ORDER1 (1) GRANTING MOTIONS TO DISMISS FOR IMPROPER VENUE AND (2) GRANTING IN PART MOTION TO DISMISS FOR FAILURE TO STATE A CLAIM UPON WHICH RELIEF MAY BE GRANTED
Plaintiff eBay Inc. (“eBay”) alleges that Defendants Digital Point Solutions, Inc., Kessler’s Flying Circus, Thunderwood Holdings, Inc., Todd Dunning, Todd Dunning Enterprises, Inc., Brian Dunning, BrianDunning.com, and Does 1-20 engaged in a “cookie stuffing” scheme in violation of the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 1030 et seq., and the Racketeer Influenced and Corrupt Organizations Act (“RICO”), 18 U.S.C. § 1962(c). eBay’s first amended complaint (“FAC”) also sets forth multiple state law claims. Defendants move to dismiss the FAC for failure to state a claim upon which relief may be granted, improper venue, and, as to eBay’s state law claims, lack of subject matter jurisdiction.2 For the reasons set forth below, the motions to dismiss for improper venue will be granted with leave to amend, and the motion to dismiss for failure to state a claim will be granted in part with leave to amend. Resolution of the motion to dismiss certain state law claims will be deferred pending amendment of the federal claims.
I. BACKGROUND
eBay pays an advertising fee to its marketing affiliates when an advertisement *1160placed by an affiliate on a web page is clicked by a web user. FAC ¶ 19. The crediting of appropriate advertising fees occurs as follows. When a web user clicks on an advertisement placed by an eBay advertising affiliate, the user’s browser is directed to the eBay website. When the user accesses eBay’s website, a “cookie” is deposited onto the user’s computer. Id. at ¶ 22. This cookie contains information with respect to the referring advertising affiliate and can track whether the user visits eBay again and whether any subsequent visit qualifies as a “revenue action.” Id. at ¶¶ 21-22. Revenue actions, which include the user registering with eBay or utilizing the auction service offered by eBay, result in the payment of commissions to the referring advertising affiliate. Id. at ¶ 19. If multiple cookies are present on the user’s computer — which may occur if the user has clicked on several different advertisements before engaging in a revenue action — the most recently deposited cookie (and its corresponding advertising affiliate) will be credited for any revenue actions. Id. at ¶ 22.
The FAC alleges that each group of Defendants engaged in a cookie stuffing scheme that resulted in the improper payment of advertising fees. While the exact method used by Defendants is unknown, eBay surmises that Defendants first placed software code on a web user’s computer surreptitiously, without the user’s knowledge. FAC ¶ 25. The software code then directed the user’s browser to eBay’s website, without the user’s knowledge or any affirmative action on the part of the user. See id. When the user’s web browser accessed eBay’s website, Defendants’ software code then prompted eBay to deposit a cookie on the user’s computer, credited to Defendants as if the user had been referred to eBay via a legitimate advertisement. Id. As a result, advertising fees for subsequent revenue actions were credited to Defendants even though the user never clicked on an advertisement. Id. at ¶¶ 25-26, 32. The cookie stuffing displaced legitimate cookies placed by other eBay affiliates. See id. at ¶¶ 22, 32.
eBay alleges that Defendants engaged in the above-described activities from at least December 2004 until June 2007. FAC ¶¶ 37-38. In January 2008, Commission Junction, a subsidiary of ValueClick that administers the revenue action payment process for eBay, sued Defendants for breach of contract in Orange Superior Court (the “Commission Junction Action”). Defendants and Commission Junction are parties to a Publisher’s Service Agreement (“PSA”), which includes a forum selection clause stating that “[t]he exclusive forum for any actions related to this Agreement shall be in the state courts, and, to the extent that the federal courts have exclusive jurisdiction, in Los Angeles, California.” PSA at 5. The issues in the Commission Junction Action arise out of the same conduct alleged in the FAC, with Commission Junction seeking the return of fees paid to several Defendants on the ground that such fees were improperly credited because of the cookie-stuffing scheme described above.
eBay initiated the instant action on August 25, 2008 and the FAC was filed on October 7, 2008. eBay alleges six claims for relief: (1) violation of the CFAA, (2) violation of RICO, (3) fraud, (4) violation of CaLPenal Code § 502, (5) unjust enrichment, and (6) violation of Cal. Bus. & Prof.Code § 17200. The FAC refers expressly to a contractual arrangement between eBay and Commission Junction with respect to the operation of the advertising affiliate program, but it does not allege any facts with respect to the PSA.
