 56). The Cronan Report then asserts the belief that the Bank would not willfully implement a process in violation Reg E. (Cronan Report ¶ 57). This opinion is pure conjecture that disregards much of the evidence to the contrary. The Cronan Report strays further into the realm of unsupported speculation when it refers to bank examiners’ “virtually unfettered access to a bank’s books and records” to perhaps suggest, without explicitly stating, that the Bank’s regulators must have changed their minds about the claim fraud filter. (Cronan Report ¶ 57.) Nowhere in the Cronan Report, or elsewhere in the record of Case 3:21-md-02992-GPC-MSB Document 634-9 Filed 01/09/26 PageID.52033 Page 24 of 37 22 which I am aware, is there any indication that the Bank approached its regulators for any kind of pre-approval (or post-approval) of the Bank’s plan to implement the CFF. Instead, the Bank’s representative specifically testified that the Bank never sought approval to use the CFF as the following deposition excerpt confirms: Q. A. Q. Q. A. Q. A. Q. A. .15 34. Based on my experience, it is implausible that Bank of America, the second largest bank in the country, would have been unable to consult its regulators prior to implementing CFF-1. In my opinion, the Bank’s failure to do so indicates 15 Letson Tr. 26:5-22. Case 3:21-md-02992-GPC-MSB Document 634-9 Filed 01/09/26 PageID.52034 Page 25 of 37 23 that the Bank itself believed that its regulators would not have approved the Bank’s implementation of CFF-1. D. The Bank Possessed Sufficient Data to Assess Claims 35. Ms. Pesce claims that the Pandemic Unemployment Assistance (“PUA”) program eliminated traditional safeguards and that as a result the Bank was unable to verify EDD cardholders, which Ms. Pesce claims was not the Bank’s responsibility in any case. (Pesce Report ¶¶ 26, 30). She further asserts that the Bank did not have information available to conduct investigations into potential benefits fraud, identity theft, or alleged unauthorized transactions. (Pesce Report ¶ 30). However, Ms. Pesce herself concedes that the Bank did have “some identifying information on cardholders from EDD” while not specifying the information that the Bank had (Id. at ¶ 30). Ms. Pesce also appears to contradict herself, when she states later in her report that the Bank’s Global Financial Crimes experts analyzed patterns and evidence of likely fraudulent behavior and suspicious activity using available data and admits that the Bank had sufficient data to identify “thousands of instances where unemployment benefits were provided to children as young as four months old, as well as elderly individuals” (Pesce Report ¶ 51). The Bank, therefore, must have possessed sufficient data to identify at least some instances of fraudulent behavior. Case 3:21-md-02992-GPC-MSB Document 634-9 Filed 01/09/26 PageID.52035 Page 26 of 37 24 36. First, as I explained in my Opening Report, enrollment fraud is to be distinguished from transaction fraud. Both Mr. Cronan and Ms. Pesce appear to conflate these two distinct types of fraud. (Cronan Report ¶¶ 43-55; Pesce Report ¶¶ 20, 54-59). Second, ,16 .17 This is further borne out by the fact that in March 2021, the Bank ).18 Required procedures, .19 (Cronan Report ¶ 70). As stated above at ¶ 23, 16 Daniels Tr. 155:23-156:21. 