Opinion for the Court filed by Circuit Judge ROGERS.

ROGERS, Circuit Judge:

The Truth in Lending Act ("TILA"), 15 U.S.C. § 1601, et seq. (2000), limits the liability of a cardholder for "unauthorized use of a credit card," id. § 1643(a)(1), which is defined as use without "actual, implied, or apparent authority" that does not benefit the cardholder, id. § 1602( o). The principal issue on appeal is what creates apparent authority to limit cardholder protection under § 1643. The district court, in granting summary judgment to American Express Travel-Related Services Co. ("AMEX"), ruled that DBI Architects, P.C. ("DBI") clothed its accounting manager with apparent authority to use its corporate AMEX account by failing to examine monthly billing statements that identified all cardholders and their charges. We hold that, while DBI did not clothe its accounting manager with apparent authority by failing to inspect its monthly billing statements, DBI did clothe its accounting manager with apparent authority by repeatedly paying after notice all charges made by the accounting manager on its corporate AMEX account, thereby misleading AMEX reasonably to believe that the accounting manager had authority to use the account. We remand DBI's § 1643 claim to the district court to determine precisely how many payments created apparent authority and thus limited DBI's protection under TILA. Otherwise, we affirm the grant of summary judgment.

I.

DBI is a corporation with its principal place of business in the District of Columbia. It had an AMEX corporate credit card account, which it authorized certain employees to use. On March 14, 2001, DBI appointed Kathy Moore as the Accounting Manager for its District of Columbia and Virginia offices. In that position, Moore was in charge of both approval and payment functions in the cash disbursement system: she controlled accounts receivable, accounts payable, corporate checking, corporate credit cards, and all other financial aspects of DBI's business. She had authority to issue DBI corporate checks to pay bills and invoices from vendors, was "entrusted with the duty of affixing authorized signatures and approvals to checks and other documents," and was responsible for the receipt, review, and payment of DBI's AMEX invoices. Aff. of Alan L. Storm in Supp. of Pl.'s Mot. for Partial Summ. J.

On or about August 10, 2001, AMEX added Moore as a cardholder on DBI's corporate account at Moore's request and without DBI's knowledge or approval. On August 22, 2001, AMEX sent DBI an account statement identifying Moore as a corporate cardholder and itemizing her annual membership fee. From August 2001 to May 2002, Moore charged a total of $134,810.40 to DBI's corporate AMEX card, including $1,555.51 in authorized corporate charges and $133,254.79 in unauthorized charges for clothing, travel, jewelry, and other personal items. During this period, AMEX sent DBI ten monthly billing statements, each listing Moore as a corporate cardholder and itemizing her charges. Between August 2001 and June 2002, Moore paid for these charges with thirteen DBI checks made payable to AMEX. In addition, between July 2001 and March 2002, Moore paid for $162,139.04 in charges on her personal AMEX card with fourteen DBI checks made payable to AMEX. Most of these checks were signed or stamped in the name of Alan L. Storm, the president of DBI; none were signed in Moore's own name.

On May 31, 2002, DBI notified AMEX of Moore's fraudulent charges and requested a refund of $133,254.79 for the corporate account and $162,139.04 for the personal account. AMEX denied the request. DBI sued AMEX in the Superior Court for the District of Columbia, alleging, in Count One of the complaint, that AMEX had violated TILA, 15 U.S.C. § 1643, by refusing to repay DBI for the $133,254.79 in fraudulent charges made by Moore on DBI's corporate AMEX card. Count Two of the complaint alleged that AMEX was liable for conversion for using DBI's corporate funds to credit the $162,139.04 in charges on Moore's personal AMEX card. Following AMEX's removal of the case to the United States District Court for the District of Columbia, AMEX moved for summary judgment, and DBI moved for partial summary judgment on the issue of liability. The district court granted AMEX's motion for summary judgment, denying DBI recovery except for two months of charges on the corporate account, and DBI appeals. Our review of the grant of summary judgment is de novo. See Tao v. Freeh, 27 F.3d 635, 638 (D.C. Cir. 1994).

II.