II. LEGAL STANDARD
When considering a motion to dismiss, the plaintiffs allegations are taken as true *1161and the Court must construe the complaint in the light most favorable to the plaintiff. Jenkins v. McKeithen, 395 U.S. 411, 421, 89 S.Ct. 1843, 23 L.Ed.2d 404 (1969). For a motion to dismiss for failure to state a claim pursuant to Fed.R.Civ.P. 12(b)(6), “[d]ismissal is appropriate only where the complaint lacks a cognizable legal theory or sufficient facts to support a cognizable legal theory.” Mendiondo v. Centinela Hosp. Medical Center, 521 F.3d 1097, 1104 (9th Cir.2008). “While a complaint attacked by a Rule 12(b)(6) motion to dismiss does not need detailed factual allegations, a plaintiffs obligation to provide the ‘grounds’ of his ‘entitle[ment] to relief requires more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do.” Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 127 S.Ct. 1955, 1964-65, 167 L.Ed.2d 929 (2007) (citations omitted).
A motion to dismiss for lack of subject matter jurisdiction may attack the complaint on facial or factual grounds. See Safe Air For Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir.2004). In a facial attack, the moving party asserts that the allegations in the complaint are insufficient on their face to invoke federal jurisdiction. Id. In a factual attack, the moving party disputes the truth of the allegations in the complaint, which otherwise would be sufficient to invoke federal jurisdiction. Id. In resolving a facial attack, the Court accepts the allegations in the complaint as true. Whisnant v. United States, 400 F.3d 1177, 1179 (9th Cir.2005). In resolving a factual attack, the Court need not presume the truthfulness of the allegations set forth in the complaint and may consider evidence beyond the face of the complaint without converting the motion to dismiss into a motion for summary judgment. Id.; Safe Air, 373 F.3d at 1039. Once the moving party has presented affidavits or other evidence tending to show that subject matter jurisdiction does not lie, the plaintiff must present affidavits or other evidence sufficient to establish subject matter jurisdiction. Safe Air, 373 F.3d at 1039.
A motion to dismiss for improper venue based upon a forum selection clause may be brought pursuant to a Fed. R.Civ.P. 12(b)(3). See Argueta v. Banco Mexicano, S.A., 87 F.3d 320, 323-24 (9th Cir.1996). In a Rule 12(b)(3) motion, the allegations in the complaint need not be accepted as true and the Court may consider evidence outside the pleadings. Murphy v. Schneider Nat’l, Inc., 362 F.3d 1133, 1137 (9th Cir.2004). If there are any factual disputes with respect to a forum selection clause, “the trial court must draw all reasonable inferences in favor of the non-moving party and resolve all factual conflicts in favor of the non-moving party.” Id. at 1138. Ultimately, the plaintiff bears the burden of showing that venue is proper. Piedmont Label Co. v. Sun Garden Packing Co., 598 F.2d 491, 496 (9th Cir.1979).
III. DISCUSSION
The Non-DPS Defendants argue that the FAC should be dismissed pursuant to Fed.R.Civ.P. 12(b)(3) for improper venue. The Non-DPS Defendants also contend that the FAC fails to state a claim under the CFAA or RICO, and that the remaining state law claims thus must be dismissed for lack of subject matter jurisdiction. The DPS corporate entity moves pursuant to Fed.R.Civ.P. 12(b)(6) to dismiss the claims under the CFAA and RICO as well as two of the four state-law claims. Defendant Shawn Hogan seeks dismissal only of the RICO claim.
