Court: Validation Notice Sent Via Email Requiring Consumer to Click a Link to Open a “Secure Package” Is Not “Sending” a Validation Notice Under FDCPA

On September 29, 2017, in a very interesting and timely Fair Debt Collection Practices Act (FDCPA) case, a district court in Indiana shot down a debt collector’s argument that it “sent” its validation notice to a consumer via email. The case is Lavallee v. Med-1 Solutions, LLC (Case No. 1-15-cv-1922, U.S.D.C., Southern District of Indiana).

A copy of the court’s decision can be found here.

Background

The precise facts in this case are very important. Specifically, the process used by the debt collector in sending the email. As such, insideARM will provide detail. 

The court considered the following as undisputed facts:

“Defendant Med-1 Solutions, LLC (Med-1) is a debt collector within the meaning of the FDCPA. Plaintiff Beth Lavallee incurred two consumer debts for medical services provided to her by a hospital, the original creditor. Med-1 sought to collect those two debts. 

As part of its collection activity, Med-1 uses a vendor (Privacy Data Systems, its sister company) that created a software application called “SenditCertified™.” Med-1 supplies data through a data batch process to the vendor about debts it seeks to collect. The vendor’s software application extracts the data and inputs it to populate a .pdf document. The .pdf document is “sent” to the intended recipient by email as a “secure package” in the following manner: 

The recipient is sent an email; the sender on the email Info@med1solutions.com. The subject of the email is that “Med-1 Solutions has sent you a secure message.” 

If the email is opened by the recipient, the message reads: “Please find your message attached,” thus alerting the recipient that she can pick up a “secure message” by clicking a link. The email itself also includes Med-1 Solutions’ name, phone number, and address. 

If the recipient clicks the link, she is redirected over the internet via a web browser to access the vendor’s web server where there is another message “instructing the user to accept their attachment,” i.e., the .pdf “secure package.” The recipient can “accept” the attachment by checking a box to “sign for this Secure Package” and verify that she is the person whose name and email is listed. If that box is checked, the recipient finally is given access to the .pdf document if she clicks on the “Open Secure Package” button appearing on her screen. 

That .pdf “secure package” contains a letter to the recipient from Med-1 Solutions that is Med-1’s FDCPA Section 1692g(a) notification. The Section 1692g(a) notification was her “secure package.”

The above process was used to send email to Ms. Lavallee related to each debt. The first email (for the first debt) was sent on March 20, 2015, and the second email (for the second debt) was sent on April 17, 2015.

The email address used by the Med-1 vendor for Ms. Lavallee was one she had given the hospital.

Ms. Lavallee testified that she regularly checks her email inbox and her email spam folder, which automatically deletes spam emails when they age over 30 days. Although Ms. Lavallee does not remember receiving either the March 20 or April 17 emails, the Med-1 vendor did not receive any error message indicating a problem in the transmission of either email. The emails were not returned as undelivered. 

The Med-1 vendor and Med-1 know too, however, that Ms. Lavallee never viewed or accessed the .pdf “secure package” document for either debt. That is because the vendor’s system “records any attempt to view [the .pdf document, or “secure package”]” and there was no record of any attempt to view the secure packages. 

Therefore, it is undisputed that for each of the two debts at issue (1) Ms. Lavallee received an email from Info@med1solutions.com advising her she had an important message, (2) the email itself did not include the Med-1 Section 1692g(a) validation notice related to the debt or even mention the hospital, and (3) Ms. Lavallee never accessed the web server that contained the validation notice and never opened the .pdf secure package. 

The Court’s Decision and Reasoning

The court then applied these facts in light of the applicable law. The sole question presented by this case is whether under the above facts, Med-1 sent to Ms. Lavallee a debt notification letter in compliance with the FDCPA. 

The court wrote:

“The statutory provision at issue, 15 U.S.C. § 1692g(a) (emphasis added), reads as follows: 

• Notice of debt; contents. Within five days after the initial communication with a consumer in connection with the collection of any debt, a debt collector shall, unless the following information is contained in the initial communication or the consumer has paid the debt, send the consumer a written notice containing— 

(1) the amount of the debt;

(2) the name of the creditor to whom the debt is owed; 

(3) a statement that unless the consumer, within thirty days after receipt of the notice, disputes the validity of the debt, or any portion thereof, the debt will be assumed to be valid by the debt collector;

(4) a statement that if the consumer notifies the debt collector in writing within the thirty-day period that the debt, or any portion thereof, is disputed, the debt collector will obtain verification of the debt or a copy of a judgment against the consumer and a copy of such verification or judgment will be mailed to the consumer by the debt collector; and

(5) a statement that, upon the consumer’s written request within the thirty-day period, the debt collector will provide the consumer with the name and address of the original creditor, if different from the current creditor.” 

