NO MFA NO DICOVERY?: Court Appears to Fault Rocket For Not Using Two-Factor Authentication in Dobronski TCPA Discovery Fight

3 Comments

Law Conference of Champions V Ticket Prices as I type: $369.00 (and rising.) 

Courts are getting smarter (and more opinionated) about how companies should be interacting with consumers over the phone and at least one federal magistrate judge has opinions on how and when MFA should be used– and she just denied discovery in a TCPA suit against Rocket Mortgage as a result.

In Dobronski v. Rocket Mortgage, 2026 WL 3135180 (E.D. Mich. Oct. 19, 2026) Rocket claimed Dobronski filled out a form on its website leading to a number of calls Dobronski says he never requested.

Rocket moved to compel arbitration and pursued discovery related to contact formation.

Amongst its discovery efforts was a subpoena served on Dobronski’s VOIP provider Bandwidth to obtain “all portal access,” “all call detail records,” “routing and originating-number records,” and “all SMS/MMS records.”

Dobronski moved for a protective order and the court agreed to with Dobronski finding this information was simply not relevant to the contract formation issues relevant at that stage.

Interestingly, in a footnote the MJ made clear she thought Rocket had brought this situation upon itself by failing to use routine MFA procedures:

As the undersigned mentioned in her Report and Recommendation, had Rocket implemented two-factor authentication to verify that the request for information was made by the owner of the phone number entered, this information would be vastly more relevant here.

Wow.

Also interesting, the Court ordered Rocket and its lawyers not to review any production from Bandwidth that exceeds this order– so even if Bandwidth produced the records it had requested the Court says Rocket can’t even look at them, much less use them.

Petty extraordinary ruling and it shows Courts are not going to give companies a pass if they fail to use two-factor authentication.

Then again I hate two-factor authentication– so inefficient– especially when trying to file documents on PACER. And especially when you’re trying to access your accounts but you’ve misplaced your phone because you have a newborn and you’re exhausted and now you can’t run payroll…

But opinions certainly vary.

One topic on which opinions don’t vary– HPO CLO Steve Kaplan’s brilliance. The guy is fantastic and you will want to check out his views on AEP and Medicare in Ep. 54 of Deserve to Win Podcast, which is out right now.

Chat soon.

Discover more from TCPAWorld

Subscribe to get the latest posts sent to your email.

Categories:

Published by Eric "Czar" Troutman

The Czar of TCPAWorld Eric Troutman is one of the country’s prominent class action defense lawyers and is nationally recognized in Telephone Consumer Protection Act (TCPA) litigation and compliance. He has served as lead defense counsel in more than 70 national TCPA class actions and has litigated nearly a thousand individual TCPA cases in his role as national strategic litigation counsel for major banks and finance companies. He also helps industry participants build TCPA-compliant processes, policies, and systems. Eric has built a national litigation practice based upon deep experience, rigorous analysis and extraordinary responsiveness. Eric and his team feel equally at home litigating multibillion dollar telecommunications class actions in federal court as they do developing and executing national litigation strategies for institutions facing an onslaught of individual TCPA matters. They thrive in each of these roles – delivering consistently excellent results – while never losing sight of the client experience. While many firms now tout TCPA expertise, Eric has been there from the beginning. He built one of the country’s first TCPA-only defense teams and began serving as national TCPA counsel for his clients nearly a decade ago. This perspective allows him to swiftly develop the right litigation strategies for dealing with recurring problems, without wasting time on tactics that are bound to fail. Eric’s rich historical perspective and encyclopedic knowledge of the TCPA landscape also make him an invaluable resource to institutional compliance teams struggling to comply with the shifting regulatory landscape. No task is too small – or too big. Indeed, Eric and his team have helped build TCPA-compliant systems and processes for some of the largest and most complex corporate entities in the country. He commonly works with in-house compliance counsel to build and implement enterprise and business-line specific TCPA solutions, performs TCPA audits and drafts and reviews proposed TCPA policies and procedures. He and his team also have the technical expertise necessary to assist call centers seeking to develop TCPA-resistant call path architecture or to modify existing telephony and software integration to better insulate from potential TCPA exposure. Eric has built a reputation for thought leadership. An avid blogger and speaker, he has been at the forefront of the industry’s effort to push for clarity and a return to sanity for the TCPA for years. He was selected to advocate for the financial services industry on important TCPA issues before the Federal Communications Commission and co-authored the nation’s only comprehensive practice guide on TCPA defense. In his spare time, Eric leads defense teams representing banks and other financial services companies in consumer finance litigation matters. He has experience representing clients in UCC, TILA, RESPA FCRA, CCRA, CLRA, FDCPA, RFDCPA and FCCPA claims, as well as in fraud and bank operations issues.

3 Comments

  1. I recommend using 1Password as your password manager AND authenticator. Makes your pacer login and 2FA all happen in the browser (with the extension). Don’t get paid by or work for 1Password, just a bigtime fan.

    Reply

  2. It would be so simple if the lead generator sent a single text message to the owner’s phone number asking “Do you consent to receiving informational and non-informational communications to this telephone number ?” or “Please confirm that you would like to receive informational and non-informational communications to this phone number”. So simple. Confirmation of number AND affirmative defense!

    Reply

  3. Aaron, you are so correct! The problem is that lead generators and telemarketers REFUSE to take “NO” for an answer. Remember that, to a lead gen or telemarketer, “STOP” is a four-letter word. I have been told by more than one lead generator that they source their telephone numbers from the NDNCR — because the NDNCR helps them TARGET consumers with working telephone numbers — the last thing that the lead gen wants is to have to remove a number from their list. Because lead gens typically spoof their CLID, identify with false entity names, and are located outside the USA and beyond the reach of the law, lead gens simply do not care about the TCPA. They will let their seller customer play the “we didn’t initiate the call” defense.

    Reply

Leave a Reply