Congress enacted the credit card provisions of the Truth in Lending Act "in large measure to protect credit cardholders from unauthorized use perpetrated by those able to obtain possession of a card from its original owner." Towers World Airways Inc. v. PHH Aviation Sys. Inc., 933 F.2d 174, 176 (2d Cir. 1991); see S.REP. No. 91-739, at 1 (1970); 116 CONG. REC. 11,827-29 (1970). Responding to concerns about the abuse of uninformed cardholders by a growing credit card industry, see generally John C. Weistart, Consumer Protection in the Credit Card Industry: Federal Legislative Controls, 70 MICH. L.REV. 1475 (1972), Congress strictly limited the cardholder's liability for "unauthorized" charges, see 15 U.S.C. § 1643(a)(1), placed the burden of establishing cardholder liability on the card issuer, see id. § 1643(b), and imposed criminal sanctions for the fraudulent use of credit cards, see id. § 1644. Specifically, § 1643 provides that a cardholder is not liable for the unauthorized use of a card unless the issuer previously provided the cardholder with information about potential liability, a means of reporting a lost or stolen card, and a means of identifying the authorized user. Id. § 1643(a)(1)(C), (D), (F). Even then, the cardholder's maximum liability is $50, id. at § 1643(a)(1)(B), and in any event, the cardholder is not liable for unauthorized charges incurred after the cardholder notifies the issuer of the fraud. Id. § 1643(a)(1)(E).

The protections under § 1643, however, apply only to "unauthorized use," which Congress defined as "a use of a credit card by a person other than the cardholder who does not have actual, implied, or apparent authority for such use and from which the cardholder receives no benefit." Id. § 1602( o); see Regulation Z, 12 C.F.R. § 226.12(b)(1) n. 22. Because the parties agree that Moore had neither actual nor implied authority to use DBI's corporate AMEX card, the question is whether Moore's charges were "authorized" as a result of her apparent authority to use the card and thus fall outside the protections available to DBI under § 1643. Cf. Credit Card Serv. Corp. v. FTC, 495 F.2d 1004, 1007 (D.C. Cir. 1974).

The Federal Reserve Board's official staff interpretation of Regulation Z, 12 C.F.R. § 226.12(b)(1), states that "whether [apparent] authority exists must be determined under state or other applicable law." 12 C.F.R. pt. 226, Supp. I, at 418. The Second Circuit observed in Towers World Airways, 933 F.2d at 176-77, that "[b]y defining `unauthorized use' as that lacking in `actual, implied, or apparent authority,' Congress apparently contemplated, and courts have accepted, primary reliance on background principles of agency law in determining the liability of cardholders for charges incurred by third-party card bearers." The common law rule provides that apparent authority arises from the "written or spoken words or any other conduct of the principal which, reasonably interpreted, causes [a] third person to believe that the principal consents to have [an] act done on his behalf by the person purporting to act for him." RESTATEMENT (SECOND) OF AGENCY § 27, at 103 (1958). The District of Columbia has adopted a similar definition: "apparent authority of an agent arises when the principal places the agent in such a position as to mislead third persons into believing that the agent is clothed with authority which in fact he does not possess." Stieger v. Chevy Chase Sav. Bank, 666 A.2d 479, 482 (D.C. 1995) (quoting Jack Pry, Inc. v. Harry Drazin, 173 A.2d 222, 223 (D.C. 1961)). The existence of apparent authority is a question of fact that should normally be left to the jury. See, e.g., Herbert Constr. Co. v. Continental Ins. Co., 931 F.2d 989, 994 (2d Cir. 1991). However, a principal may be estopped from denying apparent authority if the principal intentionally or negligently created an appearance of authority in the agent, on which a third party relied in changing its position. See RESTATEMENT (SECOND) OF AGENCY § 8B, at 38-40. We need not decide whether District of Columbia law or the common law of agency provides the rule of decision, as we discern no difference between them for the purposes of this case.

The district court ruled that Moore did not have apparent authority to become a cardholder on DBI's corporate AMEX account. But distinguishing between the acquisition and use of a credit card, the court ruled that DBI's negligent failure to examine its monthly billing statements from AMEX created apparent authority for Moore's use of the corporate card. The court relied on an analogy to District of Columbia banking law, under which depositors are required to "exercise reasonable promptness in examining the statement . . . to determine whether any payment was not authorized," D.C. Code § 28:4-406(c), and embraced the analysis of the Second Circuit in Minskoff v. American Express Travel Related Services Co., 98 F.3d 703 (2d Cir. 1996), which involved a nearly identical fact situation. There, as here, an employee of a corporation fraudulently acquired a corporate credit card from AMEX, charged personal expenses to the card, and paid for the charges with corporate checks. AMEX sent monthly statements listing the employee as a cardholder and itemizing the employee's charges, but the corporation failed to review the statements, continued to make payments, and demanded a refund upon discovering the fraud. See id. at 706-07.