The court determined that Med-1 Solutions did not send a validation notice to Ms. Lavallee as required by Section 1692g(a). 

Med-1 contended that because it is undisputed that it sent emails to Ms. Lavallee that -- with a few steps by Ms. Lavallee -- would have provided her with the Section 1692g(a) validation letter, it therefore sent the required notice. Med-1 argued that under the statute’s plain reading and interpretive case law by some courts, it is irrelevant that Ms. Lavallee did not actually receive the notice, and she must accept the consequence of failing to open documents that were sent to her via this email attachment process. 

Med-1 also relied on one district court case, which cites a case from the Ninth Circuit, to support its argument that a Section 1692g notice must only be sent and it is irrelevant whether it is received. Med-1 argued that the case in question stands for the proposition that the sending of a notice (or other communication) by first class mail that is properly addressed is presumed to have been received by the addressee under the common law’s mailbox rule and that the Mailbox rule should also apply to email communications.

The court disagreed.

The Honorable Debra McVicker Lynch, Magistrate Judge distinguished this scenario from traditional mail notices. She determined that the Mailbox rule’s presumption of receipt that makes the sending of a notice by the debt collector sufficient without the collector proving actual receipt should not apply in this case. 

Judge McVicker Lynch wrote: 

“But if notice is not sent in a manner in which receipt should be presumed as a matter of logic and common experience, then it cannot be considered to have been “sent.” 

The court concludes that Med-1 Solutions did not “send” the validation notice as required by the statute. It knows (and knew, or easily could have determined at the time) that its notice was not delivered to Ms. Lavallee. She never accessed, or attempted to access, the “Secure Package” containing the validation notice, and the email itself did not contain the validation notice. 

The name of the product of Med-1 Solutions’ sister company—“SenditCertified™”—is noteworthy. The name connotes a system by which a sender receives certification that the item was received—like certified mail. But here, Med-1 Solutions asks the court to ignore the undisputed facts that its notices were not delivered to Ms. Lavallee and that Med-1 Solutions knew or could have easily determined that fact. What Med-1 Solutions requests is akin to the sender of a certified mailing claiming notice was effected without a “green card.” 

Further, Med-1 Solutions’ system of transmission is one that’s not even likely to accomplish receipt of the validation notice. Not opening an email attachment is not the same as failing to open a letter one receives through the United States Post Office mail system. It is the proven reliability of the latter system—the very high probability that a properly addressed letter reaches its destination—that led to the common law mailbox rule presumption.

The same cannot be said for documents delivered as a web-based email attachment. Med-1 Solutions has offered no evidence that its system yields a similar result as the U.S Mail and therefore merits the same presumption underlying the “mailbox rule.” Indeed, in the court’s estimation, such attachments are more likely not to be opened and delivered than to be opened. Emphasis added by insideARM.

insideARM Perspective 

As noted in the initial paragraph above, this decision is timely. The entire ARM industry is pushing for greater use of email. Consumer advocates have mixed opinions on the use of email and it is believed that the Consumer Financial Protection Bureau (CFPB) is currently considering potential debt collection rules that will address the use of email.  insideARM believes this case is important because of the discussion of the process involved. The CFPB should also take note of this case when considering how emails may be used. 

Judge McVicker Lynch noted:

“As described in the facts section, for Ms. Lavallee even to have had an opportunity to receive the validation notice, she was required to open an email and then click through over the internet to an unknown web browser inviting her to then open a “Secure Package.” Contrary to Med-1 Solutions’ argument, modern consumer practices are not conducted this way.

Although a consumer may regularly open e-mails from persons and companies she knows and to which she has given her email address for communications6 (like a recognized email from the utility company or the bank one does business with), there is no evidence that Ms. Lavallee should have recognized as safe an email from Med-1 Solutions. Today, email users are regularly warned and know to beware of email invitations to click on web-based attachments. The United States Department of Homeland Security has issued a Security Tip (ST04-010), originally released in 2009 and updated in 2017, warning the public to use caution with email attachments because they can be sources of viruses. See https://www.us-cert.gov/ncas/tips/ST04-010. The Department of Homeland Security warns that email attachments are a “common tool for attackers” and if an email attachment seems suspicious, “don’t open it.” 

A footnote to the opinion is also critical. It stated:

“Ms. Lavallee has argued that a notice sent by email should not enjoy the same presumption of receipt as a notice sent by United States mail. The court does not need to address that issue and does not do so here, because the statutory notice was not in the email sent to Ms. Lavallee. The court decides only the question presented by the undisputed facts outlined in this order.” 

Thus, it appears the that at least this court is open to the idea of email communications; it is only ruling that this process is deficient. insideARM will continue to monitor and report on this critical issue to the ARM industry.