000001/01411998_1 1

UNITED STATES DISTRICT COURT

SOUTHERN DISTRICT OF FLORIDA

CASE NO.: ________________

ALBA HERRERA, on behalf of herself and

all others similarly situated,

Plaintiff,

vs.

TD BANK, N.A.,

Defendant.

CLASS ACTION

JURY TRIAL DEMANDED

CLASS ACTION COMPLAINT

Plaintiff Alba Herrera (“Plaintiff”), individually and on behalf of all others similarly 

situated, by and through counsel, brings this Class Action Complaint (“Complaint”) against 

Defendant TD Bank, N.A. (“TD Bank”) and based upon personal knowledge with respect to 

herself, and on information and belief and the investigation of counsel as to all other matters, in 

support thereof alleges as follows: 

INTRODUCTION

1. Consumers who have never banked with TD Bank have recently discovered that 

TD Bank opened fraudulent accounts using their identity and personal information. The 

consumers were not aware of these accounts being opened, did not authorize them, and in 

Plaintiff’s case, had never even banked with TD Bank in the past. 

2. TD Bank’s practice of allowing unauthorized accounts to be opened without 

minimal verification or security authentication procedures is the latest in a series of abusive and 

fraudulent practices that TD Bank has employed. 

3. In 2016, Wells Fargo was found liable for fraud because its employees were 

Case 1:22-cv-22838-KMW Document 1 Entered on FLSD Docket 09/06/2022 Page 1 of 25
000001/01411998_1 2

opening fake accounts for Wells Fargo customers to drive up profit. Wells Fargo paid billions in 

fines and civil settlements. After the Wells Fargo scandal, big banks like TD Bank pledged that, 

unlike Wells Fargo, their practices were lawful and proper.

4. However, investigations and reports on TD Bank tell a different story. In reality, 

TD Bank has a history and routine practice of opening accounts in the names of consumers without 

lawful authority and permission from the people whose identities were used to open the accounts. 

5. Most recently, unauthorized third parties have capitalized on TD Bank’s loose 

practices by using TD Bank’s Online Banking platform to open fraudulent checking and savings 

accounts with consumers’ stolen Personal Identifying Information (“PII”)1(the “Unauthorized 

Account Openings”). 

6. In February 2022, residents of the Sandhills area in North Carolina began receiving 

checks, debit cards, statements, and welcome letters from TD Bank. The residents were shocked 

because they had never opened accounts with TD Bank, and the nearest TD Bank branch was 100 

miles away in South Carolina. TD Bank never reached out to them to confirm identity before 

opening the accounts.

7. The local authorities opened an investigation and determined that over 1,000 

Sandhills residents’ names were used open unauthorized TD Bank accounts.

8. As will be more fully explained below, Plaintiff and members of the Class have 

been significantly injured by the Unauthorized Account Openings and have incurred out-of-pocket 

expenses associated with the reasonable mitigation measures they were forced to employ. Plaintiff 

1 The Federal Trade Commission defines “identifying information” as “any name or number that may be 

used, alone or in conjunction with any other information, to identify a specific person,” including, among 

other things, “[n]ame, Social Security number, date of birth, official State or government issued driver’s 

license or identification number, alien registration number, government passport number, employer or 

taxpayer identification number.” 17 C.F.R. § 248.201(b)(8). 

Case 1:22-cv-22838-KMW Document 1 Entered on FLSD Docket 09/06/2022 Page 2 of 25
000001/01411998_1 3

and the Class have also incurred damage to their credit. 

9. Plaintiff and the Class also face identity theft and damages associated with identity 

theft because their PII has fallen into the hands of cybercriminals. TD Bank’s negligent practices 

allowed cybercriminals to open fraudulent accounts using TD Bank’s Online Banking platform. 

10. On behalf of herself and the Class preliminarily defined below, Plaintiff brings 

causes of action sounding in negligence, violations of the Fair Credit Reporting Act, and violations 

of the Electronic Funds Transfer Act. TD Bank’s failure to safeguard and properly authenticate 

those consumers’ PII—including but not limited to their name, Social Security Number, date of 

birth, and government-issued identifications number—enabled unauthorized third parties to 

commit identity theft. Plaintiff seeks damages and injunctive and declaratory relief arising from 

TD Bank’s failure to safeguard the PII of thousands of consumers, resulting in the identity theft of 

those consumers, damage to their credit, and associated harms. 

PARTIES

11. Plaintiff Alba Herrera is a natural person who lives in Cutler Bay, Florida, and is 

therefore a citizen of Florida. 

12. Defendant TD Bank is a national bank with its headquarters and principal place of 

business located in Cherry Hill, New Jersey and is therefore a citizen of New Jersey. Among other 

things, TD Bank is engaged in the business of providing retail banking services to consumers. TD 

Bank operates banking centers, and thus conducts business, throughout the State of Florida, 

including within this District. 

JURISDICTION AND VENUE

13. Subject matter jurisdiction is proper in this Court pursuant to 28 U.S.C. §1331 

based on the federal statutes that Plaintiff claims were violated. It is also proper pursuant to the 

Case 1:22-cv-22838-KMW Document 1 Entered on FLSD Docket 09/06/2022 Page 3 of 25
000001/01411998_1 4

Class Action Fairness Act, 28 U.S.C. § 1332(d), because the matter in controversy exceeds 

$5,000,000.00, exclusive of interest and costs, and is a class action in which at least one member 

of the class (Ms. Herrera) is a citizen of a State different from the Defendant. The number of 

members of the proposed Class in aggregate exceeds 100 consumers. 28 U.S.C. § 1332(d)(5)(B).

