23-721-cv Suluki v. Credit One Bank, NA

UNITED STATES COURT OF APPEALS FOR THE SECOND CIRCUIT

August Term 2023 (Argued: June 26, 2024 Decided: May 28, 2025) Docket No. 23-721-cv

KHALILAH SULUKI, Plaintiff-Appellant, v. CREDIT ONE BANK, NA, Defendant-Appellee, CAPITAL ONE BANK, NA, COMENITY CAPITAL BANK, Defendants.

ON APPEAL FROM THE UNITED STATES DISTRICT COURT FOR THE SOUTHERN DISTRICT OF NEW YORK

Before: CHIN, SULLIVAN, and ROBINSON, Circuit Judges.

Appeal from a judgment of the United States District Court for the Southern District of New York (Stein, J.) dismissing plaintiff-appellant's claims under the Fair Credit Reporting Act, which alleged that defendant-appellee bank failed to conduct a reasonable investigation into her dispute claiming identity theft committed by her mother. Plaintiff contends that a reasonable investigation would have led to a finding that the account was fraudulent. The district court granted summary judgment to the bank, concluding first that, putting aside the actual reasonableness of the bank's investigation, no reasonable investigation required by the statute would have yielded a different result; and second that plaintiff did not present any triable issues of fact as to whether the bank willfully or negligently violated the statute so as to be liable to her for damages.

AFFIRMED.

ALISA TIWARI (Matthew W.H. Wessler, on the brief), Gupta Wessler LLP, Washington, DC; Leonard A.

Bennett and Craig Carley Marchiando, on the brief, Consumer Litigation Associates, P.C., Newport News, VA; and Abel L. Pierre, on the brief, Law Office of Abel L. Pierre, P.C., New York, NY, for Plaintiff-Appellant.

HEIDI E. SIEGMUND (Matthew A. Fitzgerald, Philip A.

Goldstein, and Jarrod D. Shaw, on the brief), McGuireWoods LLP, New York, NY, Richmond, VA, and Pittsburgh, PA, for Defendant-Appellee.

RYAN COOPER, Senior Counsel (Steven Y. Bressler, Deputy General Counsel, Kristin Bateman, Assistant General Counsel, and Seth Frotman, General Counsel, on the brief), Washington, DC, for Amicus Curiae Consumer Financial Protection Bureau; and Anisha S. Dasgupta, General Counsel, Mariel Goetz, Acting Director of Litigation, and Bradley Dax Grossman, Attorney, Washington, DC, on the brief, for Amicus Curiae Federal Trade Commission, in support of Plaintiff- Appellant.

CHIN, Circuit Judge: In this case, a daughter alleges that her mother stole her identity to fraudulently open and use a credit card account in her name. Plaintiff-appellant Khalilah Suluki ("Suluki") claims that her mother, Khadijah Suluki ("Khadijah"), opened several credit card accounts in her name without her permission at various banks, including defendant-appellee Credit One Bank, N.A. ("Credit One"). Upon discovering the alleged fraud, Suluki disputed the account both by calling Credit One and by notifying the three major national credit reporting agencies (the "CRAs"): Equifax, Experian, and Trans Union.

Credit One investigated her dispute multiple times. Its investigators concluded that the account was legitimate and that it belonged to Suluki. Suluki filed suit, alleging, inter alia, that Credit One violated the Fair Credit Reporting

Act (the "FCRA"), 15 U.S.C. § 1681 et seq., by failing to conduct a reasonable investigation into her dispute. See 15 U.S.C. § 1681s-2(b)(1).

The parties cross-moved for summary judgment. The district court denied Suluki's motion and granted summary judgment in favor of Credit One.

Suluki v. Credit One Bank, NA, 666 F. Supp. 3d 403, 409-10, 412-15 (S.D.N.Y. 2023).

The court concluded that, even though there were genuine issues of material fact as to the accuracy of the information reported and the reasonableness of Credit One's investigations, summary judgment in Credit One's favor was still appropriate because no reasonable jury could find that any reasonable investigation would have led Credit One to determine that the account was fraudulent or that the information was unverifiable. See id. at 410-14. The district court also concluded that Suluki could not recover damages because she did not present evidence from which a reasonable jury could find that Credit One willfully or negligently violated the FCRA. Id. at 412-15.

On appeal, Suluki contends that the district court erred principally in two ways: first, by concluding that Credit One would not have come to a different conclusion had it conducted a reasonable investigation, and second, in holding that Credit One did not willfully violate the FCRA. Suluki accuses

Credit One of taking a "cookie-cutter" approach to investigating her dispute by concluding its inquiry after it found only two "superficial links" between her and the account. Plaintiff-Appellant Br. at 27. She claims that, had Credit One conducted what she considers to be a reasonable investigation, it would have concluded that Khadijah stole Suluki's identity to create and use the account, or that the information was at least unverifiable.