17 Daniels Tr. 90:1-91:5 ( ”) 18 BANA_EDD_MDL-00125921; Martin Tr. 301:18-302:25; also see BANA_EDD_MDL_00417555 19 See, e.g., BANA_EDD_MDL-00100663 (Bank instructing analysts to “ .”). See also, Kreis Report ¶ 36(6) “ .” Case 3:21-md-02992-GPC-MSB Document 634-9 Filed 01/09/26 PageID.52036 Page 27 of 37 25 the Bank had sophisticated tools that it could have used for identity verification, and as the Bank’s fraud expert suggested, the Bank could likely have cross-referenced EDD cardholders against existing Bank of America cardholders. The Bank’s documents further suggest that it could also have used other data at its disposal, including the use of ANI data, which as mentioned above and according to the Bank’s fraud expert was the “best indicator” for a claim being false,20 and that, based on the Bank’s size, it was also likely that many EDD cardholders were also bank customers outside of the UI program, which would have provided many other investigatory data points in the Bank’s own records.21 37. It is also my understanding based on the Bank’s records that the Bank applied its .22 This further demonstrates that the Bank possessed sufficient data and tools to assess claims without having to automatically deny all ATM claims with CFF-1. 20 BANA_EDD_MDL-00169898. 21 BANA_EDD_MDL-00631444 at -00631445; and Holt Tr. 276:19-277:1. 22 Id. Case 3:21-md-02992-GPC-MSB Document 634-9 Filed 01/09/26 PageID.52037 Page 28 of 37 26 E. The Bank Did Not Take Reasonable Steps to Analyze and Address Fraud 38. Both Mr. Cronan and Ms. Pesce emphasize throughout their report the “unprecedented” and “extraordinary” nature of the pandemic and the resultant spike in claims volumes. (Pesce Report ¶¶ 15-16, 19, 25, 46,; Cronan Report ¶ 11, 35-37, 42, 44-46, 49, 51, 53, 55). 39. While I agree that the challenges presented by the pandemic were substantial, so too are the resources, experience and abilities of Bank of America, the second largest Bank in the United States. As explained above at ¶ 3 and in my opinion, the financial and banking industry is resilient, and the Bank had ample resources and ability to address the challenges created by the pandemic without resorting to implementing CFF-1. Banks and financial institutions do sometimes deal with spikes in claims volume, but industry standards have developed to deal with unusual circumstances. 40. The Cronan Report discusses the Bank’s safety and soundness obligations as a balancing factor against the Bank’s consumer protection obligations (Cronan Report ¶¶ 14-19 and 55). While Mr. Cronan claims that the OCC could consider uncontrolled fraud losses an unsafe and unsound banking practice, he concedes that an unsafe and unsound practice in itself does not indicate that a bank is in an unsafe and unsound condition, and he does not suggest that Bank of America’s safety and soundness was ever threatened by the circumstances he Case 3:21-md-02992-GPC-MSB Document 634-9 Filed 01/09/26 PageID.52038 Page 29 of 37 27 described. (Cronan Report at ¶ 19). Mr. Cronan also concedes that in typical circumstances, a bank’s adherence to safety and soundness principles would not affect the conduct of its Reg E investigations. (Cronan Report at ¶ 43). Nonetheless, Mr. Cronan claims that “the Bank’s approach to modifying its Regulation E investigative process was a reasonable response in light of the unprecedented fraud… and its urgent need to address its safety and soundness obligations.” (Cronan Report at ¶ 55). As stated above, it is my opinion that by implementing CFF-1, the Bank did not simply “modify” its normal Reg E investigations. Rather, it abandoned any industry-standard investigation for all ATM claims. Mr. Cronan appears to accept that the Bank was never in an unsafe and unsound condition. (Cronan Report at ¶ 19). Finally, as described above and further in this section, the Bank could have adopted alternative industry standard strategies to address the rising volume of claims. In my opinion, it was therefore not reasonable for the Bank to believe that its regulators would consider its elimination of any manual investigation process for EDD debit cardholders reporting ATM transaction errors to be a “reasonable and compliant response” (Cronan Report ¶ 55). 