14. This Court has personal jurisdiction over TD Bank because TD Bank regularly 

conducts and/or solicits business in, engages in other persistent courses of conduct in, and/or 

derives substantial revenue from products and/or services provided to persons in this District and 

in Florida. 

15. Venue is proper in this Court pursuant to 28 U.S.C. § 1391(b)(2) because a 

substantial part of the events or omissions giving rise to the claims occurred in this District – where 

Plaintiff lives. 

FACTUAL ALLEGATIONS 

A. TD Bank’s Online Banking Platform Allows Unauthorized Third Parties to “Open an 

Account in Minutes”

16. Defendant TD Bank is one of the ten largest banks in the U.S. and provides over 

9.8 million consumers “with a full range of retail, small business and commercial banking products 

and services.”2 

17. TD Bank is licensed to do business in over fifteen states and the District of 

Columbia, and has over 1,100 locations throughout the Northeast, Mid-Atlantic, Metro D.C., the 

Carolinas, and Florida. 

18. TD Bank accumulates and manages highly sensitive PII of consumers through its 

banking services and products. 

2 See TD Bank’s Business Profile, dated July 31, 2022 (attached as Exhibit A). 

Case 1:22-cv-22838-KMW Document 1 Entered on FLSD Docket 09/06/2022 Page 4 of 25
000001/01411998_1 5

19. In collecting and maintaining consumer PII, TD Bank both implicitly and explicitly 

agrees it will safeguard the data using reasonable means according to its internal policies and 

federal and state law. 

20. Despite recognizing its duty to do so, TD Bank has not implemented reasonable 

cybersecurity safeguards or policies to protect consumer PII, or trained its employees to prevent, 

detect, and stop unauthorized third parties from opening fraudulent accounts on TD Bank’s Online 

Banking platform. As a result, TD Bank leaves vulnerabilities in its systems for unauthorized third 

parties to exploit consumer PII and commit identity theft. 

21. This is the case even though TD Bank is aware of the importance of authenticating 

the personal information it accumulates in its ordinary course of business. Indeed, TD Bank 

ensures consumers that it provides a “secure online experience that protects [its] public website 

and Online Banking.” TD Bank states that it uses “industry-accepted practices” which allows it 

to “authenticate [consumers’] identity when they access TD Bank’s online and mobile services”3:

3 See https://www.td.com/us/en/personal-banking/security-center (last visited September 2, 2022).

Case 1:22-cv-22838-KMW Document 1 Entered on FLSD Docket 09/06/2022 Page 5 of 25
000001/01411998_1 6

22. Despite its assertion that “the security of [consumers’] personal information and 

[its] website is [its] top priority,” TD Bank’s Online Banking platform has minimal security 

requirements in place before allowing a new account to be opened online. 

23. In fact, TD Bank’s Online Banking platform allows consumers to “open a checking 

account online in minutes.”4 TD Bank does not make any attempts to reach out to an individual 

to confirm his or her identity before opening a new account. Under TD Bank’s Online Banking 

platform, consumers and cybercriminals can open a checking account with only a social security 

number, a picture of a government-issued ID, and an individual’s personal information. 

24. TD Bank’s account opening security protocols are so lax that it allows unauthorized 

third parties to open an account with expired phone numbers and expired IDs, and addresses that 

are no longer current. No phone call, Zoom meeting, or personal contact is otherwise made by TD 

4

“Open a Checking Account Online in Minutes | TD Bank Checking Accounts,”

https://www.td.com/us/en/personal-banking/checking-accounts (last visited September 2, 2022). 

(Attached as Exhibit B). 

Case 1:22-cv-22838-KMW Document 1 Entered on FLSD Docket 09/06/2022 Page 6 of 25
000001/01411998_1 7

Bank to an account applicant before an account is opened.

25. Conversely, it is much more difficult to close an account with TD Bank once an 

account has already been opened. An individual must go to a branch in person and present 

identification to close an account.

B. TD Bank Causes Identity Theft by Allowing Unauthorized Accounts to be Opened 

using Plaintiff and the Class Members’ PII

26. Plaintiff and the members of the Class are consumers who are victims of 

Unauthorized Account Openings at TD Bank under their identities, without their knowledge or 

authorization. 

27. TD Bank collects and maintains PII in its systems for the purpose of opening and 

maintaining checking, savings, and investment accounts. 

28. TD Bank represents to consumers that it takes adequate measures to secure 

individuals’ PII and properly authenticate information it receives. 

29. Despite its duties and alleged commitments to safeguard PII, TD Bank does not 

follow industry standard practices in securing consumers’ PII. 

C. The 2022 Sandhills Unauthorized Account Openings 

30. TD Bank’s practice of allowing fake accounts to be opened without authorization 

or approval has been occurring on a large scale since at least February 2022. 