We are not persuaded. The FCRA requires furnishers to conduct investigations into consumer disputes, but it does not guarantee that the results of those investigations will favor the consumer lodging the dispute. And to that end, the FCRA does not require furnishers to conduct perfect investigations -- it requires only that furnishers conduct reasonable investigations.

We agree with the district court that there is a genuine issue of material fact as to whether the information on Suluki's credit report is accurate, i.e., whether Khadijah indeed opened and used the account without Suluki's permission, as Suluki and Khadijah provided conflicting statements. Even assuming, however, that Khadijah opened the account in Suluki's name without her daughter's permission, we conclude that no reasonable investigation into Suluki's claim would have led Credit One to a different conclusion. And,

because we also determine as a matter of law that even assuming the FCRA was violated, no jury could conclude that the violation was willful or negligent, Suluki is not entitled to damages.

Accordingly, we AFFIRM the judgment of the district court.

BACKGROUND I. The Facts 1 A. The Credit One Account At some point prior to her beginning college in 2014, Suluki discussed with Khadijah opening a credit card account in Suluki's name so that she could begin building credit. Following Khadijah's advice, Suluki applied for her first credit card with Discover Bank when she began college. Khadijah helped Suluki prepare for the application process and was present when Suluki applied for the card. Khadijah also assisted Suluki when she applied for other credit cards at retail stores like Century 21 and American Eagle. Suluki made payments on her credit cards using money that Khadijah sent her while she was

We present the facts in the light most favorable to Suluki, with all factual ambiguities resolved and all reasonable inferences drawn in her favor. See Martinez v. Agway Energy Servs., LLC, 88 F.4th 401, 406 n.2 (2d Cir. 2023). away at college. Khadijah also opened a Credit One account with Suluki's sister, Taheerah, so that Taheerah could build her credit as well.

On November 2, 2017, an individual filled out an online form to open a credit card with Credit One. The applicant input Suluki's name, birthdate, the address of her childhood home in Brooklyn, her Social Security number, and the email address "[email protected]." J. App'x at 218. The card was first used in December 2017, in Brooklyn, and remained open for over 18 months. Account statements show that the card was most often used for miscellaneous purchases at retail stores and restaurants in the Brooklyn area.

Every month, someone made minimum or partial payments on the card from a Chase bank account that Suluki and Khadijah shared. In August 2020, after Suluki had alleged identity theft and disputed her account, the card's balance was paid in full.

B. Suluki's Allegations of Identity Theft In July 2019, Suluki applied to rent an apartment and was rejected. 2 That denial prompted her to take a closer look at her credit, and she pulled credit

2 In March 2019, three months before Suluki discovered the alleged fraud, she and her family went on vacation to Puerto Rico for her birthday. During the trip, Suluki and her family got into a fight. Upon their return, Khadijah kicked Suluki out of the family home. reports from Experian, Equifax, and Trans Union. Upon reviewing the reports, she was "dismayed to discover that while she was attending college, she was the victim of identity theft, as [Khadijah] opened various accounts in [Suluki's] name and maxed out some of [Suluki's] pre-existing accounts." Id. at 10. One of those accounts was a Credit One card.

On July 6, 2019, Suluki called Credit One to report that she had not opened the account. She stated that she did not know who opened the account.

She initially gave the representative a different telephone number than the one associated with the account, but then was able to confirm that her mother's telephone number was the number for the account. The representative advised her that there was a balance on the account of $562.47, and he confirmed with her that she was filing a report indicating that the card was on a fraudulent account for which she had not applied. At some point thereafter, Suluki advised Credit One that her mother used her information to open the account without her permission or knowledge. 3 Credit One closed Suluki's account "in accordance

3 Suluki's briefs on appeal do not explain what motive Khadijah could have had for opening cards in Suluki's name without her permission. But at her deposition, Suluki stated that "money has always been a problem" and speculated that Khadijah may have done it to fund an Airbnb she was building in her house. J. App'x at 57. with its normal policy." Id. at 211. It opened an investigation and requested that she obtain a police report. 4 Suluki visited the precinct on West 8th Street in Coney Island to file a police report, but officers told her she could not file a report without certain paperwork from Credit One. As a result of this "back and forth," Suluki decided not to obtain a report. Id. at 58-59. By the end of the summer, she had called Credit One "two, maybe three" times to report the fraud, and she retained a lawyer. Id. at 57.

At some point after Suluki reported the identity theft, Credit One called Khadijah and left her messages. In response, Khadijah called Credit One on July 25, 2019, and told Credit One that the account was not fraudulent.

Khadijah told the Credit One representative that she and Suluki opened the account together when Suluki was in college, with the understanding that Khadijah would make payments on the card to assist Suluki with building her credit. Khadijah told the representative that there was no forgery or fraud, that

The record includes a transcript of a call that Suluki made to Credit One on July 6, 2019, as well as a recording of part of a telephone call that Suluki made to Credit One on July 20, 2019. In neither call, as reflected in the transcript and recording, respectively, does Suluki explicitly accuse her mother of fraudulently opening the account. As discussed below, she did identify her mother as a suspect in later correspondence. she had been paying the amount due every month, and would remain responsible for paying off the account balance. The representative advised her that the account had already been closed and that the outstanding balance was $562.47.