The Second Circuit held in Minskoff that TILA "clearly preclude[s] a finding of apparent authority where the transfer of the card was without the cardholder's consent, as in cases involving theft, loss, or fraud." Id. at 708 (quoting Towers World Airways, 933 F.2d at 177). Regarding the employee's use of the card, however, the court drew an analogy from New York banking law, under which depositors are obligated to "exercise reasonable care and promptness" in examining their bank statements and reporting unauthorized charges, id. at 709 (quoting N.Y.U.C.C. § 4-406(1)), and held that a "cardholder's failure to examine credit card statements that would reveal fraudulent use of the card constitutes a negligent omission that creates apparent authority for charges that would otherwise be considered unauthorized under the TILA." Id. at 709-10. The court noted that the corporation's negligence "enabled [the employee] to pay all of the American Express statements with forged checks, thereby fortifying American Express' continuing impression that nothing was amiss." Id. at 710. The court reasoned that, as a policy matter, cardholders are in a better position than card issuers to discover fraudulent charges, and that "[n]othing in the TILA suggests that Congress intended to sanction intentional or negligent conduct by the cardholder that furthers the fraud or theft of an unauthorized card user." Id. at 709. Accordingly, the court concluded that AMEX was liable only for the fraudulent charges incurred before the corporation had a reasonable opportunity to examine its first billing statement, and remanded the case for the district court to make this determination, including whether, as the record developed on remand, any issues required submission to the jury. See id. at 710.

On appeal, DBI contends that the district court erred in following Minskoff. Because TILA and Regulation Z oblige the card issuer to protect the cardholder from fraud, DBI maintains that the district court erred in imposing on the cardholder a "novel duty . . . derived from a rough analogy to D.C. banking law" to inspect monthly billing statements and to notify the card issuer of fraud. Appellant's Br. at 12; see D.C. Code § 28:4-406(c). AMEX responds that, by continuing to pay without objection all charges on its corporate account, DBI vested Moore with apparent authority to use its corporate credit card. We conclude that both parties are correct. DBI is correct that its failure to inspect its monthly billing statements did not clothe Moore with apparent authority to use its corporate AMEX account. AMEX is correct that DBI clothed Moore with apparent authority to use its corporate AMEX account by repeatedly paying without protest all of Moore's charges on the account after receiving notice of them from AMEX.

Nothing in the law of agency supports the district court's conclusion that DBI's mere failure to review its monthly billing statements created apparent authority for Moore to use its corporate AMEX account. DBI's silence without payment would be insufficient to lead AMEX reasonably to believe that Moore had authority to use DBI's corporate account, as such silence would be equally consistent with DBI's never having received the statements. Cf. Whetstone Candy Co. v. Kraft Foods, Inc., 351 F.3d 1067, 1078 (11th Cir. 2003). Indeed, in Crestar Bank, N.A. v. Cheevers, 744 A.2d 1043 (D.C. 2000), the District of Columbia Court of Appeals held that a cardholder's "failure to object to the [disputed] charges within a reasonable time . . . [did not] constitut[e] ratification and acceptance of those charges." Id. at 1048 (first alteration in original). The court distinguished Minskoff as involving more than mere silence: whereas in Crestar Bank there was no relationship between the cardholder and the third party who made the fraudulent charges, and the cardholder neither received notice of the charges nor paid them, in Minskoff the cardholder's employee made the fraudulent charges, and the cardholder both received notice of the charges and paid them in full for sixteen consecutive months. Id. at 1048 n. 4.; see Minskoff, 98 F.3d at 710.