31. In February 2022, residents of the Sandhills area in North Carolina began receiving 

checks, debit cards, statements, and welcome letters from TD Bank. The residents were shocked 

because they had never opened accounts with TD Bank, and the nearest TD Bank branch was 100 

miles away in South Carolina. 

32. The local authorities opened an investigation and determined the Sandhills 

residents whose names were used to open TD Bank accounts were victims of identity fraud (the 

Case 1:22-cv-22838-KMW Document 1 Entered on FLSD Docket 09/06/2022 Page 7 of 25
000001/01411998_1 8

“Sandhills Unauthorized Account Openings”). 

33. Cybercriminals bypassed TD Bank’s inadequate security systems on its Online 

Banking platform and fraudulently opened multiple checking and savings accounts under 

consumers’ identities.

34. The vast majority of the victims of the Sandhills Unauthorized Account Opening 

were not TD Bank customers and had never banked with TD Bank. 

35. By February 2022, it was estimated that over 1,000 residents in the Sandhills area 

had their identities stolen due to fake TD Bank accounts being opened in their names.5

36. Since the Sandhills Unauthorized Account Openings occurred, many Sandhills 

victims have struggled to get TD Bank to close their accounts. The victims were told by TD Bank 

that the fake accounts had been closed, but the victims continued to receive text messages and 

correspondence related to the fraudulent accounts. The fraudulent accounts often still appeared as 

being “active” on the victims’ credit reports. 

D. The Unauthorized Account Openings are the Latest in a Long Series of TD Bank’s 

Fraudulent and Abusive Practices 

37. Despite its declaration that “the security of [consumers’] personal information and 

its website is [its] top priority,”6 TD Bank has a track record of prioritizing its own profits over 

protecting consumers’ financial and personal information. 

38. On May 4, 2022, Capitol Forum reported on TD Bank’s abusive compensation and 

incentivization system, which uses a “points system” that rewards employees for placing profits 

5 Keely Arthur, Hundreds in Sandhills Area Victims of Fraudulent Bank Accounts, CAR LINK MALL (Feb. 

25, 2022), https://www.carlinkmall.com/hundreds-in-sandhills-area-victims-of-fraudulent-bankaccounts-wral-com.

6 See https://www.td.com/us/en/personal-banking/security-center (last visited September 2, 2022).

Case 1:22-cv-22838-KMW Document 1 Entered on FLSD Docket 09/06/2022 Page 8 of 25
000001/01411998_1 9

over fair service for consumers and permitted TD Bank employees to create new accounts for 

customers.7 The program “incentivized employees to open as many accounts and push as many 

customers into overdraft protection as possible, threatening employees with lost bonuses or even 

firings if goals were not met.”8

39. In 2016, Wells Fargo was accused of creating millions of accounts for their 

customers without the customers’ consent or knowledge, “leading to billions paid in civil and 

criminal probes, the resignation of Wells Fargo CEO John Stumpf, and the imposition of a growth 

cap by the Federal Reserve.” 

40. Shockingly, the Capital Forum Report uncovered that in 2016-2017, the Office of 

the Comptroller of the Currency (“OCC”) found that TD Bank had been using similar tactics as 

Wells Fargo. Specifically, the OCC’s investigation found that TD Bank “was one of a handful of 

retail financial institutions that had systemic problems in its account opening, verification, and 

sales processes,” and that its “problematic account practices stretched across retail branches from 

Maine to Florida.”

41. According to the Report, the Acting Comptroller, for political reasons, failed to 

issue a fine or even require public disclosure of these practices and instead the OCC privately 

reprimanded TD Bank. 

E. Plaintiff’s Experience

42. Plaintiff Herrera is a Florida citizen. 

7 The Capitol Forum, “TD Bank/First Horizon: Faulty Accounts Didn’t Draw Fines From Trump Official; 

Workers Say Suspect Practices Persis as Deal Approvals Sought,” (May 4, 2022) 

https://thecapitolforum.com/td-bank-first-horizon-faulty-accounts-didnt-draw-fines-from-trump-officialsworkers-say-suspect-practices-persist-as-deal-approvals-sought/

8 Letter to OCC Acting Comptroller Hsu (June 14, 2022) (Attached as Exhibit C). 

Case 1:22-cv-22838-KMW Document 1 Entered on FLSD Docket 09/06/2022 Page 9 of 25
000001/01411998_1 10

43. On July 8, 2022, Plaintiff received an email from TD Bank thanking her for opening 

new accounts with them. See Exhibit D (July 8, 2022 Email). Specifically, the email contained 

information regarding two new accounts that had been opened using her identity: (1) a TD 

Convenience Checking account, and (2) a TD Simple Savings account. 

44. Plaintiff was not aware that the accounts had been opened and did not authorize the 

opening of the accounts.

45. Plaintiff has never been a TD Bank customer. 

46. Upon information and belief, unauthorized third parties accessed Plaintiff’s PII 

from an unknown source and used her PII to open the checking and savings accounts under 

Plaintiff’s name, using TD Bank’s Online Banking platform. 

47. TD Bank allowed the unauthorized third party to open an account under Plaintiff’s 

identity using an expired phone number, expired ID, and an address that was no longer current. 