A. Venue and the Nom-DPS Defendants
The FAC alleges that venue is proper under 28 U.S.C. §§ 1391(b)-(c) and 18 U.S.C. § 1965(a). Pursuant to *1162§ 1391(b)(1), a civil action may be brought in any district in which a defendant resides. A civil action also may be brought in any district “in which a substantial part of the events or omissions giving rise to the claim occurred.” 28 U.S.C. § 1391(b)(2). If the defendant is a corporation, it is deemed to reside in any district where its contacts would be sufficient to subject it to personal jurisdiction. 28 U.S.C. § 1391(c). 18 U.S.C. § 1965(a) provides that a RICO action may be “instituted in the district court of the United States for any district in which such person resides, is found, has an agent, or transacts his affairs.” See also City of New York v. Cyco.Net, Inc., 383 F.Supp.2d 526, 543 (S.D.N.Y.2005) (“The RICO venue provision is supplemental to the general federal venue provision found in 28 U.S.C. § 1391.”) (citations omitted).
In the absence of an enforceable forum selection clause, it is apparent that eBay has alleged sufficient facts to establish that venue is proper in this district. Defendants’ software code forced web users’ browsers to visit eBay’s website, resulting in the placement of a cookie that should not have been deposited. When the users visited eBay’s site again and engaged in a revenue action, the improperly credited cookie caused eBay to pay Defendants for the revenue action. These events are sufficient to establish personal jurisdiction under § 1391(b)(2), as some or all of the predicate acts underlying eBay’s claims are alleged to have occurred in this district. The test for venue over a corporation under § 1391(b)(1) essentially mirrors the test for personal jurisdiction. 28 U.S.C. § 1391(c); Jonathan Browning, Inc. v. Venetian Casino Resort, LLC, No. C 07-3983, 2007 WL 4532214, at *5-6 (N.D.Cal. Dec. 19, 2007) (“A corporation resides in any jurisdictional district in which it is subject to personal jurisdiction.”). The Court concludes that the corporate Defendants are subject to personal jurisdiction because of the multiple alleged contacts with eBay’s computer system in this district. See id. at *6. The alleged harm that resulted from such contacts also occurred in this district because the advertising affiliate data maintained by eBay was corrupted by Defendants’ software code.
However, the Non-DPS Defendants argue that eBay is bound by the forum selection clause set forth in the PSA. A forum selection clause is presumed to be valid and enforceable absent a showing that “enforcement would be unreasonable and unjust, or that the clause was invalid for such reasons as fraud or overreaching.” M/S Bremen v. Zapata OffShore Co., 407 U.S. 1, 15, 92 S.Ct. 1907, 32 L.Ed.2d 513 (1972). eBay does not contest the validity of the clause; rather, it asserts that it is not bound by the clause because it is not a signatory to the PSA. In response, Defendants argue that eBay is bound by the PSA as a third-party beneficiary.
In the Ninth Circuit, a third-party beneficiary of an agreement is bound by the terms of the agreement, including a valid forum selection clause. TAAG Linhas Aereas de Angola v. Transamerica Airlines, Inc., 915 F.2d 1351, 1354 (9th Cir.1990) (“it is well-settled contract law that the scope of a third-party beneficiary’s rights is defined by the contract ... a forum selection clause can restrict a third-party beneficiary to the designated forum.”). Defendants argue that while eBay may not be an actual signatory to the PSA, eBay does enter into a supplemental Terms and Conditions (“T & C”) Agreement with advertising affiliates. The T & C Agreement appears to supplement the PSA, reciting in relevant part as follows:
In consideration for Your participation in the Affiliate Program (the “Program”) maintained by eBay Inc. (“eBay”) *1163through Commission Junction (“CJ”), You agree to comply with these Supplemental Terms and Conditions (“Terms and Conditions”) in addition to the terms of the Commission Junction Publisher Service Agreement (“PSA”). If any of these Terms and Conditions conflict with those of the PSA, then these Terms and Conditions will control. Capitalized terms not defined herein have the meanings set forth in the PSA.