Further, the view that mere silence does not confer apparent authority is consistent with the text and purpose of § 1643 and Regulation Z. The plain language of § 1643 does not require a cardholder to inspect monthly billing statements in order to invoke its protections. The text sets no preconditions to its protections, such as an exhaustion requirement, and makes no reference to other remedies, such as those under the Fair Credit Billing Act, 15 U.S.C. § 1666 (2000), which permits — but does not require — a cardholder to seek correction of billing errors by reporting them to the card issuer in writing. Rather, § 1643 places the risk of fraud primarily on the card issuer. Designed to remedy the problem that "if a consumer does not immediately discover and report a card loss, he can be liable for thousands of dollars in unauthorized purchases made by a fast working thief," S.REP. No. 91-737, at 5, § 1643 requires the card issuer to demonstrate that it has taken certain measures to protect the cardholder from fraud before it can hold a cardholder liable for any unauthorized charges. 15 U.S.C. § 1643(a)(1), (b). The text of § 1643 thus indicates that Congress intended for the card issuer to protect the cardholder from fraud, not the other way around. Explaining the rationale underlying Congress's "policy decision that it is preferable for the issuer to bear fraud losses from credit card use," one commentator has suggested that Congress understood that "[a] system of issuer liability is preferable because it stimulates more efficient precautions against losses," with cardholder liability incurred "only [to] the degree . . . necessary to ensure proper control of his card and prompt notice of loss to the issuer." See Weistart, supra, at 1509, 1511.

Regulation Z likewise reflects the remedial purpose of § 1643. Filling in the gap between TILA and the Fair Credit Billing Act, the Federal Reserve Board explains in Regulation Z that a cardholder need not contest charges under § 1666 in order to pursue remedies under § 1643. See Crestar Bank, 744 A.2d at 1048. Specifically, the Board's official staff interpretation of 12 C.F.R. § 226.12(b)(3) states that "[t]he liability protections afforded to cardholders in § 226.12 [under § 1643] do not depend upon the cardholder's following the error resolution procedures in § 226.13 [under § 1666]." Although § 1666 and § 226.13 apply only to "consumer credit" and not to corporate credit, see §§ 1666(a), 1602(h), they nevertheless support the general proposition that a cardholder's failure to report fraudulent charges does not create apparent authority for such charges. Congress instructed the Federal Reserve Board to promulgate regulations to carry out the purposes of TILA, see 15 U.S.C. § 1604(a), and the Supreme Court has held that courts owe deference to the Board's regulations and its interpretation of its regulations under TILA. See Anderson Bros. Ford v. Valencia, 452 U.S. 205, 219, 101 S.Ct. 2266, 2274, 68 L.Ed.2d 783 (1981) (citing Ford Motor Credit Co. v. Milhollin, 444 U.S. 555, 556, 100 S.Ct. 790, 792, 63 L.Ed.2d 22 (1980)). Because the Board's interpretation is consistent with § 1643 and § 1666, deference to Regulation Z is due. See Anderson, 452 U.S. at 219, 101 S.Ct. at 2274; Milhollin, 444 U.S. at 565, 100 S.Ct. at 796. Indeed, in Crestar Bank, 744 A.2d at 1048, the District of Columbia Court of Appeals deferred to Regulation Z and rejected an interpretation that "reads into § 1643 a presumption that if the cardholder fails to notify the [card issuer] that the disputed charges are not his, they will be deemed to have been authorized by the cardholder."

Thus, there is no need for a court to look to banking laws to resolve the risk allocation and public policy issues regarding credit card fraud. While the district court duly noted that DBI had paid Moore's charges in full for ten months, cf. Minskoff, 98 F.3d at 710, the court ultimately relied on an analogy to District of Columbia banking law in concluding that DBI's negligent failure to examine its monthly billing statements created apparent authority for Moore to use its corporate AMEX account. In so doing, the district court gave insufficient weight to the fact that § 1643 places the risk of fraud primarily on the card issuer. Under the district court's approach, once a card issuer sends a billing statement to the cardholder, the statutory burden shifts to the cardholder to prove that it fulfilled its duty to review the statement and to report fraudulent charges. As DBI suggests, the effect is to make § 1666 a fraud shield for AMEX. This interpretation hardly seems consistent with the courts' liberal construction of TILA in light of its remedial purposes. Congress's plan for addressing credit card fraud places the burden on the card issuer to prove that it has taken certain measures to protect the cardholder from fraud before it can hold the cardholder liable for any unauthorized charges, see 15 U.S.C. § 1643(a)(1), (b), and even then, limits the cardholder's liability to $50, see id. § 1643(a)(1)(B), (d). In other words, the consequence of the cardholder's failure to examine its billing statements is that it may not be able to take advantage of the opportunity Congress provided under § 1666 to correct a billing error, not that it forfeits protections against liability for unauthorized use under § 1643. Cf. Crestar Bank, 744 A.2d at 1048. The district court thus erred in imposing a duty on DBI to inspect its monthly billing statements because such a duty effectively creates an exhaustion requirement that neither § 1643 nor Regulation Z contemplates.