48. Once Plaintiff realized that the above accounts had been opened using her identity, 

Plaintiff took numerous time-consuming steps in attempt to mitigate the damage, including: 

a. Calling and reporting the Unauthorized Account Openings to the TD Bank Fraud 

hotline;

b. Taking time off work;

c. Going to the nearest TD Bank Branch to close the unauthorized accounts;

d. Reporting the identity theft to the FBI;

e. Reporting the identity theft to local police; 

f. Freezing credit accounts;

g. Changing passwords;

h. Monitoring accounts; and

Case 1:22-cv-22838-KMW Document 1 Entered on FLSD Docket 09/06/2022 Page 10 of 25
000001/01411998_1 11

i. Signing up for credit monitoring services.

49. Despite how easy it was for an unauthorized third party to open TD Bank accounts 

in Plaintiff’s name, closing the unauthorized accounts was very burdensome to Plaintiff. TD 

Bank’s Fraud Department never returned the call Plaintiff placed to report the Unauthorized 

Account Opening. Only after Plaintiff went to a TD Bank branch in person and presented 

identification did TD Bank close the unauthorized accounts.

50. To date, TD Bank has offered no compensation or explanation as to how these 

unauthorized accounts were opened. TD Bank also has not provided Plaintiff any credit monitoring 

services.

51. Plaintiff and the proposed Class have suffered and will continue to suffer damages, 

including monetary losses, lost time, and effort. They have suffered, or are at an increased risk of 

suffering:

a. The loss of the opportunity to control how their PII is used;

b. The diminution in value of their PII;

c. The compromise and continuing publication of their PII;

d. Out-of-pocket costs associated with the prevention, detection, recovery, and 

remediation from identity theft or fraud;

e. Lost opportunity costs and lost wages associated with the time and effort expended 

addressing and trying to mitigate the actual and future consequences of the 

Unauthorized Account Opening, including, but not limited to, efforts researching 

how to prevent, detect, contest, and recover from identity theft and fraud;

f. Unauthorized use of stolen PII; and

g. The continued risk to their PII, which remains in the possession of TD Bank and is 

Case 1:22-cv-22838-KMW Document 1 Entered on FLSD Docket 09/06/2022 Page 11 of 25
000001/01411998_1 12

subject to further fraud so long as TD Bank fails to undertake the appropriate 

measures to protect the PII in its possession; and

h. Current and future costs related to the time, effort, and money that will be expended 

to prevent, detect, contest, remediate and repair the impact of the Unauthorized 

Account Opening for the remainder of the lives of Plaintiff and Class members.

52. For example, Plaintiff has spent time, effort, and money to report in person the 

Unauthorized Account Opening to TD Bank, the FBI, and local police department. Plaintiff has 

signed up for credit monitoring through Experian, TransUnion, and Equifax. Plaintiff works on a 

commission basis. Her salary is directly correlated with the hours she works and calls to potential 

customers. Plaintiff has lost money based on the time she has spent away from work on her efforts 

to mitigate the impact of the Unauthorized Account Opening.

53. Defendant failed to protect the PII of Plaintiff and members of the proposed Class 

from criminal activity. Specifically, Defendant failed to authenticate the PII of Plaintiff and 

members of the proposed Class to prevent them from being exploited by third parties engaged in 

disruptive and unlawful business practices and tactics, including online account hacking, 

unauthorized use of financial accounts, and fraudulent attempts to open unauthorized financial 

accounts (i.e., identity fraud), all using the stolen PII. 

54. TD Bank’s use of outdated and insecure security protocols that are easy to hack, 

and its failure to maintain adequate security measures and an up-to-date technology security 

strategy, demonstrates a willful and conscious disregard for privacy, and has allowed the 

Unauthorized Account Opening. 

55. Further, TD Bank’s failure to timely detect that consumers’ PII was used to commit 

the Unauthorized Account Opening and remedy the inadequate security systems after the Sandhills 

Case 1:22-cv-22838-KMW Document 1 Entered on FLSD Docket 09/06/2022 Page 12 of 25
000001/01411998_1 13

Unauthorized Account Opening demonstrates its nonchalant approach to cybersecurity and its 

institutional disregard for data protection.

56. Defendant’s failure to properly notify Plaintiff and members of the proposed Class 

of the Unauthorized Account Opening exacerbated Plaintiff’s and members of the proposed 

Class’s injury by depriving them of the earliest ability to take appropriate measures to protect their 

PII and take other necessary steps to mitigate the harm caused by the Unauthorized Account 

Opening.

57. TD Bank’s practice of opening unauthorized accounts has caused significant 

financial losses, reputational and credit reporting damage, and related stress and hardship to Class 

members. Specifically, TD Bank has:

a. Allowed unauthorized electronic fund transfers or withdrawals from customer 

accounts;

b. Placed or caused to be placed erroneous and derogatory information in credit 

reports when unauthorized accounts were opened, closed, or utilized.

58. As a result of the Unauthorized Account Opening, Plaintiff now faces, and will 

continue to face, a heightened risk of identity theft, fraud, and damaged credit in the future.

F. TD Bank Failed to Adhere to FTC Guidelines or Industry Standards

59. According to the Federal Trade Commission (“FTC”), the need for data security 

should be factored into all business decision-making.

9

 To that end, the FTC has issued numerous 

guidelines identifying best data security practices that businesses, such as TD Bank, should employ 

to protect against the unlawful exposure of PII.