On August 15, 2019, in response to Suluki's allegations, Credit One requested information from her and provided a form affidavit for her to complete. The letter also asked for a copy of an "Identity Theft Report" filed "with [Suluki's] local police department (or another Federal, State, or Local law enforcement agency) or the U.S. Postal Inspector." Id. at 140. On August 29, 2019, Suluki completed and submitted the affidavit but did not provide an identity theft report. She represented in the affidavit that "I did not apply for this credit card, nor . . . was I aware of these charges." Id. at 141. She identified the "suspect" as "Khadijah Suluki," but then filled in her own name and social security number in the blank below. Id. On November 10, 2019, apparently with the assistance of her attorneys, Suluki sent letters to Experian, Equifax, and Trans Union disputing the portion of her credit report that included her Credit One account. The letters stated, in pertinent part:

My mother used my information and opened accounts in my name without me ever agreeing to that. She opened a century 21 account with my information. She did this when I was away at college.

That's why she was able to get the card and use it . . . . My mother also opened a Credit One account. The C21 account was used [without] my consent.

Id. at 144. 5 Suluki did not attach an identity theft report to the CRA dispute letters.

On April 28, 2020, Suluki disputed her account again by sending another round of dispute letters to the CRAs. The letters stated that Khadijah "opened up a capital one and credit one account" and "never made the charges or used the century 21 account." Id. at 194. Suluki, however, did not include new information or an identity theft report. Id. In the meantime, Credit One continued to receive regular and, for the most part, timely payments on the account until it was paid off in full in August 2020.

C. Credit One's Investigations Credit One's notes recording the activity in the account (the "Notes") confirm that Credit One received a call on July 6, 2019 from Suluki. The call

The above-quoted language comes from the copy of the letter Suluki sent to Experian. Suluki sent the "same exact packet" to Trans Union and Equifax. J. App'x at 62. triggered an investigation, which resulted in the conclusion that the cardholder, that is, Suluki, was "responsible" for the account. Id. at 273. The Notes confirm that Suluki called again on July 20, 2019, and advised that she had not opened the account. They confirm further that Khadijah called on July 25, 2019, identifying herself as the "mother" and saying she would take responsibility for the balance due on the account. Id. The Notes show further investigation by Credit One, including after receiving Suluki's affidavit of fraud. Finally, the Notes indicate that Suluki was sent a letter on or about September 17, 2019, advising her that she was deemed responsible for the account.

There were additional investigations, as Credit One received notice of Suluki's disputes from the CRAs via an automated computer dispute verification ("ACDV"). An ACDV "is an automated request to verify, update, or delete trade line information in a consumer's credit report." Id. at 213. Consumer disputes submitted through ACDVs are transmitted to CRAs, who then convey them to furnishers. It is Credit One's policy to investigate "each ACDV that claims fraud." Id. 6

Some Credit One fraud investigators are Credit One employees, and others are third-party vendors who Credit One hires and trains in their fraud investigation procedures. John Perry, a Credit One fraud specialist whose investigation of Suluki's

Credit One received six ACDVs from the CRAs relating to Suluki's disputes -- four within nearly a week of each other in November 2019 and two a few days apart in May 2020. Where multiple identical disputes are received via an ACDV within a 30-day period, Credit One generally conducts a full investigation on the first ACDV, and relies on the results of that investigation to resolve subsequent identical disputes.

Credit One employees John Perry and Adoria Reaux conducted investigations of the disputes received from the CRAs on November 29, 2019, and May 13, 2020, respectively. All investigations into Suluki's dispute followed the same procedure, and all investigators concluded that there was no fraud.

Once a Credit One investigator receives a dispute based on identity theft, he or she conducts the investigation by reviewing (1) the ACDV itself, including the dispute code at issue; (2) all documents that accompany the ACDV; (3) information from Credit One's databases; and (4) information about the consumer available through databases like Experian and LexisNexis ("Lexis").

Credit One's policy instructed investigators to use "both internal and external

dispute we discuss in more detail below, testified that he and all other Credit One fraud investigators receive about two weeks of "classroom-style training" upon hiring, "training required by law of the yearly annual updates," and biweekly meetings during which investigators are alerted to any new policies or procedures. J. App'x at 155. sources" to "identify any potential links to the person(s) committing fraudulent activity." Id. at 204 (noting that "[a]t least two strong links are required when holding a consumer responsible" and "[l]inks should always be relevant to the consumer's claim"). The Notes are also available for the investigators to review.

When Perry reviewed Suluki's November 29, 2019 dispute after receiving notice from Experian, he began by reviewing the ACDV and the dispute code attached to it. The dispute code "103" indicated that Suluki was alleging that her Credit One account was fraudulently opened. Id. at 199-200.

