SAN JOSE, Calif. (CN) – A federal judge has allowed the central claims against TurboTax parent Intuit over lax cybersecurity to proceed.
U.S. District Judge Edward Davila on Monday granted in part and denied in part a motion to dismiss filed by Intuit, which faces lawsuits accusing it of lax security protocols that made it easy for cybercriminals to steal individuals’ personal information and file fraudulent tax returns on their behalf.
“Plaintiffs have alleged that Intuit has been conferred benefits through an unfair business practice,” Davila wrote in a 11-page order. “Accordingly, Intuit’s motion to dismiss the unjust enrichment claim is denied.”
The case stems from accusations by at least six plaintiffs that their personal information was stolen by cybercriminals and used to file fraudulent tax returns, causing each of the plaintiffs significant financial and psychological harm and defrauding American taxpayers of enormous sums of money.
But lead plaintiff Christine Diaz doesn’t simply stop there. She says Intuit turned a blind eye to the practice as it sought to enhance its own profits, even if it meant benefiting from patently criminal behavior.
In 2015, Intuit’s chief information security officer told a cybersecurity blogger that 60 percent of their returns flagged for fraudulence were due to people using personal information obtained via identity theft to open false accounts.
Nevertheless, Intuit continued to have relatively few security requirements for people opening new accounts, Diaz says. In fact, she says the company removed multistep authentication, which had historically proven to be one of the more effective bulwarks against criminal practices, despite knowing about the massive fraud.
The company also allowed the re-use of social security codes and did not apply limitations on the number of tax returns single individuals could file, all of which indicated a companywide complicity with the large defrauding of the U.S. government, Diaz says.
While Diaz’s central claims held up to Intuit’s motion to dismiss, it was not all bad news for the company as Davila ordered four of Diaz’s co-plaintiffs to seek arbitration.
Carol Knoch, James Lebinski, David Stock and Marilyn Williams all signed Intuit’s terms of service when they signed up for the TurboTax service, which included an arbitration clause.
“In the present case, the parties’ dispute resolution agreements expressly provide that arbitration will be conducted by the American Arbitration Association before a single AAA arbitrator under the AAA’s rules,” Davila wrote in a separate 6-page order granting a motion to compel arbitration filed by Intuit.
The arbitration clauses in many contracts have come under increasing scrutiny by consumer advocates recently, with many arguing such agreements undermine consumers’ due process entitlements and their right to have their day in court.
Another plaintiff, Richard Brown, also saw his claim dismissed with leave to amend, mostly because Brown was not a TurboTax customer.
“Brown has not alleged facts explaining how Intuit could have or should have known that the account(s) opened in Brown’s name were fraudulent,” Davila wrote in the order.
Also a few of Diaz’s claims, including aiding and abetting fraud and negligent enablement of third party fraud, were also dismissed.
Nevertheless, her central claims, including her claim of negligence, unfair competition and unjust enrichment, will all move forward.