60. In 2016, the FTC updated its publication, Protecting Personal Information: A 

9 Start with Security: A Guide for Business, FED. TRADE COMM’N (Sep. 2, 2015), 

https://www.ftc.gov/system/files/documents/plain-language/pdf0205-startwithsecurity.pdf.

Case 1:22-cv-22838-KMW Document 1 Entered on FLSD Docket 09/06/2022 Page 13 of 25
000001/01411998_1 14

Guide for Business, which established guidelines for fundamental data security principles and 

practices for business.10 The guidelines explain that businesses should:

a. protect the personal customer information that they keep; 

b. properly dispose of personal information that is no longer needed; 

c. encrypt information stored on computer networks; 

d. understand their network’s vulnerabilities; and 

e. implement policies to correct security problems.

61. The FTC recommends that companies not maintain PII longer than is needed for 

authorization of a transaction; limit access to sensitive data; require complex passwords to be used 

on networks; use industry-tested methods for security; monitor for suspicious activity on the 

network; and verify that third-party service providers have implemented reasonable security 

measures.11

62. The FTC has brought enforcement actions against businesses for failing to 

adequately and reasonably protect customer data, treating the failure to employ reasonable and 

appropriate measures to protect against unauthorized access to confidential consumer data as an 

unfair act or practice prohibited by Section 5 of the Federal Trade Commission Act (“FTCA”), 15 

U.S.C. § 45. Orders resulting from these actions further clarify the measures businesses must take 

to meet their data security obligations.

63. TD Bank’s failure to employ reasonable and appropriate measures to protect against 

unauthorized use of consumers’ PII by allowing the Unauthorized Account Opening constitutes 

an unfair act or practice prohibited by Section 5 of the FTCA, 15 U.S.C. § 45.

10 Protecting Personal Information: A Guide for Business, FED. TRADE COMM’N (Sep. 28, 2016), 

https://www.ftc.gov/system/files/documents/plain-language/pdf-0136_proteting-personal-information.pdf.

11 See Start with Security, supra note 30.

Case 1:22-cv-22838-KMW Document 1 Entered on FLSD Docket 09/06/2022 Page 14 of 25
000001/01411998_1 15

64. As a long-standing member of the banking community, and being one of the 

nation’s largest banks, TD Bank knew or should have known the importance of safeguarding 

consumer PII and of the foreseeable consequences of identity theft. Despite this knowledge, 

however, TD Bank failed to take adequate cyber-security measures to prevent the Unauthorized 

Account Opening from happening.

65. TD Bank has not provided any compensation to consumers victimized by the 

Unauthorized Account Opening; offered to provide any assistance or compensation for the costs 

and burdens — current and future — associated with the identity theft and fraud resulting from the 

Unauthorized Account Opening; or taken any other effort to assist the Plaintiff and Class members 

from repairing their credit. 

CLASS ACTION ALLEGATIONS

66. Plaintiff brings this action on behalf of herself and all others similarly situated 

pursuant to Fed. R. Civ. Proc. 23. The Class is preliminarily defined as: 

All individuals who had a checking or savings account opened under their identity 

by TD Bank without their authorization using PII for Unauthorized Account 

Opening via TD Bank’s online banking platform. 

67. Excluded from the Class are TD Bank and its subsidiaries and affiliates, officers, 

directors and members of their immediate families and any entity in which it has a controlling 

interest, the legal representatives, heirs, successors or assigns of any such excluded party, the 

judicial officer(s) to whom this action is assigned, and the members of their immediate families.

68. Plaintiff reserves the right to modify or amend the definition of the proposed Class 

and/or to add a subclass(es) if necessary, before this Court determines whether certification is 

appropriate.

69. Fed. R. Civ. Proc. 23(a)(1) Numerosity: The Class is so numerous such that joinder 

Case 1:22-cv-22838-KMW Document 1 Entered on FLSD Docket 09/06/2022 Page 15 of 25
000001/01411998_1 16

of all members is impracticable. Upon information and belief, and subject to class discovery, the 

Class consists of over 1,000 consumers who have had an unauthorized account(s) opened in their 

name at TD Bank, the identity of whom are within the exclusive knowledge of and can be 

ascertained only by resort to TD Bank’s records. TD Bank has the administrative capability 

through its computer systems and other records to identify all members of the Class, and such 

specific information is not otherwise available to Plaintiff.

70. Fed. R. Civ. Proc. 23(a)(2) Commonality and Fed. R. Civ. Proc. 23(b)(3) 

Predominance: There are numerous questions of law and fact common to the Class. As such, there 

is a well-defined community of interest among the members of the Class. These questions 

predominate over questions that may affect only individual members of the Class because TD 