41. To support his claim, Mr. Cronan repeatedly refers to “criminal fraudsters []infiltrating state unemployment benefits at an unprecedented rate” and states that this led the Bank to believe that many of the new EDD prepaid debit card accounts were fraudulent. (Cronan Report ¶¶ 36, 42, 50). However, this is a reference Case 3:21-md-02992-GPC-MSB Document 634-9 Filed 01/09/26 PageID.52039 Page 30 of 37 28 to benefits enrollment fraud rather than transaction fraud. As I explained in Kreis Report at ¶ 34, these are two distinct types of fraud, and cardholder claims based on an unauthorized ATM transactions involve transaction fraud. Yet both the Cronan and Pesce Reports conflate the two to suggest that growth in benefits or enrollment fraud somehow required the Bank to implement a rule related to transaction fraud. (Cronan Report ¶¶ 43-55; Pesce Report ¶¶ 20, 54-59). In my opinion, this reasoning does not hold water. 42. Moreover, as I stated in my opening report, there were and are many different industry-standard strategies that would have been available to the Bank for dealing with a spike in claims, including prioritizing the investigation of higher- dollar-value claims. As I explained in my Opening Report, increasing the dollar value threshold would have alleviated some of the burden the Bank faced in manually investigating claims and would have provided an opportunity to triage the Bank’s exposure to fraud by ensuring it was focused on the most significant claims. Additionally, as I explained, low-dollar-value claims are the least likely to be fraudulent, as fraudsters typically are trying to extract maximum value in each fraudulent transaction. Notably, this strategy of prioritizing the investigation of higher-dollar-value claims would also ensure that legitimate EDD cardholders were timely receiving their funds in their time of need during the Pandemic. Case 3:21-md-02992-GPC-MSB Document 634-9 Filed 01/09/26 PageID.52040 Page 31 of 37 29 43. Another strategy would have been to increase the monetary threshold at which lower dollar value claims are auto-paid. These strategies would have ensured that legitimate EDD cardholders were receiving their much-needed funds, rather than suffering the consequences they were not responsible for creating. The Bank also had sophisticated identity-verification and fraud-detection tools at its disposal.23 Ms. Pesce speculates that increasing the threshold for low-dollar-value transactions would not have solved the problem and would have meant that more unauthorized-transaction claims would be paid out to fraudsters. (Pesce Report ¶ 47). As above, Ms. Pesce’s focus on fraudsters completely ignores legitimate claims and the Bank’s Reg E obligations. CFF-1 denied legitimate claims without the Bank conducting any investigation of the Bank’s own records.24 While increasing the threshold for low-dollar-value transactions might have meant that more unauthorized-transaction claims were paid out, it would also mean fewer legitimate claims being arbitrarily denied, and far fewer legitimate cardholders having to suffer the grave consequence of their EDD card being frozen for extended periods of time.25 23 See Ramirez Tr. 83:24-85:10 and BANA_EDD_MDL-00127437 (referencing the Bank’s Fraud High Risk Verification Process). See also Simpson Tr. 84:21-85:4 (confirming that the Bank had sophisticated tools to authenticate callers); BANA_EDD_MDL-00405158-00405160 and BANA_EDD_MDL-00090722 at -00090723 (Bank documents listing Experian KIQ and Lexis Nexis phone finder as “sophisticated tools to authenticate caller”). 24 See BANA_EDD_MDL-00592327 (describing the CFF as a rule). 