## Facts

- Scottrade, Inc., an online broker-dealer, provided a website through which retail customers maintained securities accounts and placed trades.
- BroCo Investments, Inc., a Mauritian brokerage, maintained an account at Genesis Securities, LLC, a U.S. broker-dealer, through which BroCo’s customer trades were executed.
- A BroCo customer allegedly bought large blocks of thinly traded securities through BroCo’s account at Genesis, then hacked into Scottrade customer accounts and placed unauthorized buy orders for those securities.
- The unauthorized purchases allegedly inflated the securities’ prices, after which the wrongdoer sold his holdings at a profit, leaving Scottrade customers holding illiquid, devalued stock.
- Scottrade reimbursed customers for losses from the unauthorized trading (about $1.46 million) and sued, including claims against Genesis under the Securities Exchange Act of 1934 and the Computer Fraud and Abuse Act (CFAA).
- Genesis moved to dismiss under Rule 12(b)(6); Scottrade sought leave to amend.

## Issues

1. Whether Scottrade, which reimbursed customers but was not itself a purchaser or seller in the challenged trades and had no assignments from customers, had standing to sue under Exchange Act § 10(b), Rule 10b-5, and § 9(a).
2. Whether Scottrade stated a rescission claim under Exchange Act § 29(b) despite not being a party to, or in privity with a party to, the allegedly unlawful contracts.
3. Whether Scottrade stated a CFAA claim against Genesis where Genesis itself did not allegedly access Scottrade’s computers without authorization.
4. Whether leave to amend should be granted or denied as futile.

## Decision

- Genesis’s motion to dismiss was granted in full.
- The court dismissed Scottrade’s claims under § 10(b), Rule 10b-5, and § 9(a) for lack of standing because Scottrade was not an actual purchaser or seller in the relevant transactions and had no assigned claims.
- The court dismissed the § 29(b) rescission claim because Scottrade was not a party to, and lacked privity with a party to, a contract made in violation of the securities laws.
- The court dismissed the CFAA claim because Genesis did not itself access Scottrade’s computers without authorization as required by the statute.
- All claims against Genesis were dismissed with prejudice.
- Scottrade’s motion for leave to amend was denied as futile.

## Legal Principles

- Private claims under Exchange Act § 10(b), Rule 10b-5, and § 9(a) are limited to plaintiffs who are actual purchasers or sellers in the challenged transactions; a broker’s reimbursement of customers’ losses is not a substitute for purchaser-seller status.
- A plaintiff seeking to pursue customers’ securities-fraud claims must have a valid assignment; indemnifying customers, without assignment, leaves the plaintiff with only derivative injury and no standing.
- Exchange Act § 29(b) rescission requires a contractual nexus: the plaintiff must be a party to, or in privity with a party to, the contract alleged to violate the securities laws.
- CFAA liability requires that the defendant itself accessed a protected computer without authorization or exceeded authorized access; participation in downstream trading activity does not satisfy the access element absent unauthorized access by the defendant.
- Leave to amend may be denied as futile when defects are legal and cannot be cured by repleading.

## Conclusion

The court held that an online broker that reimburses customers for hacked-account trading losses lacks standing to bring federal securities-fraud claims without purchaser-seller status or assigned claims, and it dismissed related § 29(b) and CFAA claims against the executing broker where contractual privity and unauthorized computer access by that defendant were not plausibly alleged.


Scottrade, Inc. v. BroCo Invs., Inc., 774 F. Supp. 2d 573 (S.D.N.Y. 2011)