OPINION

VOGEL, Acting P. J.

A lawyer's office manager forged the lawyer's signature, opened bank accounts in the lawyer's name, deposited money the lawyer had received in trust from his clients, then stole the money from the accounts she had opened. When the clients sued the lawyer to recover the misappropriated money, the lawyer cross-complained against the office manager and the banks in which the accounts had been opened. The banks demurred, contending their contract was with the office manager, not the lawyer, that the lawyer was never their customer, and that they thus did not owe him a duty of due care. The trial court agreed with the banks, sustained the demurrers without leave to amend, and dismissed the cross-complaint. The lawyer appeals, insisting he was the bank's "customer." We disagree and, for the reasons explained below, affirm the judgment.

FACTS A.

Two former clients (Mara and Ismael Rodriguez) sued Stephen A. Rodriguez, his law firm (Rodriguez Rodriguez), and the law firm's former office manager, Evelyn Oberhuber, alleging that Mara and Ismael and their parents had given $140,000 to the Rodriguez firm ($40,000 as a retainer for services to be rendered to the clients in a pending criminal case and a civil forfeiture proceeding, plus $100,000 to obtain bail for Mara) but that, instead of placing the money in its trust account, the law firm converted all of it to its own use. According to Mara and Ismael, when the court in which the criminal case was pending denied Mara's motion for bail, she asked Rodriguez to refund the $100,000. When Rodriguez refused, Mara and Ismael obtained new counsel. Further investigation by Rodriguez disclosed that Oberhuber, the law firm's office manager, had misappropriated the money.

Based on the facts stated in the preceding paragraph, Mara and Ismael alleged causes of action for legal malpractice, breach of contract, breach of fiduciary duty, money had and received, conversion, and "fraudulent conveyance," and prayed for special, general, and punitive damages.

B.

Rodriguez answered the complaint and cross-complained against Oberhuber, Union Bank of California, and Bank of the West. Both banks demurred to Rodriguez's original and first amended cross-complaints, and the demurrers were sustained with leave to amend. Rodriguez then filed his second amended cross-complaint, the operative pleading, alleging that Oberhuber, who no longer works for Rodriguez, had been employed as an office manager and paralegal for eight years, during which time she "embarked on an egregious scheme to launch a business scam that made unauthorized use of [Rodriguez's] information, finances and [reputation]." To make matters worse, he alleged, Union Bank and Bank of the West "so negligently performed the required procedures related to business accounts as to aid and allow . . . Oberhuber to conduct her scheme of fraudulent and illegal activities. Had the proper procedures been followed and implemented as required by industry standards and the banks themselves, said acts of unlawfulness [might] have been altogether avoided."

Rodriguez alleged that he provides "legal services related to family law, bankruptcy law, minor civil litigation and criminal defense," and has "spent a significant amount of time" developing his practice and maintaining his clients' confidences. Oberhuber, who had access to all of Rodriguez's files, including confidential information, breached her duty to Rodriguez by misusing and misappropriating his confidential information, forging his signature, and collaborating with others to use Rodriguez's property for her own gain.

Conversion and Related Torts. In 10 causes of action against Oberhuber (but not the banks), Rodriguez alleged among other things that Oberhuber had forged Rodriguez's name to signature cards for accounts at both Bank of the West and Union Bank, forged his name on numerous checks drawn on the account at Bank of the West, withdrawn his money from the general account at Union Bank, and forged his name on numerous checks drawn on a trust account at Union Bank. Rodriguez sought general and punitive damages from Oberhuber (who has not appeared in this action and is not a party to this appeal).

Negligence. In his second cause of action, Rodriguez alleged that both banks used his confidential information "that they obtained improperly" from Oberhuber to open several bank accounts. He alleges that, "as a matter of public policy," the banks "owed a duty of due care" to Rodriguez as a "putative" customer, and that the banks breached this duty by facilitating "the opening of bank accounts in [Rodriguez's] name[] without [Rodriguez's] presence, signature or consent, which made [Rodriguez an] involuntary customer[] of the banks. [The banks] then went on to allow fraudulent checks to be drawn against said accounts, further cementing the bank/customer relationship." Copies of the forged signature cards, withdrawal slips, and checks are attached to and incorporated into the cross-complaint. Rodriguez does not allege that he or his firm had an existing relationship with either bank.