He then reviewed the documents that Experian transmitted with the ACDV. In this case, those documents included Suluki's dispute letter and "illegible" copies of her driver's license and Social Security card. Id. at 200.

Perry then reviewed information pertaining to Suluki and her account in Credit One's internal databases, confirming that the Social Security information Suluki provided in her ACDV matched the number on her account.

He reviewed Credit One's application database, which has a "fraud" tab for each application received. The fraud tab reflects an Early Warning Services ("EWS") score, which is a third-party data point that predicts fraudulent activity. A higher score can indicate fraudulent activity; the EWS score on Suluki's count

was zero. The fraud tab also contains "Precise ID Fraud Shield Indicators" for each account -- another metric of potential fraudulent activity. Id. If there are more than three "T" indicators present, Credit One investigators initiate "an especially careful and thorough investigation." Id. Here, there were only two "T" indicators present.

Credit One's application database included a "Red Flag" tab, which "indicates whether any phone numbers or e-mail addresses associated with a particular application . . . were also used on any other Credit One applications." Id. If the "Red Flag" tab shows other applications used the same identifiers as the disputed account or fraudulent activity associated with accounts linked to those identifiers, then investigators are alerted that the disputed account may also be fraudulent. Here, the "Red Flag" tab showed that the phone number and email address were associated with Taheerah's account but did not otherwise flag any suspicious activity or indicators of fraud, and Taheerah's account was open and current.

Finding no initial red flags or other indicators of fraud, Perry next reviewed the payment history on the account. He noted that the account had a "history of payments," and that "[i]n [his] experience, consistent on-time

payments are highly unusual in identity theft cases." Id. at 201. He also observed that there were no disputed charges on the account. Searching Credit One's phone database, Perry noted that the same phone number listed on the application was used to open the account, and had been used for payments.

After conducting a review of Credit One's internal databases, Perry used Lexis to verify the information -- the Social Security number, address, and phone number -- associated with Suluki's account. The Lexis search established that Suluki's association with the address and phone number on the account predated the opening of the account. Based on the above findings, Perry "determined that the evidence supported a finding that Ms. Suluki was responsible for the Account." Id. at 202. Accordingly, he responded to the ACDV that Credit One's reporting was accurate.

Reaux's investigation into the April 2020 dispute was substantially similar to Perry's. After she independently followed Credit One's procedures, she reached the same conclusion that there was no fraud and Suluki was deemed responsible.

II. Proceedings Below On February 9, 2021, Suluki filed a complaint (the "Complaint") in the district court below against Capital One Bank, Comenity Capital Bank, and Credit One, alleging violations of the FCRA. On April 8, 2021, Credit One answered the Complaint. Suluki voluntarily dismissed her claims against Capital One and Comenity Bank on September 22, 2021, and on October 14, 2021, respectively.

After the parties engaged in discovery, Suluki moved for summary judgment contending that: (1) Credit One's reporting to the CRAs that the account belonged to Suluki was inaccurate as a matter of law; (2) Credit One failed to properly report the results of its investigation to the CRAs; and (3) Credit One's investigation of her identity theft claim was unreasonable as a matter of law. Credit One moved for summary judgment contending that: (1) its investigation was reasonable as a matter of law; and (2) whether or not its investigation was reasonable, it did not act willfully and therefore damages were unwarranted.

The district court denied Suluki's motion and granted Credit One's.

See Suluki, 666 F. Supp. 3d at 410, 412. The court held that there was a genuine

issue of material fact as to whether the information was accurate, and accordingly it denied Suluki's motion for summary judgment on accuracy. Id. at 409-11. The court also denied Suluki's motion for summary judgment to the extent she argued that Credit One's investigation was unreasonable as a matter of law. Id. at 412.

The district court, however, granted Credit One's motion for summary judgment on the basis of causation, concluding that no reasonable jury could find that, had Credit One conducted a reasonable investigation, its investigators could have concluded that Suluki was not responsible for the account. Id. at 412-15; see id. at 414 ("Suluki has not presented any facts showing that, had Credit One taken any of the additional steps she urges, it would have come to a different conclusion."). In so holding, the district court also rejected Suluki's claims that Credit One willfully or negligently violated the FCRA and concluded therefore that she was not entitled to damages. Id. at 414-15.

This appeal followed.