Bank has acted on grounds generally applicable to the Class. Such common legal or factual 

questions include, but are not limited to:

a. Whether TD Bank had a duty to safeguard and authenticate consumer PII at the 

time of account opening;

b. Whether TD Bank knew or should have known of the susceptibility of TD Bank’s 

online account enrollment program to fraudulent accounts; 

c. Whether TD Bank’s security measures to detect fraud were reasonable and met 

industry standards;

d. Whether TD Bank was negligent in failing to implement reasonable and adequate 

security procedures and practices;

e. Whether TD Bank’s failure to implement adequate data security measures allowed 

the Unauthorized Account Opening to occur;

f. Whether TD Bank’s conduct, including its failure to act after the Sandhills 

Case 1:22-cv-22838-KMW Document 1 Entered on FLSD Docket 09/06/2022 Page 16 of 25
000001/01411998_1 17

incident, resulted in or was the proximate cause of Unauthorized Account 

Opening, resulting in the unlawful use of the Plaintiff’s and Class members’ PII;

g. Whether Plaintiff and Class members were injured and suffered damages or other 

losses because of TD Bank’s failure to reasonably protect and authenticate 

consumers’ PII at account opening;

h. Whether Plaintiff and Class members are entitled to relief;

i. Whether TD Bank failed to adequately notify Class members of the use of their 

PII;

j. Whether TD Bank breached its duty to Class members by failing to properly 

safeguard their PII and by failing to notify them of Unauthorized Account 

Opening;

k. Whether TD Bank’s violation of EFTA and FCRA constitutes evidence of 

negligence; and

l. Whether TD Bank placed or caused to be placed erroneous and derogatory 

information in credit reports when unauthorized accounts were opened, closed, or 

utilized.

71. Fed. R. Civ. Proc. 23(a)(3) Typicality: Plaintiff’s claims are typical of the claims of 

all Class members, because all such claims arise from the same set of facts regarding TD Bank’s 

wrongful conduct in allowing unauthorized accounts to be opened.

72. Fed. R. Civ. Proc. 23(a)(4) Adequacy: Plaintiff will fairly and adequately protect 

the interests of the Class. Plaintiff is a more than adequate representative of the Class in that 

Plaintiff is a victim of the Unauthorized Account Opening, has incurred reasonable mitigation 

damages as a result of the Unauthorized Account Opening, and brings the same claims on behalf 

Case 1:22-cv-22838-KMW Document 1 Entered on FLSD Docket 09/06/2022 Page 17 of 25
000001/01411998_1 18

of herself and the putative Class. Plaintiff has no interests antagonistic to that of the Class 

members. Plaintiff has retained counsel who are competent and experienced in litigating class

actions, including class actions following data breaches and unauthorized data use (i.e., identity 

fraud) and against banks, and specifically TD Bank. Plaintiff intends to vigorously prosecute this 

case and will fairly and adequately protect the Class’s interests.

73. Fed. R. Civ. Proc. 23(b)(2) Injunctive and Declaratory Relief: TD Bank has acted 

or refused to act on grounds generally applicable to the Class, thereby making appropriate final 

injunctive relief or corresponding declaratory relief with respect to the Class as a whole.

74. Fed. R. Civ. Proc. 23(b)(3) Superiority: It is impracticable to bring Class members’ 

individual claims before the Court. Class treatment permits a large number of similarly situated 

persons to prosecute their common claims in a single forum simultaneously, efficiently and without 

the unnecessary duplication of evidence, effort, expense, or the possibility of inconsistent or 

contradictory judgments that numerous individual actions would engender. The benefits of the 

class mechanism, including providing injured persons or entities with a method for obtaining 

redress on claims that might not be practicable to pursue individually, substantially outweigh any 

difficulties that may arise in the management of this class action.

75. A class action is superior to the other available methods for the fair and efficient 

adjudication of this controversy because:

a. The unnamed members of the Class are unlikely to have an interest in individually 

controlling the prosecution of separate actions;

b. Concentrating the litigation of the claims in one forum is desirable;

c. Plaintiff anticipates no difficulty in the management of this litigation as a class 

action; and

Case 1:22-cv-22838-KMW Document 1 Entered on FLSD Docket 09/06/2022 Page 18 of 25
000001/01411998_1 19

d. Plaintiff’s legal counsel has the financial and legal resources to meet the substantial 

costs and legal issues associated with this type of litigation.

76. Plaintiff knows of no unique difficulty to be encountered in the prosecution of this 

action that would preclude its maintenance as a class action.

77. Fed. R. Civ. Proc. 23(c)(4) Issue Certification: Likewise, particular issues under 

Rule 23(c)(4) are appropriate for certification because such claims present only particular, common 

issues, the resolution of which would advance the disposition of this matter and the parties’ 

interests therein. Such issues include, but are not limited to:

a. Whether TD Bank owed a legal duty to Plaintiff and the Class to exercise due care 

in safeguarding their PII and to not allow unauthorized accounts to be opened in 

their names;

b. Whether TD Bank’s security measures to protect its Online Banking system from 

opening unauthorized accounts was reasonable considering best practices 

recommended by industry experts;

c. Whether TD Bank’s failure to institute adequate protective security and 

authentication measures allowing Unauthorized Account Opening amounted to 

negligence;

d. Whether TD Bank failed to take commercially reasonable steps to safeguard and 

authenticate consumer PII because of the Unauthorized Account Opening; and

e. Whether adherence to FTC data security recommendations and industry standards 

on data security would have reasonably prevented the Unauthorized Account 

Opening.

78. Finally, all members of the proposed Class are readily ascertainable. TD Bank has 

Case 1:22-cv-22838-KMW Document 1 Entered on FLSD Docket 09/06/2022 Page 19 of 25
000001/01411998_1 20

access to consumer names and addresses affected by the Unauthorized Account Opening. Using 

this information, Class members can be identified and ascertained for the purpose of providing 

constitutionally sufficient notice.