Negligent Interference With Prospective Economic Advantage. In his eighth cause of action against Oberhuber and the banks, Rodriguez alleges that the banks, "[t]hrough their relationship and ongoing communications" with Oberhuber, "knew or should have known of the business relationship between" Rodriguez and his clients, Mara and Ismael, and that the banks, "as a matter of public policy, owed a duty of due care" to Rodriguez as a "putative" customer. The banks, "as the operators of several fraudulently opened bank accounts, knew or should have known that their failure to act with reasonable care could significantly affect the financial relationship" between Rodriguez and his clients. The banks "acted wrongfully and without reasonable care by not requiring proper identification and verification of an authorized signor in violation of industry standards." Rodriguez does not allege that he or his firm had an existing relationship with the banks.

More specifically, Rodriguez alleges that "[b]anking industry standards are reflected in . . . Bank of the West's own new accounts manual and dictate that new accounts opened should be subject to verification of identity and accuracy of the information being offered by the customer. For business accounts, each signer must present a valid form of identification. The identification should be inspected and the picture should be compared with the individual presenting the identification. The birth date on the identification should approximate the age of the presenter. Further, at the opening of the new account, signatures provided on signature cards are to be compared with those on the primary identification provided to ensure that they are consistent. These industry standards are also reflected in [Union Bank's] bank-wide policy manual[, according to which] it is against bank policy to open accounts for persons who are not adequately identified or any person requesting to open an account for another individual, without the person's . . . signature and consent. Further, the policy manual indicates that when opening personal or business accounts, valid and reliable identification must be received and owners and officers of businesses should be personally identified."

The banks' demurrers to Rodriguez's second amended cross-complaint were sustained without leave to amend, and this appeal is from the judgment of dismissal thereafter entered in favor of the banks.

DISCUSSION

In a series of related arguments, Rodriguez contends the banks owed him a duty of care because he was the banks' customer and that his pleading is sufficient to state causes of action against the banks for negligence and negligent interference with prospective economic advantage. Because we reject Rodriguez's claim that a duty was owed to him by the banks, it follows that no cause of action is alleged and that the demurrers were properly sustained without leave to amend.

A.

A bank's basic duty of care — to act with reasonable care in its transactions with its customers — arises out of the bank's contract with its customer. (Cal. U. Com. Code, § 4104, subd. (a)(5) [a bank's customer is "a person having an account with a bank or for whom a bank has agreed to collect items"]; cf. Software Design Application, Ltd. v. Hoefer Arnett, Inc. (1996) 49 Cal.App.4th 472, 479 [ 56 Cal.Rptr.2d 756]; Chazen v. Centennial Bank (1998) 61 Cal.App.4th 532, 543-545 [ 71 Cal.Rptr.2d 462] [a bank's duty of care is owed to its depositors, not to strangers, except when the bank has allowed a person to deposit a check payable into the customer's account, notwithstanding that the check was payable to someone else]).

To plead the existence of this duty, Rodriguez offers the conclusory allegation that he was a "putative customer" of the banks — but does not allege facts to suggest that he, rather than Oberhuber, had a contractual relationship with either bank, or even that he consented to the opening of any of the accounts. (See 1 Witkin, Summary of Cal. Law (10th ed. 2005) Contracts, §§ 116, 117, pp. 155-156 [formation of a contract requires mutual assent by the parties].) In short, he cannot allege that he was the bank's customer because he did not consent to the creation of any of the accounts and, indeed, did not even know of their existence until after Oberhuber's wrongful acts were completed.

To accept Rodriguez's contention that he was the banks' customer would mean that the banks would have had recourse against Rodriguez had they provided overdraft protection for an Oberhuber check exceeding the balance of the accounts, which plainly would not have been allowed. ( Perdue v. Crocker National Bank (1985) 38 Cal.3d 913, 922-924 [ 216 Cal.Rptr. 345, 702 P.2d 503].) The contract between a bank and its customer is not a one-way street.

B.

To avoid this conclusion, Rodriguez contends the name on the signature card determines the identity of the customer. The case he relies on to support this conclusion, Dodd v. Citizens Bank of Costa Mesa (1990) 222 Cal.App.3d 1624 [ 272 Cal.Rptr. 623], defeats rather than supports Rodriguez's position.