DISCUSSION I. The Applicable Law A. Standard of Review "We review a district court's grant of summary judgment de novo where the parties filed cross-motions for summary judgment and the district court granted one motion but denied the other." Zhang Jingrong v. Chinese Anti- Cult World Alliance Inc., 16 F.4th 47, 56 (2d Cir. 2021) (quoting Atlas Air, Inc. v. Int'l Bhd. of Teamsters, 943 F.3d 568, 576-77 (2d Cir. 2019)). "We evaluate each party's motion on its own merits, taking care in each instance to draw all reasonable inferences against the party whose motion is under consideration." Byrne v. Rutledge, 623 F.3d 46, 53 (2d Cir. 2010) (internal citation and quotation marks omitted). We may affirm the grant of summary judgment in favor of one party only if we conclude that on the record presented, considered in the light most favorable to the other party, no reasonable jury could have found in favor of the latter. Zhang Jingrong, 16 F.4th at 56-57. Summary judgment is proper, and we will affirm, where "the movant shows that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law." Fed. R. Civ. P. 56(a).

B. The FCRA Congress enacted the FCRA "to ensure fair and accurate credit reporting, promote efficiency in the banking system, and protect consumer privacy." Safeco Ins. Co. of Am. v. Burr, 551 U.S. 47, 52 (2007). The FCRA places obligations on three distinct entities in the consumer-lending ecosystem: furnishers of consumer credit information to CRAs, the CRAs themselves, and users of consumer credit reports. Furnishers include banks, card issuers, and other financial institutions that transmit information relating to debts owed by consumers to CRAs for reporting. See Galper v. JP Morgan Chase Bank, NA, 802 F.3d 437, 445 (2d Cir. 2015). Furnishers of consumer information are subject to obligations under Sections 1681s-2(a) and (b). Section 1681s-2(b) is relevant to this appeal. 7

Section 1681s-2(a) provides that where a consumer disputes the accuracy of information on her credit report, furnishers "may not furnish the information to any consumer reporting agency without notice that such information is disputed by the consumer." 15 U.S.C. § 1681s-2(a)(3). The FCRA explicitly bars private rights of action to enforce Section 1681s-2(a). See id. § 1681s-2(d); Longman v. Wachovia Bank, N.A., 702 F.3d 148, 151 (2d Cir. 2012) ("[T]he statute plainly restricts enforcement of [section 1681s-2(a)] to federal and state authorities."). Accordingly, the district court properly held that Suluki cannot bring a claim against Credit One for failing to report to the CRAs that Suluki disputed the account. Suluki, 666 F. Supp. 3d at 411-12. Suluki does not challenge this ruling on appeal.

Section 1681s-2(b) governs a furnisher's duty to investigate after receiving notice of a consumer dispute from a CRA. 15 U.S.C. § 1681s-2(b). 8 When a consumer disputes the accuracy of their credit report with a CRA, the CRA must provide the furnisher with "all relevant information" regarding the dispute. 15 U.S.C. § 1681i(a)(2)(A). Once the CRA notifies the furnisher that there is a dispute, the furnisher must (1) investigate the disputed information; (2) report the results of the investigation to the CRA; and (3) take corrective steps if the information is inaccurate, incomplete, or impossible to verify. 15 U.S.C. § 1681s-2(b)(1).

Notably, Section 1681s-2(b) does not set out guidelines for the furnisher's investigation, as it merely provides that the furnisher "shall . . . conduct an investigation with respect to the disputed information." 15 U.S.C. § 1681s-2(b)(1)(A). Courts, including ours, however, have read into the section a reasonableness requirement. Longman, 702 F.3d at 151 (noting that furnishers have a "duty to reasonably investigate and verify that the information is

This duty arises only when the furnisher receives notice of a dispute from a CRA.

See Sprague v. Salisbury Bank & Tr. Co., 969 F.3d 95, 99 (2d Cir. 2020); see also SimmsParris v. Countrywide Fin. Corp., 652 F.3d 355, 358 (3d Cir. 2011) ("Notice under § 1681i(a)(2) must be given by a credit reporting agency, and cannot come directly from the consumer."). accurate"); accord Johnson v. MBNA Am. Bank, NA, 357 F.3d 426, 431 (4th Cir. 2004); Gorman v. Wolpoff & Abramson, LLP, 584 F.3d 1147, 1157 (9th Cir. 2009); Felts v. Wells Fargo Bank, NA, 893 F.3d 1305, 1312 (11th Cir. 2018) ("The appropriate touchstone for evaluating a furnisher's investigation under [Section] 1681s-2(b) is reasonableness." (internal citation and quotation marks omitted)).

We have not elaborated on what it means to conduct a reasonable investigation, but the question is not a complicated one. "[A] reasonable procedure is one 'that a reasonably prudent person would undertake under the circumstances.'" Seamans v. Temple Univ., 744 F.3d 853, 864 (3d Cir. 2014). This inquiry is fact-dependent and turns in part on "what [the furnisher] learned about the nature of the dispute from the description in the CRA's notice of dispute." Frederick v. Capital One Bank (USA), N.A., No. 14-CV-5460 (AJN), 2018 WL 1583289, at *7 (S.D.N.Y. Mar. 27, 2018) (alteration in original) (quoting Gorman, 584 F.3d at 1157); see also, e.g., Chiang v. Verizon New England Inc., 595 F.3d 26, 38 (1st Cir. 2010). The provided description, however, should not "cabin[] the scope of the investigation once undertaken." Gorman, 584 F.3d at 1157 n.11. "[T]he term 'investigation' itself denotes a 'fairly searching inquiry,' or at least something more than a merely cursory review." Boggio v. USAA Fed. Sav.