Foreman Decl. Ex. 2. This language in the T & C Agreement, when read together with eBay’s own allegations in the FAC with respect to the role of the PSA, indicates that eBay is a third-party beneficiary of the PSA. Pursuant to the PSA, advertising affiliates earn revenue by “promoting Advertisers,” including eBay. See PSA at 1. Indeed, the T & C Agreement appears expressly to incorporate the terms of the PSA. See Prouty v. Gores Tech. Group, 121 Cal.App.4th 1225, 1232, 18 Cal.Rptr.3d 178 (2004) (“The test for determining whether a contract was made for the benefit of a third person is whether an intent to benefit a third person appears from the terms of the contract.”) (citation omitted).
At oral argument, eBay contended that a separate “user agreement” supersedes the forum selection clause of the PSA. See Hr’g Tr. 25-26, Dec. 12, 2008. However, the FAC does not explain how violation of the user agreement is unrelated to the alleged breach of the PSA or why the PSA should not be considered the primary and controlling agreement for all claims related to the PSA. Moreover, the FAC only alleges that individual Defendants Shawn Hogan, Brian Dunning, and Todd Dunning entered into the user agreement. See FAC ¶ 35. Accordingly, while eBay has met its burden of showing that venue would be proper in this district in the absence of an applicable forum selection clause, it has failed to present sufficient allegations as to why it is not bound by the forum selection clause contained in the PSA. The Central District of California and/or the Los Angeles Superior Court would provide an alternate and viable forum to bring claims against the Non-DPS Defendants. See Murphy, 362 F.3d at 1141-43. Accordingly, the motion to dismiss by the Non-DPS Defendants for improper venue will be granted, with leave to amend.3 Because the Court finds that dismissal of the FAC with respect to the Non-DPS Defendants is proper under Rule 12(b)(3), it does not consider the other motions brought by these Defendants.
B. Alleged Violation of CFAA by the DPS Corporate Entity
Under the CFAA, civil liability may be imposed where a defendant
[K]nowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value ... (18 U.S.C. § 1030(a)(4)); or
[I]ntentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damage (18 U.S.C. § 1030(a)(5)(B)); or
[I]ntentionally accesses a protected computer without authorization, and as a result of such conduct, causes damage and loss (18 U.S.C. § 1030(a)(5)(C)); and
[C]auses loss to one or more persons during any 1-year period ... aggregat*1164ing at least $5,000 in value (18 U.S.C. § 1030(c)(4)(A)©©).
See also Ticketmaster L.L.C. v. RMG Techs., Inc., 507 F.Supp.2d 1096, 1113 (C.D.Cal.2007).
The instant case appears to be one of first impression with respect to the application of the CFAA to a cookie stuffing scheme. As an initial matter, the use of a third party’s computer to access a website, rather than one’s own computer, does not prevent a claim under the CFAA. See Binary Semantics Ltd. v. Minitab, Inc., 07-CV-1750, 2008 WL 763575, at *5 (M.D.Pa. Mar.20, 2008) (concluding that the CFAA applies to defendant who controlled actions of person who allegedly accessed a protected computer). Such a conclusion comports with reality, as hackers may use the computers of unknowing third parties to carry out their schemes. See, e.g., U.S. v. Ancheta, Case No. CR 05-1060 (C.D.Cal.) (hacker admitted using third-party computers as “zombies” to carry out spam operations and denial of service attacks).4 DPS argues that even if it directed a user’s computer to the eBay website, such access by the user’s computer was not “without authorization,” as eBay is a public website that may be accessed by anyone and thus is not a “protected computer” within the meaning of the CFAA.