The plaintiff in Dodd, who ran a trucking business, contracted with Pacific Payroll Systems, Inc., for the preparation of his payroll checks and tax returns and, to that end, authorized Pacific to transfer funds from Dodd's bank directly to Pacific's account at Citizens Bank. The signature card for Pacific's account at Citizens Bank authorized signatures by two Pacific employees (Kramer and Hunter), identified the account as belonging to Pacific, and labeled it as a "payroll trust account." Although Dodd received statements from Pacific showing that his taxes and payroll were being paid, in fact Kramer and Hunter had diverted over $90,000 of Dodd's funds to their own use. ( Dodd v. Citizens Bank of Costa Mesa, supra, 222 Cal.App.3d at pp. 1625-1626.)

As relevant to our case, Dodd sued Citizens Bank for negligence, alleging that he was a customer because Citizens Bank knew Pacific was using the account to collect funds solely for the payment of its clients' payrolls and taxes, and because Citizens Bank had supplied checks to Pacific that were designed to be customized with the name and address of the particular client for whom the check was written. Dodd alleged that, because he was the bank's customer, it should have been sending him monthly statements (which he could have compared with Pacific's statements to detect the fraud). ( Dodd v. Citizens Bank of Costa Mesa, supra, 222 Cal.App.3d at p. 1626.) Citizens Bank's demurrer was sustained without leave to amend, and the Court of Appeal affirmed, explaining its holding this way:

"[S]ection 4104, subdivision (e), defines `customer' as `any person having an account with a bank. . . .' Here, the signature card establishing the account, attached as [an] exhibit . . . to the first amended complaint, clearly identifies Pacific as the accountholder. [¶] Notwithstanding the signature card, Dodd contends a question of fact is created by his allegations that Citizens knew about Pacific's method of operation, accepted preauthorized deposits from Dodd's bank and processed checks identifying Dodd's business as the accountholder. . . ." ( Dodd v. Citizens Bank of Costa Mesa, supra, 222 Cal.App.3d at p. 1627.) The Dodd court distinguished Kendall Yacht Corp. v. United California Bank (1975) 50 Cal.App.3d 949, 956 [ 123 Cal.Rptr. 848], where the court allowed individuals to recover against a bank for the wrongful dishonor of checks issued by a closely held corporation — the individuals being the husband and wife sole-shareholders of the corporation — on the ground that it was "entirely foreseeable" that the husband and wife would suffer adverse personal consequences when the bank wrongfully dishonored their corporation's checks. Significantly, the Kendall Yacht court stated that it "would certainly not hold as a general proposition that the shareholders or officers of a corporation could recover under section 4402 for the wrongful dishonor of a corporation check." ( Kendall Yacht Corp. v. United California Bank, supra, 50 Cal.App.3d at p. 956; see also American Nat. Bank v. Stanfill (1988) 205 Cal.App.3d 1089, 1100 [ 252 Cal.Rptr. 861] [two individuals who borrowed money to fund a charitable corporation and used the proceeds to open an account in the corporation's name were allowed to sue the bank for negligence].)

The Dodd court, faced with criminal acts similar to those alleged in our case, held that the circumstances before it did "not approach those in Kendall Yacht and American Nat. Bank. In each of those cases, the bank dealt directly with the individuals and held them financially responsible for the accounts in question. Here, Dodd had no responsibility for Pacific's account and had no direct dealings with Citizens. He was one of Pacific's many clients and had no customer relationship with Citizens." ( Dodd v. Citizens Bank of Costa Mesa, supra, 222 Cal.App.3d at p. 1628.) Because the bank owed no duty to Dodd, the alleged breach was legally irrelevant. ( Ibid.)

By no stretch of the imagination does Dodd support Rodriguez's contention that the bank must look to the name on the signature card to determine the identity of the customer.

C.