Bank, 696 F.3d 611, 616 (6th Cir. 2012) (citing Gorman, 584 F.3d at 1155-57); Johnson, 357 F.3d at 430-31.

Considering this context-dependent inquiry, reasonableness is "generally a question for a finder of fact," Gorman, 584 F.3d at 1161; see also Hinkle v. Midland Credit Mgmt., Inc., 827 F.3d 1295, 1303 (11th Cir. 2016) ("[T]he question of whether the furnisher behaved reasonably . . . is a factual question, and it will normally be reserved for trial."). Summary judgment in favor of the furnisher, however, is appropriate where no reasonable factfinder could conclude that the investigation was unreasonable. See Gorman, 584 F.3d at 1157.

Even assuming an investigation is not reasonable, courts have also concluded that summary judgment in favor of the furnisher is appropriate if a reasonable investigation would not have yielded a different result. See Felts, 893 F.3d at 1313 ("[A] plaintiff asserting a claim against a furnisher for failure to conduct a reasonable investigation cannot prevail on the claim without demonstrating that had the furnisher conducted a reasonable investigation, the result would have been different." (emphasis in original)); Frazier v. Dovenmuehle Mortg., Inc., 72 F.4th 769, 775, 776 n.3 (7th Cir. 2023) (collecting cases).

In essence, a court granting summary judgment to a furnisher after concluding that no reasonable investigation would have yielded a different outcome does so based on causation; if there is no genuine dispute of material fact about whether a reasonable investigation would have revealed the inaccuracy of the disputed information, then there is no nexus between the furnisher's unreasonable investigation and the inaccuracy that caused the plaintiff damages. See Chiang, 595 F.3d at 41 (noting that FCRA plaintiff was "required to present evidence of actual inaccuracies in his account that an alternative investigation might have uncovered"); see also Casella v. Equifax Credit Info. Servs., 56 F.3d 469, 474–75 (2d Cir. 1995) (holding that FCRA plaintiff must show "causation between the harm alleged" and the "alleged violation[] of the FCRA").

To recover damages, a plaintiff must show that the violation of the FCRA was willful or negligent. A defendant who willfully violates the FCRA is liable for actual damages, punitive damages, and attorneys' fees. 15 U.S.C. § 1681n(a). A defendant who negligently violates the FCRA is liable only for actual damages and attorneys’ fees. 15 U.S.C. § 1681o.

II. Application Like the district court, we do not reach the issue of whether Credit One correctly determined that Suluki was responsible for the account because there was no fraud. On this record, we agree there is a genuine issue of material fact as to the accuracy of the determination. See Suluki, 666 F. Supp. 3d at 410.

The conflicting testimony from Suluki, Khadijah, and Taheerah creates a genuine issue of fact as to whether Khadijah opened the account with Suluki's permission or whether she did so without Suluki's knowledge and consent.

Even assuming the information provided by Credit One was inaccurate, however, the inaccuracy was not, by itself, sufficient to create liability under the FCRA, for the FCRA "is not a strict liability statute." Obabueki v. Choicepoint, Inc., 236 F. Supp. 2d 278, 285 (S.D.N.Y. 2002); accord Abdallah v. LexisNexis Risk Sols. FL Inc., No. 19-CV-3609 (MKB), 2021 WL 6197060, at *6 (E.D.N.Y. December 30, 2021) ("[M]erely reporting inaccurate information is insufficient to give rise to liability under the FCRA, as the Act is not a strict liability statute."). The FCRA simply requires a reasonable investigation, and a furnisher is not liable for reporting inaccurate information unless its investigation was not reasonable. Moreover, even where an investigation turns

out to be unreasonable, a plaintiff asserting a claim against a furnisher must still "demonstrat[e] that had the furnisher conducted a reasonable investigation, the result would have been different, i.e., that the furnisher would have discovered that the information it reported was inaccurate or incomplete." Felts, 893 F.3d at 1313. Without such a showing, "a plaintiff's claim against a furnisher necessarily fails, as the plaintiff would be unable to demonstrate any injury from the allegedly deficient investigation." Id. Both parties moved for summary judgment as to whether Credit One's investigation was reasonable. The district court concluded that "there [is] a factual dispute about the adequacy of the steps taken by Credit One to investigate Suluki's claims." Suluki, 666 F. Supp. 3d at 413. We do not reach the question of whether Credit One's investigation was reasonable as a matter of law, because we hold, as the district court held, id. at 414, that no reasonable investigation into Suluki's claims would have led Credit One to reach a different conclusion about Suluki's account. We likewise hold that no reasonable jury could find that Credit One willfully violated the FCRA, thereby precluding an award of punitive damages for Credit One's purportedly unreasonable investigation.