25 See BANA_EDD_MDL-00077066 (Bank emails describing a “process gap” that existed when cardholders whose accounts were wrongly frozen applied for reconsideration, resulting in delays in unfreezing the cardholder’s account); Ehresman Tr. 106:2-110:4. Case 3:21-md-02992-GPC-MSB Document 634-9 Filed 01/09/26 PageID.52041 Page 32 of 37 30 44. Ms. Pesce claims that “[l]ocating and hiring trained personnel to address the daunting volume of unauthorized transaction claims over a short timeframe is simply unrealistic” and that “[h]iring enough contractors was also not a viable solution” since consulting firms were implementing cutbacks due to COVID-19. (Pesce Report ¶ 45). Based on over a decade of experience at First Annapolis Consulting and Accenture (which acquired First Annapolis Consulting), I know that consulting firms such as Accenture could have quickly built a team of senior bank experts to train enough analysts to manage the spike in claims the Bank experienced. With hundreds of thousands of employees worldwide, this is well within Accenture’s capability and is exactly the type of full-service solution it provides to banks as an integral part of its business. As I stated in my opening report, Bank of America has long been a highly profitable financial institution; it is the second largest bank in the United States. In my opinion, the Bank has ample resources to bear the costs of implementing strategies other than CFF-1 to deal with the increased claims volume, including increasing the number of claims analysts through professional staffing companies such as Accenture. It is my opinion that Bank could have hired sufficient numbers of highly trained claims analysts in the relevant time from this or another highly specialized global professional services company. Case 3:21-md-02992-GPC-MSB Document 634-9 Filed 01/09/26 PageID.52042 Page 33 of 37 31 45. Prior to implementing CCF-1 on September 28, 2020, the Bank had known for months that the COVID-19 pandemic had resulted in record levels of unemployment and concomitant increases in claims volumes. The Bank had ample time to marshal its resources and respond proactively. It is my opinion that the Bank’s decision to implement CFF-1 in late September 2020 was the result of the Bank’s failures to respond adequately or proactively to these challenges. 46. Mr. Cronan claims that the Bank’s pre-pandemic manual investigation process became “inadequate” in the face of the pandemic. (Cronan Report ¶ 46). Ms. Pesce similarly claims that by the time the Bank was able to complete a manual investigation, the fraudsters would have already stolen the funds. (Pesce Report ¶ 46). As discussed above, both experts seem to assume that the only alternative option to the Bank’s pre-pandemic Reg E compliant manual investigation process was to dispense with a manual investigation. As discussed above, the Bank had many alternative industry standard options available to deal with the foreseeable spike in claims volume and transaction fraud, including hiring the required number of agents to conduct industry standard investigations rather than automatically denying all claims involving an ATM transaction without conducting any investigation. Executed on April 4, 2025. J. DANIEL KREIS Case 3:21-md-02992-GPC-MSB Document 634-9 Filed 01/09/26 PageID.52043 Page 34 of 37 APPENDIX A: MATERIALS RELIED UPON Production Materials BANA_EDD_MDL-00001312 BANA_EDD_MDL-00004535-4580 BANA_EDD_MDL-00004535-4580 BANA_EDD_MDL-00005509-5545 BANA_EDD_MDL-00006482 - 6535 BANA_EDD_MDL-00012738-12739 BANA_EDD_MDL-00028946-28949 BANA_EDD_MDL-00057504-57506 BANA_EDD_MDL-00057837-57878 BANA_EDD_MDL-00077223-77225 BANA_EDD_MDL-00090135-90137 BANA_EDD_MDL-00090640-90647 BANA_EDD_MDL-00090695-90698 