"The existence of a duty of care toward an interest of another worthy of legal protection is the essential prerequisite to a negligence cause of action, determined as a matter of law by the court. ( Bily v. Arthur Young Co. (1992) 3 Cal.4th 370, 397 [ 11 Cal.Rptr.2d 51, 834 P.2d 745].) The gist of [plaintiffs'] negligence claim is that the banks . . . owed a duty of care to [them] to investigate the entity opening the account and to thereafter supervise and monitor account transactions such as withdrawals and transfers. . . . [¶] The primary flaw in [plaintiffs'] negligence theory is that none of the [banks] had any relationship with [plaintiffs, who therefore are] strangers to the contractual relationships between [the banks] and the thieves. . . . [¶] . . . [¶]

"In this case the banks' basic duty of care derives from the contract with their customer, account holder Linda McDonald. [Plaintiffs] knew nothing of her bank accounts, and [were] not . . . customer[s] of either bank. . . . Recent cases have held that absent extraordinary and specific facts, a bank does not owe a duty of care to a noncustomer. [Citations.] [¶] . . . [¶] Nevertheless, [plaintiffs] posit such a duty, based primarily on Sun `n Sand, Inc. v. United California Bank (1978) 21 Cal.3d 671 [ 148 Cal.Rptr. 329, 582 P.2d 920] and its progeny. In Sun `n Sand, our Supreme Court held that a bank owes a limited duty of inquiry when a check presented for deposit bears some objective signs of fraud. There, the plaintiff, at an employee's urging, made checks payable to defendant bank, believing it owed the bank minor sums. The employee altered the checks to increase the sums, then deposited them in her personal account with the same bank. The bank permitted this negotiation without any inquiry, despite the fact that the checks were not payable to the employee, but to the bank itself.

"Our Supreme Court first reiterated the competing policy considerations that come into play when deciding to impose a duty to exercise reasonable care under a given set of circumstances. These include `. . . the foreseeability of harm to the plaintiff, the degree of certainty that the plaintiff suffered injury, the closeness of the connection between the defendant's conduct and the injury suffered, the moral blame attached to the defendant's conduct, the policy of preventing future harm, the extent of the burden to the defendant and consequences to the community of imposing a duty to exercise care with resulting liability for breach, and the availability, cost and prevalence of insurance for the risk involved.' ( Sun `n Sand, Inc. v. United California Bank, supra, 21 Cal.3d at p. 695. . . .)

"The court went on to conclude: `[A]n attempt by a third party to divert the proceeds of a check drawn payable to the order of a bank to the benefit of one other than the drawer or drawee suggests a possible misappropriation. Accordingly, we conclude that Sun `n Sand's allegations define circumstances sufficiently suspicious that [the bank] should have been alerted to the risk that Sun `n Sand's employee was perpetrating a fraud. By making reasonable inquiries, [the bank] could have discovered the fraudulent scheme and prevented its success.' ( Sun `n Sand, Inc. v. United California Bank, supra, 21 Cal.3d at pp. 694-695.) However, the court also cautioned that this `duty is narrowly circumscribed: It is activated only when checks, not insignificant in amount, are drawn payable to the order of a bank and are presented to the payee bank by a third party seeking to negotiate the checks for his own benefit. Moreover, the bank's obligation is minimal. We hold simply that the bank may not ignore the danger signals inherent in such an attempted negotiation. There must be some objective indicia from which the bank could reasonably conclude that the party presenting the check is authorized to transact in the manner proposed.' ( Id., at pp. 695-696.) [¶] Post- Sum `n Sand cases involve similar situations. . . .

"The danger signals triggered in [ Sun `n Sand and its progeny] all stemmed from the particular circumstances of the checks, endorsements or depositors, where the person attempting to negotiate the check is not the payee. Here, no checks were presented to either bank for deposit. Rather, funds were deposited into the precise accounts to which they were directed by wire transfer. The accounts at the banks were the identified and intended destination of funds wired from the brokerage accounts by McDonald. [Plaintiffs were] not [the] originator[s] of the wire transfers, played no role in the transactions, and [were] not identified as possessing any interest in the funds transferred into the bank accounts. In short, there was nothing suspicious as to the wiring of funds into the Wells Fargo and First Interstate accounts and, thus, [Plaintiffs were] not . . . foreseeable and identifiable injured third part[ies]. [¶] . . . [¶]

"[Plaintiffs] suggest that the frequency with which the McDonalds `deposited and simultaneously withdrew hundreds of thousands of dollars from the [accounts opened in the fictitious name] was a sharp indicator of money laundering or other illegal activity . . .' [but Plaintiffs cite] no authority for the proposition that, in the absence of suspicious instruments, a bank has a duty to supervise account activity or otherwise track frequent and/or large dollar transactions in deposit accounts, nor are we aware of any such duty. [¶] . . . [¶]

"[Plaintiffs'] real complaint is that the banks did not follow their own internal policies or standard industry practices pertaining to verifying authorization of an individual to open a partnership account, and ignored suspicious circumstances surrounding the establishment of those accounts. From this they assert that the banks breached a duty of care owed to [Plaintiffs] upon opening the accounts for Linda McDonald.