A. Causation Even assuming there are genuine issues of fact as to the reasonableness of Credit One's investigation, Suluki has not shown the existence of a genuine issue of fact as to whether a reasonable investigation would have uncovered additional evidence that would have led Credit One to determine that Khadijah opened the account in Suluki's name without her permission. See Felts, 893 F.3d at 1313.

On appeal, Suluki contends that Credit One failed to consider various pieces of information – "[her] affidavit, direct links to [Khadijah] in the account information, and evidence that [Khadijah] was actively using the credit card" – that would have resulted in a different investigative result. Plaintiff- Appellant's Br. at 33. We disagree.

For starters, the record unequivocally shows that Credit One did review this evidence. The Notes make several references in August and September of 2019 to the receipt of the "affidavit of fraud," and Credit One's policy (which Perry followed) requires its investigators to "[r]eview . . . an affidavit [that] was received in relation to the claim." J. App'x at 206.

But even assuming the Credit One investigators overlooked this evidence, a reasonable jury could not have concluded that Credit One would have reached a different result. First, the affidavit was flawed on its face due to Suluki's failure to follow the affidavit's instructions. Both Credit One's cover letter and the affidavit itself instructed Suluki to provide "an identity theft report" that had been submitted to law enforcement. J. App'x at 140 (cover letter stating "you are required to file an identity theft report with your local police department (or another Federal, State, or Local law enforcement agency) or the U.S. Postal Inspector"); id. at 141 (affidavit warning that the "Identity Theft Report filed with law enforcement . . . must be provided with this affidavit" (emphasis in original)). Yet despite such explicit instructions, Suluki did not submit the identity theft report. Suluki also failed to follow the affidavit's express directive to "initial all transaction(s) not authorized by [her]." Id. at 141 (emphasis in original). Even in the section where she was supposed to include the name of the suspected fraudster, she wrote both her and Khadijah's name and then listed her own social security number instead of Khadijah's. See id. On

the basis of such an error-ridden affidavit, no reasonable investigator would have concluded that Suluki was not responsible for the account. 9 Second, it cannot be said that the "direct links" between Khadijah and the account necessarily suggested fraud. It is true, as Suluki points out, that the phone number, physical address, and email address connected to the account belonged to Khadijah. But both the phone number and physical address were also associated with Suluki. Even the email address on its face ([email protected]) suggests that it belonged to (Khalilah) Suluki. And while Suluki stresses that Khadijah made payments for the account from her own phone and that Credit One possessed the recordings of those calls, the fact remains that Khadijah was making payments from a joint account to which both she and Suluki had access. See id. at 53 (Suluki testifying that the payments on the card came from the joint account that she shared with Khadijah). Suluki's arguments in no way obscure the fact that payments were made regularly and on

9 Though not binding precedent, DeSiena v. Pennsylvania Higher Educ. Assistance Agency, No. 22-1956, 2023 WL 4044109 (2d Cir. June 16, 2023) (summary order), supports our conclusion. There, a panel of this Court affirmed the district court's grant of summary judgment in a furnisher's favor, concluding that "an affidavit [by the consumer] stating that she did not sign for the Loan . . . without more, does not demonstrate that the [furnisher] failed to conduct a reasonable investigation." Id. at *2. (internal citation and quotation marks omitted). time by a person related to her from a joint account to which she had access.

Ultimately, a reasonable investigator would not rely on these “direct links” to conclude that someone other than Suluki was responsible for the account.

Third, the purchase details and payment history do not compel a different conclusion. As Credit One notes in its brief, most of the purchases on the account were consistent with a purchaser matching Suluki's demographic: a college-aged female from Brooklyn. In fact, many of the purchases on the account were made at retail stores in Brooklyn, such as American Eagle, Adidas, and Uniqlo. See, e.g., id. at 233 (bill showing purchase at American Eagle Outfitters); id. at 243 (purchase at Uniqlo); id. at 249 (transaction at Adidas).

Based on this record, no reasonable investigator would have concluded that Suluki was not responsible for the account.

In short, even with the benefit of discovery, Suluki did not present evidence to show that there were reasonable steps that Credit One could and should have taken or that there was additional evidence that it could or would have found that would have shown that Khadijah opened the account without Suluki's permission. Because no reasonable investigation would have led to a different result, summary judgment in favor of Credit One was appropriate.

B. Damages Suluki also challenges the district court's determination that she is not entitled to damages because no reasonable jury could find that Credit One willfully or negligently violated the FCRA. On appeal, Suluki argues that Credit One willfully violated the FCRA because it followed a rigid "blueprint" for its investigations and did not sufficiently change its investigative procedures after a federal judge found its processes to be unreasonable. Like the district court below, we disagree.