Consequently, AMEX cannot meet its burden to show that it is entitled to judgment as a matter of law, see Fed.R.Civ.P. 56(c); Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 247-48, 106 S.Ct. 2505, 2509, 91 L.Ed.2d 202 (1986); Celotex Corp. v. Catrett, 477 U.S. 317, 322-23, 106 S.Ct. 2548, 2552-53, 91 L.Ed.2d 265 (1986); Dunaway v. Int'l Bhd. of Teamsters, 310 F.3d 758, 761 (D.C. Cir. 2002), based solely on DBI's failure to examine its monthly billing statements. Indeed, AMEX makes no such attempt. AMEX contends, and we hold, that DBI cannot avoid liability for Moore's fraudulent charges because its repeated payments in full after notice led AMEX reasonably to believe that Moore had the authority to use DBI's corporate credit card. Imposing liability based on the cardholder's payment after notice is not inconsistent with Congress's plan for allocating loss from credit card fraud. By identifying apparent authority as a limit on the cardholder's protection under § 1643, Congress recognized that a cardholder has certain obligations to prevent fraudulent use of its card. DBI's troubles stemmed from its failure to separate the approval and payment functions within its cash disbursement process. Moore had actual authority both to receive the billing statements and to issue DBI checks for payment to AMEX. While DBI did not voluntarily relinquish its corporate card to Moore, it did mislead AMEX into reasonably believing that Moore had authority to use the corporate card by paying her charges on the corporate account after receiving AMEX's monthly statements identifying her as a cardholder and itemizing her charges. While payment may not always create apparent authority, this is not a case involving "an occasional transgression buried in a welter of financial detail." Minskoff, 98 F.3d at 710. Nor is this a case involving payment without notice, as might occur when a cardholder authorizes its bank to pay its credit card bills automatically each month. Where, as here, the cardholder repeatedly paid thousands of dollars in fraudulent charges for almost a year after monthly billing statements identifying the fraudulent user and itemizing the fraudulent charges were sent to its corporate address, no reasonable juror could disagree that at some point the cardholder led the card issuer reasonably to believe that the fraudulent user had authority to use its card.

DBI's remaining contentions have no merit. DBI's reliance on the provision limiting a cardholder's liability to charges made on an "accepted" credit card, see 15 U.S.C. § 1643(a)(1)(A), is misplaced, for Moore's charges were not "unauthorized" because DBI's payments created apparent authority for Moore to make them. DBI's insistence that it derived no benefit from Moore's purchase of jewelry, shoes, and clothing is irrelevant because the use of a card is "unauthorized" only if the cardholder derives no benefit from it and it lacks actual, implied, or apparent authority. See id. § 1602( o). Because DBI's payments created apparent authority, the use was not "unauthorized."

Accordingly, we hold that DBI is estopped from avoiding liability to AMEX for the charges Moore incurred on the corporate account after her apparent authority arose. The question remains when Moore's apparent authority arose. The district court held, consistent with AMEX's alternative prayer for relief, that DBI could recover payment for the first two months of Moore's charges following her unauthorized acquisition of the card on DBI's corporate account. But no relevant statute sets a time period that is controlling. Both § 1666 and Regulation Z allow the cardholder 60 days from the date of the credit card statement to notify the card issuer of a billing error, see 15 U.S.C. § 1666(a); 12 C.F.R. § 226.13(b)(1), and District of Columbia banking law, on which the district court may have relied, allows the customer a "reasonable period of time, not exceeding 30 days," to examine a bank statement and to notify the bank of any fraudulent charges. D.C. Code § 28:4-406(d)(2); cf. Minskoff, 98 F.3d at 709-10. Because the question of precisely when apparent authority arose cannot be resolved as a matter of law, we remand DBI's § 1643 claim to the district court to determine, or as appropriate to allow a jury to determine, at what point DBI's payment created apparent authority and thereby terminated DBI's protection under the statute. AMEX did not cross-appeal, and therefore the district court's award of $21,748.87 for the first two months of use sets a floor for DBI's recovery. Cf. Hartman v. Duffey, 19 F.3d 1459, 1464-65 (D.C. Cir. 1994).