CAUSES OF ACTION

FIRST CLAIM FOR RELIEF

NEGLIGENCE

(On behalf of Plaintiff and the Class) 

79. Plaintiff repeats and incorporates by reference paragraphs 1-78.

80. TD Bank, one of the ten largest banks in the U.S., is no novice to the widespread 

fraud committed every day by unauthorized third parties by opening unauthorized accounts.

81. The Wells Fargo scandal and banking industry investigations and scrutinization that 

followed, put TD Bank on notice that it has a duty to protect innocent consumers’ financial and 

personal information. 

82. TD Bank had full knowledge of the sensitivity of the PII and the types of harm that 

Plaintiff and Class members could and would suffer if the PII was used to open unauthorized 

accounts.

83. TD Bank had a duty to exercise reasonable care in safeguarding, securing, and 

protecting such information from being compromised, lost, stolen, misused, and/or disclosed by 

unauthorized parties. This duty includes, inter alia, designing, maintaining and testing its Online 

Banking protocols to ensure that Plaintiff and Class members’ PII was adequately screened, 

authenticated, and protected and that employees tasked with processing such information were 

adequately trained on cyber security measures regarding consumer PII.

84. Especially considering the Sandhills Unauthorized Account Openings, Plaintiff and 

the Class members were the foreseeable and probable victims of any inadequate security practices 

and procedures that TD Bank employed. TD Bank knew of or should have known of (a) the 

Case 1:22-cv-22838-KMW Document 1 Entered on FLSD Docket 09/06/2022 Page 20 of 25
000001/01411998_1 21

inherent risks in collecting and processing the PII of Plaintiff and the Class, (b) the critical 

importance of providing adequate security of that PII, (c) that TD Bank had inadequately trained 

its employees, and (d) that TD Bank security protocols were insufficient to protect the PII of 

Plaintiff and Class members because TD Bank failed to verify that PII was authorized to be used 

to open TD checking and savings accounts.

85. TD Bank’s own conduct created a foreseeable risk of harm to Plaintiff and Class 

members. TD Bank’s misconduct included, but was not limited to, its failure to take the steps to 

prevent the unauthorized account opening as set forth herein, foremost being to verify that the PII 

was authorized to be used by the person whose PII was used. TD Bank’s misconduct also included 

its decision that it would not comply with industry standards for the safekeeping and authentication 

of consumer PII, which reasonably would have prevented the Unauthorized Account Opening.

86. Section 5 of the FTC Act prohibits “unfair...practices in or affecting commerce,” 

including, as interpreted and enforced by the FTC, the unfair act or practice by businesses, such as 

TD Bank, of failing to use reasonable measures to protect PII. The FTC publications and orders 

described above also form part of the basis of TD Bank’s duty in this regard.

87. TD Bank further violated Section 5 of the FTC Act by failing to use reasonable 

measures to protect consumer PII and not complying with applicable industry standards, as 

described herein. TD Bank’s conduct was particularly unreasonable given the nature and amount 

of PII it received using its Online Banking system and stored, and the foreseeable consequences 

of the Unauthorized Account Opening including, specifically, the damages that would result to 

Plaintiff and Class members if third parties were permitted to open and use bank accounts.

88. Plaintiff and the Class members had no ability to prevent the Unauthorized Account 

Opening because TD Bank never took the simple act of contacting them to confirm identity and 

Case 1:22-cv-22838-KMW Document 1 Entered on FLSD Docket 09/06/2022 Page 21 of 25
000001/01411998_1 22

account opening authorization before account opening.

89. TD Bank breached its duty to Plaintiff and the Class by failing to exercise ordinary 

and reasonable care in protecting and safeguarding their PII while it was within TD Bank’s

possession or control.

90. TD Bank unlawfully breached its duty to Plaintiff and Class members by failing to 

have appropriate procedures in place to detect and prevent unauthorized use of consumers’ PII to 

open accounts.

91. TD Bank also unlawfully breached its duty to adequately disclose to Plaintiff and 

Class members the existence and scope of the Unauthorized Account Openings.

92. But for TD Bank’s wrongful and negligent breach of duties owed to Plaintiff and 

Class members, Plaintiff and Class Members’ PII would not have been exploited and the damages 

caused by the Unauthorized Account Openings would not have occurred.

93. As a result of TD Bank’s negligence, Plaintiff and the Class have suffered and will 

continue to suffer damages and injury including, but not limited to, out-of-pocket expenses 

associated with mitigating against the Unauthorized Account Opening, such as time off work and 

lost sales commissions, time spent monitoring accounts and changing passwords, effort spent 

signing up for credit monitoring services, damage to credit, and other current and future 

consequences of the Unauthorized Account Opening. 

94. These harms are directly and proximately caused by the Unauthorized Account 

Opening. 

SECOND CLAIM FOR RELIEF

VIOLATIONS OF THE FAIR CREDIT REPORTING ACT

(On behalf of Plaintiff and the Class)

95. Plaintiff repeats and incorporates by reference paragraphs 1-78 above.

Case 1:22-cv-22838-KMW Document 1 Entered on FLSD Docket 09/06/2022 Page 22 of 25
000001/01411998_1 23

96. Under the Fair Credit Reporting Act (“FCRA”), TD Bank has a duty to provide 

accurate information regarding checking or savings accounts to the credit reporting agencies and 

a duty to adequately investigate a dispute upon notice. See 15 U.S.C. §§ 1681s-2(a), (b). 