BANA_EDD_MDL-00090721-90724 BANA_EDD_MDL-00100390; BANA_EDD_MDL-00100634 -100679 BANA_EDD_MDL-00100506-529 BANA_EDD_MDL-00100530 BANA_EDD_MDL-00100616-00100633 BANA_EDD_MDL-00100634-100679 BANA_EDD_MDL-00100741 BANA_EDD_MDL-00104526 - 104527 BANA_EDD_MDL-00107327-107335 BANA_EDD_MDL-00125177-125179 BANA_EDD_MDL-00125919-125923 BANA_EDD_MDL-00129437-129440 BANA_EDD_MDL-00159469-159474 BANA_EDD_MDL-00163307-163308 BANA_EDD_MDL-00181896 BANA_EDD_MDL-00218256 BANA_EDD_MDL-00225047-225048 BANA_EDD_MDL-00225867 BANA_EDD_MDL-00228914 BANA_EDD_MDL-00273305-273307 BANA_EDD_MDL-00297295 BANA_EDD_MDL-00406128-406130 "BANA_EDD_MDL-00411205, -005560, -00556122, -00556152, -00556324, -00558991, -00558996, -00559094, -00559101; PLFF00000008; Yuan—A-0000003, -0000004" BANA_EDD_MDL-00417487-417490 BANA_EDD_MDL-00450516-450518 Case 3:21-md-02992-GPC-MSB Document 634-9 Filed 01/09/26 PageID.52044 Page 35 of 37 BANA_EDD_MDL-00455617 BANA_EDD_MDL-00510141-510148 BANA_EDD_MDL-00517105-517126 BANA_EDD_MDL-00556536-556537 BANA_EDD_MDL-00559693-559980 BANA_EDD_MDL-00571310 BANA_EDD_MDL-00572766-572770 BANA_EDD_MDL-00592192-592194 BANA_EDD_MDL-00592324-592330 BANA_EDD_MDL-00718756-718770 BANA_EDD_MDL-00863943-863948 BANA_EDDMDL-00003887 - 3911 BANA_EDDMDL-00003912 - 3937 BANA_EDDMDL-00570333 - 570334 BANA_MDD_MDL-00012790 Moore_S_0000367 PLFF00000011 BANA_EDD_MDL-00077066 BANA_EDD_MDL-00127437 BANA_EDD_MDL-00405158 BANA_EDD_MDL-00405159 BANA_EDD_MDL-00405160 BANA_EDD_MDL-00169898 BANA_EDD_MDL-00554835 BANA_EDD_MDL-00159110 BANA_EDD_MDL-00876614 BANA_EDD_MDL-00460916 BANA_EDD_MDL-00501938 BANA_EDD_MDL-00060514 BANA_EDD_MDL-00631444 BANA_EDD_MDL-00417555 Publicly available materials "Employment Development Department Strike Team Detailed Assessment & Recommendations" Order re Preliminary Injunction [Yick, N.D. Cal., Dkt. 89] Order re Preliminary Injunction [Yick, N.D. Cal., Dkt. 103] CFPB Consent Order Order re Motion to Dismiss [Dkt. 126] First Amended Master Consolidated Complaint [Dkt. 136] Defendant's Memorandum of Points and Authorities in Opposition to Plaintiffs' Motion for Class Certification Bank of America Q3-2020 Press Release Alan S. Kaplinsky, "CFPB issues new no-action letter to Upstart" Case 3:21-md-02992-GPC-MSB Document 634-9 Filed 01/09/26 PageID.52045 Page 36 of 37 "Federal Regulators Fine Bank of America $225 Million Over Botched Disbursement of State Unemployment Benefits at Height of Pandemic" Accenture Fact Sheet Fiscal 2025 - First Quarter Discovery BofA's Responses and Objections to Plaintiffs' Fifth Set of Interrogatories BofA's Responses and Objections to Plaintiffs' Fifth Set of Interrogatories (Exhibit 11) Plaintiffs' Revised Rule 30(b)(6) Deposition Notice BofA's Responses and Objections to Plaintiffs' Seventh Set of Interrogatories Transcript of Rule 30(b)(6) Deposition of Shane Daniels Transcript of Rule 30(b)(6) Deposition of Robert Chestnut Transcript of Rule 30(b)(6) Deposition of Matthew Martin Transcript of Rule 30(b)(6) Deposition of Michael Letson Transcript of Rule 30(b)(6) Deposition of William Golden Expert Declaration of Teresa A. Pesce Expert Declaration of Russell Cronan Expert Class Certification Report of J. Daniel Kreis Transcript of Ryan Schwartz Transcript of Anne Holt Transcript of William Fox Transcript of Melissa Ramirez Transcript of Faiz Ahmad Transcript of Paul Simpson Transcript of Jennifer Ehresman Russell Cronan Expert Report (March 4, 2025) Teresa A. Pesce Expert Report (March 4, 2025) Case 3:21-md-02992-GPC-MSB Document 634-9 Filed 01/09/26 PageID.52046 Page 37 of 37
File and source
- File
- gov.uscourts.casd.709615.634.9.pdf
- Size
- 651,717 bytes
- SHA-256
- 54bcfc5d3f36f71c744679444845be677100a95b0020a3628a405900572d947e
- Original
- PACER (login required)