III.

The tort of conversion, or the "wrongful possession or disposition of another's property as if it were one's own," BLACK'S LAW DICTIONARY 333 (7th ed. 1999), has been codified in the District of Columbia:

The law applicable to conversion of personal property applies to instruments. An instrument is also converted if it is taken by transfer, other than a negotiation, from a person not entitled to enforce the instrument or a bank makes or obtains payment with respect to the instrument for a person not entitled to enforce the instrument or receive payment.

D.C. Code § 28:3-420(a). Under District of Columbia law, a holder in due course of a negotiable instrument, such as a check, takes the instrument free of any claims. Id. § 28:3-306. A holder of an instrument is a holder in due course if the instrument bears no facial evidence of forgery or alteration, and if the holder takes the instrument for value, in good faith, and without notice of the claim or defense. Id. § 28:3-302. Although § 28:3-420(a) provides that "[a]n action for conversion of an instrument may not be brought by . . . the issuer . . . of the instrument," and DBI was the issuer of the checks, AMEX did not challenge DBI's claim on this basis, and we therefore turn to DBI's contentions.

DBI concedes that the checks at issue bore no facial evidence of forgery or alteration, that AMEX took the checks for value, and that AMEX had no knowledge of the fraud. See Pl.'s Mem. of P. A. in Opp'n to Def.'s Mot. for Summ. J., at 14 n. 3. DBI's challenges to AMEX's good faith are to no avail. First, the district court's finding that AMEX took the checks in good faith, defined as "honesty in fact and the observance of reasonable commercial standards of fair dealing," D.C. Code § 28:3-103(a)(4), was not invalidated by its enforcement of an erroneous discovery deadline. The finding of good faith was based on the court's recognition that the automated processing of checks is a commercially reasonable practice in the banking industry, see id. § 28:3-103(a)(7); Grand Rapids Auto Sales, Inc. v. MBNA Am. Bank, 227 F.Supp.2d 721, 729 (W.D.Mich. 2002), and that AMEX had no reason to suspect fraud because it is not unusual for employers to pay the credit card debts of their employees, see Hartford Accident Indem. Co. v. Am. Express Co., 74 N.Y.2d 153, 544 N.Y.S.2d 573, 542 N.E.2d 1090, 1095 (1989). Any further discovery on this point would not have affected the basis for the district court's finding of good faith.

Second, DBI does not dispute that AMEX processed the checks electronically pursuant to its normal procedures. Nor does it offer any evidentiary support to show that AMEX's automated procedures "vary unreasonably from general banking usage." D.C. Code § 28:3-103(a)(7). It thus fails to raise a genuine issue as to whether AMEX's automated processing of checks was commercially reasonable.

Third, DBI's contention that AMEX acted in bad faith when it failed to offer DBI the fraud prevention technology that it applies to large corporate accounts is irrelevant to the conversion claim, which relates only to Moore's personal AMEX account. Similarly, DBI's supplemental memorandum that the district court rejected as untimely refers to technology that prevents fraudulent credit card charges, not fraudulent use of checks to pay for legitimate credit card charges.

DBI's remaining contentions have no merit. Its view that a direct payee of stolen funds cannot be a holder in due course does not reflect District of Columbia law. Comment 4 to D.C. Code § 28:3-302 states that although typically the holder in due course is not the payee of the instrument, "in a small percentage of cases it is appropriate to allow the payee of an instrument [such as AMEX] to assert rights as a holder in due course." This occurs when the "conduct of some third party [such as Moore] is the basis of the defense of the issuer of the instrument." D.C. Code § 28:3-302 cmt. 4. Consequently, AMEX can be a holder in due course of DBI's corporate checks for payment of charges on Moore's personal account. DBI's suggestion that the holder in due course doctrine "has the effect of abolishing the common law of conversion" preserved in District of Columbia law, Appellant's Br. at 26, is an overstatement, for the tort is defeated only to the extent there is a defense to the claim.

Accordingly, we affirm in part the grant of summary judgment to AMEX on DBI's § 1643 claim and we remand in part; we affirm the grant of summary judgment to AMEX on DBI's conversion claim.