97. TD Bank methodically reports the status of all customer accounts to one or more 

credit reporting agencies. For example, TD Bank does business with Early Warning Services, LLC 

(“Zelle”). TD Bank also has claimed to utilize the services of all three of the major general credit 

reporting bureaus, Equifax, Experience, and TransUnion.

98. Reporting an account as open to the credit bureaus when the account was in fact 

opened without authorization, violates the FCRA.

99. Reporting transactions from an unauthorized account to a credit bureau violates the 

FCRA.

100. Despite the clear and unambiguous requirements of the FCRA, Defendant regularly 

provides inaccurate information regarding checking accounts to one or more credit reporting 

agencies and fails to adequately investigate or authenticate unauthorized and illegal accounts.

101. Pursuant to 15 U.S.C. §§ 1681n and 1681o, and all other provisions of the FCRA, 

TD Bank is liable for negligently and willfully violating the FCRA. All legal and equitable relief 

under the FCRA is appropriate in light of the continuing egregious conduct of TD Bank. 

THIRD CLAIM FOR RELIEF

VIOLATIONS OF THE ELECTRONIC FUNDS TRANSFER ACT

(On behalf of Plaintiff and the Class) 

102. Plaintiff repeats and incorporates by reference paragraphs 1-78.

103. Congress created the Electronic Funds Transfer Act (“EFTA”), 15 U.S.C. § 1693, 

et seq., in order to establish a framework to regulate electronic fund and remittance transfer 

systems, and to establish individual consumer rights related to electronic fund transfers.

Case 1:22-cv-22838-KMW Document 1 Entered on FLSD Docket 09/06/2022 Page 23 of 25
000001/01411998_1 24

104. Pursuant to EFTA, “No person may issue a consumer any card, code, or other means 

of access to such consumer’s accounts for the purpose of initiating an electronic fund transfer other 

than (1) in response to a request or application therefor; or (2) as a renewal of, or in substitution 

for, an accepted card, code, or other means of access, whether issued by the initial issuer or a 

successor.” 15 U.S.C. § 1693i(a).

105. TD Bank has violated and continues to violate this prohibition every time it opens 

unauthorized accounts, issues debit and/or credit cards for such accounts, or facilitates any means 

of access to the unauthorized accounts allowing for electronic funds transfers. 

106. TD Bank has violated EFTA each time it made an electronic fund transfer without 

full disclosure of all terms to the customer and customer approval of the account. 15 U.S.C. §§ 

1693i(a).

107. Pursuant to 15 U.S.C. 1693m, and other provisions of EFTA, TD Bank is liable for 

actual damages and statutory damages of not less than $100 nor greater than $1,000 based on the 

frequency, persistence, and outrageousness of its actions. Plaintiff and the Class is also entitled to 

reimbursement for her legal fees and expenses.

PRAYER FOR RELIEF

WHEREFORE, Plaintiff, individually and on behalf of the Class as heretofore identified, 

respectfully prays this Honorable Court for judgment as follows:

A. Certification for this matter to proceed as a class action on behalf of the proposed Class 

under Fed. R. Civ. Proc. 23; 

B. Designation of Plaintiff as Class Representative and designation of the undersigned as 

Class Counsel;

C. Actual, statutory, punitive, or exemplary damages in an amount according to proof;

Case 1:22-cv-22838-KMW Document 1 Entered on FLSD Docket 09/06/2022 Page 24 of 25
000001/01411998_1 25

D. Injunctive or declaratory relief;

E. Pre- and post-judgment interest at the maximum rate permitted by applicable law;

F. Costs and disbursements assessed by Plaintiff in connection with this action, including 

reasonable attorneys’ fees pursuant to applicable law; 

G. For attorneys’ fees under the common fund doctrine and all other applicable law; and

H. Such other relief as this Court deems just and proper.

DEMAND FOR JURY TRIAL

Plaintiff, on behalf of herself and the Class, hereby demand a trial by jury pursuant to 

Fed. R. Civ. Proc. 38(b) on all claims so triable.

Dated: September 6, 2022 Respectfully submitted,

/s/ Jeff Ostrow

Jeff Ostrow (FBN 121452)

Jonathan M. Streisfeld (FBN 117447)

KOPELOWITZ OSTROW P.A.

One W. Las Olas Blvd., Suite 500

Fort Lauderdale, Florida 33301

Telephone: (954) 525-4100

Facsimile: (954) 525-4300

ostrow@kolawyers.com

streisfeld@kolawyers.com

Lynn A. Toops*

Amina A. Thomas*

Lisa M. La Fornara*

COHEN & MALAD, LLP 

One Indiana Square 

Suite 1400 

Indianapolis, IN 46204 

Telephone: (317) 636-6481 

ltoops@cohenandmalad.com

athomas@cohenandmalad.com

llafornara@cohenandmalad.com

*pending pro hac vice admission

Counsel for Plaintiff and the Proposed Class

Case 1:22-cv-22838-KMW Document 1 Entered on FLSD Docket 09/06/2022 Page 25 of 25