"First, [Plaintiffs] have at least part of their argument backward[, claiming] that failure to follow internal procedures and industry standards when opening an account, such as requiring documentation to verify the existence of the partnership, was negligent. However, absent a duty, the [banks'] care, or lack of care, is irrelevant. Violation of a self-imposed rule does not create actionable negligence unless plaintiff (1) suffers the type of harm sought to be prevented by the rule and (2) is a member of the class of people for whose protection the rule was promulgated. [Citation.] [ Plaintiffs make] the conclusory statement that these practices are an industry safeguard `against the sort of misconduct perpetrated by McDonald' [but] did not [and could not] allege . . . that any such account opening or screening procedures exist to protect strangers with whom they do no business. Rather, they exist to protect the banks.

"Second, contrary to [Plaintiffs'] assertions, the circumstances surrounding the opening of the accounts were not so suspicious as to trigger a duty to investigate the phony partnership for the benefit of strangers. Again, nothing in the account opening process would hint that [Plaintiffs] existed. Further, that Linda McDonald had opened other corporate and partnership accounts, with herself as sole signator, is not on its face illegal and had that fact triggered investigation, again it would be for the banks' benefit, not for noncustomers. The same can be said for the fact that although Linda McDonald and [another person] were signators, they were not identified as partners or agents of the phony limited partnership. . . .

"Finally, [the] determination . . . whether to impose a duty of inquiry under the circumstances at hand fails the Rowland v. Christian analysis. To begin, it is within the realm of possibility and, hence, foreseeable on some level that a prospective account holder might present phony corporate or partnership papers to open an account and then use the account to fraudulent ends. However, nothing in these transactions gave any inkling that [Plaintiffs] or anyone else was a potential victim and, hence, foreseeability becomes a very abstract and rarefied concern. `[C]reation of a legal duty requires more than a mere possibility of occurrence since, through hindsight, everything is foreseeable.' [Citation.] Moreover, foreseeability of harm or knowledge of danger, by itself, is insufficient to create a legally cognizable special relationship giving rise to a duty to prevent harm. [Citation.]" ( Software Design Application, Ltd. v. Hoefer Arnett, Inc., supra, 49 Cal.App.4th at pp. 478-482, fns. omitted, most italics added.)

D.

Software Design is substantively indistinguishable from the facts of our case, notwithstanding Rodriguez's assertion that his case is different because the thief opened the account in Rodriguez's name, not a fictitious name. Although the banks in both cases might upon further inquiry have discovered the fraudulent nature of the thieves' actions, the point is that in neither case did the bank owe a duty to a stranger — the fictitious partnership in Software Design or Rodriguez in our case — because the strangers had no contractual relationship with the banks. In any event, there are no allegations in Rodriguez's cross-complaint to suggest that Oberhuber acted in a manner that should have aroused the banks' suspicion, and the fact that she identified herself with her driver's license does not in itself suggest the absence of authority to open an account in someone else's name.

As Division Five of our court observed in CTC Real Estate Services v. Lepe (2006) 140 Cal.App.4th 856, 859 [44 Cal.Rptr.3d 823], "[s]ociety is now faced with the exploding problem of identity theft, a phenomenon that inevitably creates new issues with which our legal system must deal." (Fn. omitted; see also Graham v. CSC Credit Services, Inc. (D.Minn. 2004) 306 F.Supp.2d 873, 881, fn. 1 [in 2003, the Federal Trade Commission reported that over twenty-seven million Americans were victims of identity theft in the past five years, including almost 10 million people in the past year].) Given the scope of the problem and the consequences to the community of imposing a noncontractual duty with resulting liability for breach, a decision to shift the burden of loss from the actual victim to a third party duped by the thief is one to be made, if at all, by the Legislature, not the judiciary.

DISPOSITION

Rothschild, J., and Jackson, J., concurred.