Section 1681n of the FCRA provides that "[a]ny person who willfully fails to comply with any requirement imposed under this subchapter with respect to any consumer is liable to that consumer" for "any actual damages sustained by the consumer as a result of the failure or damages of not less than $100 and not more than $1,000" and punitive damages. 15 U.S.C. § 1681n(a). In Safeco, the Supreme Court concluded that, in the context of Section 1681n, willfulness includes "not only knowing violations of [the statute], but reckless ones as well" 551 U.S. at 57. Conduct is "reckless" when it "violat[es] an objective standard," id. at 68, and entails "an unjustifiably high risk of harm that is either known or so obvious that it should be known." Farmer v. Brennan, 511 U.S. 825,

836 (1994). The Court in Safeco reasoned that, given the FCRA's "less-than- pellucid" text, an entity subject to the FCRA does not act willfully unless its "reading was [] objectively unreasonable." 551 U.S. at 70.

Here, Suluki has not presented evidence from which a reasonable jury could find that Credit One acted in willful or reckless violation of the FCRA.

As explained in detail above, Credit One investigated Suluki's dispute pursuant to its protocols and based on the information available to its investigators.

Though Suluki attempts to characterize Credit One's investigations as recklessly cursory, we are convinced that no reasonable jury could find that, on this record, Credit One's investigations posed an "unjustifiably high risk" of an erroneous conclusion. Farmer, 511 U.S. at 836; accord Safeco Ins. Co. of Am., 551 U.S. at 68.

Credit One responded to each of Suluki's allegations of fraud by reviewing information from internal and external sources before ultimately determining that she was responsible for the account. Indeed, as outlined above, Suluki fails to point to any information that Credit One overlooked that would have led it to a different conclusion. On this record, we simply cannot say that Credit One acted in willful or reckless violation of the FCRA. See Safeco Ins. Co. of Am., 551 U.S. at 69; see also Grayson v. Equifax Credit Info. Servs., No. 18-CV-6977 (MKB),

2021 WL 2010398, at *6 (E.D.N.Y. Jan. 29, 2021) (rejecting plaintiff's claim that a CRA willfully violated its duties under the FCRA when it "request[ed] additional information and documentation for the purpose of verifying an alleged identity theft" where consumer's original documentation "lack[ed] sufficient detail").

We also reject Suluki's argument that Wood v. Credit One Bank, 277 F. Supp. 3d 821, 849 (E.D. Va. 2017), compels a finding that Credit One willfully violated the FCRA. While it is true that the district court in Wood concluded that "[i]t was unreasonable for Credit One to simply match [the plaintiff's] personal identifiers with those associated with the [a]ccount," id. at 853, especially when "the alleged identity thief is a family member who could have knowledge of or access to an individual's personal information . . . and who might use that information to fraudulently open a credit account," id. at 853 n.53, we disagree with Suluki's argument that Wood constitutes “authoritative guidance” under Safeco. The Supreme Court in Safeco made explicitly clear that a finding of willfulness may be supported by "guidance from the courts of appeals or the Federal Trade Commission." 551 U.S. at 70. But the Wood decision relied on by Suluki comes from neither a court of appeals nor the Federal Trade Commission, and as far as we can tell, no agency or court of appeals has adopted or endorsed

the district court's conclusions. Thus, "[g]iven this dearth of guidance and the less-than-pellucid statutory text," id., we reject Suluki's claim that Credit One willfully violated the FCRA.

The FCRA also allows a consumer to recover "any actual damages sustained" for "[a]ny person who is negligent in failing to comply" with the FCRA. 15 U.S.C. § 1681o(a). The consumer must show causation between the harm alleged by the plaintiff and the furnisher's violation.

The CFPB and FTC join Suluki in arguing that she could have established actual damages, pursuant to 15 U.S.C. § 1681o, by Credit One's continued inclusion of unverified information on her consumer report. They contend that the actual damages inquiry relies on a "key principle . . . [that] '[w]hen a furnisher . . . reports that the disputed information has been verified as accurate, the question of whether the furnisher behaved reasonably will turn on whether the furnisher acquired sufficient evidence to support the conclusion that the information was true.'" Br. of Amici Curiae at 28-29 (alterations accepted) (quoting Felts, 893 F.3d at 1312). We have concluded, however, that Credit One acquired sufficient evidence to support its conclusion that the account information was verified, and additional investigation would not have altered

that conclusion. See Johnson, 357 F.3d at 433 ("[T]he extensive instructions by the district court made clear that [the consumer's] claim was based on [the creditor's] duty to investigate consumer disputes, not its duty to provide accurate information[,] . . . [and the court correctly] instructed the jury that the damages recoverable . . . may not include any damages that were caused by the inaccuracy of the information itself." (internal quotations omitted)).

Suluki has not produced evidence from which a reasonable jury could find that Credit One willfully or negligently violated the FCRA by verifying the account. Suluki therefore cannot demonstrate that Credit One is liable for damages.

CONCLUSION For the reasons set forth above, we AFFIRM the district court's judgment.