In response, eBay argues that “[DPS’s] access of eBay’s computers was unauthorized because the only purpose of that access was to defraud eBay.” FAC ¶35. Allegations with respect to access and use beyond those set forth in a user agreement constitute unauthorized use under the CFAA. See Am. Online, Inc. v. LCGM, Inc., 46 F.Supp.2d 444, 450 (E.D.Va.1998) (“Defendants’ actions violated [the] Terms of Service, and as such was unauthorized.”). In addition, Defendant Shawn Hogan has not moved to dismiss the CFAA claim, presumably because the FAC alleges that he did enter into a formal user agreement and violated the terms of that agreement (and the CFAA) by engaging in the alleged cookie stuffing scheme.5 While DPS argues it could not have violated the user agreement because it never entered into any such agreement with eBay, eBay alleges explicitly that DPS caused users to access eBay’s website solely to corrupt eBay’s advertising affiliate data. For purposes of a Rule 12(b)(6) motion, such allegations are sufficient to support a claim of unauthorized access in violation of the CFAA. In addition, “fraud” under the CFAA only requires a showing of unlawful access; there is no need to plead the elements of common law fraud to state a claim under the Act. See Hanger Prosthetics & Orthotics, Inc. v. Capstone Orthopedic, Inc., 556 F.Supp.2d 1122, 1131 (E.D.Cal.2008) (“The term ‘defraud’ for purposes of § 1030(a)(4) simply means wrongdoing and does not require proof of common law fraud.”). Accordingly, eBay has sufficiently alleged that DPS engaged in conduct prohibited by the CFAA.6
*1165 C. Alleged RICO violations by DPS Defendants
“To state a claim under § 1962(c), a plaintiff must allege ‘(1) conduct (2) of an enterprise (3) through a pattern (4) of racketeering activity.’ ” Odom v. Microsoft Corp., 486 F.3d 541, 547 (9th Cir.2007) (quoting Sedima, S.P.R.L. v. Imrex Co., Inc., 473 U.S. 479, 496, 105 S.Ct. 3275, 87 L.Ed.2d 346 (1985)). The DPS Defendants argue that the FAC fails to plead the enterprise element adequately, as the DPS corporate entity did not come into existence until May 2007 and thus cannot satisfy the “enterprise” element. DPS also contends that the FAC fails to establish an association-in-fact enterprise because the FAC names only Does 1-10 with Shawn Hogan in an attempt to plead a RICO association.
RICO defines “enterprise” to include “any individual, partnership, corporation, association, or other legal entity, and any union or group of individuals associated in fact although not a legal entity.” 18 U.S.C. § 1961(4). An enterprise need not be exclusively criminal in nature to come under the auspices of RICO. U.S. v. Turkette, 452 U.S. 576, 580-81, 101 S.Ct. 2524, 69 L.Ed.2d 246 (1981). Instead, an enterprise need only be an “ongoing organization, formal or informal,” so long as the organization functions as a “continuing unit.” Odom, 486 F.3d at 552 (quoting Turkette, 452 U.S. at 583, 101 S.Ct. 2524). “A single ‘individual’ is an enterprise under RICO. Similarly, a single ‘partnership,’ a single ‘corporation,’ a single ‘association,’ and a single ‘other legal entity’ are all enterprises.” Id. at 549.
eBay alleges that the cookie stuffing scheme constituted the predicate act of mail and wire fraud under 18 U.S.C. § 1343. See FAC ¶45. In the Ninth Circuit, a RICO claim predicated on mail fraud is subject to the heightened pleading requirements of Fed.R.Civ.P. 9(b), which requires that fraud be pled with particularity. Lancaster Cmty. Hosp. v. Antelope Valley Hosp. Dist., 940 F.2d 397, 405 (9th Cir.1991). The FAC fails to meet this standard. It alleges that “Defendant Shawn Hogan and DOES 1-10 (the ‘Hogan Group’) engaged in activities through the company Digital Point Solutions, Inc., which constitutes an enterprise under RICO. Through Digital Point Solutions, Inc., the Hogan Group associated with each other and others for the common purpose of defrauding eBay of commission fees by designing and implementing the cookie stuffing scheme described above.” FAC ¶ 43. It is unclear from the FAC whether eBay is alleging that the Hogan Group was associated with the DPS corporate entity at all relevant times or only during certain periods (for example from the incorporation of DPS in May 2007 through the termination of the enterprise in June 2007). While eBay theorizes that the Hogan Group may have constituted a separate association-in-fact enterprise for certain time periods, the FAC does not set forth this theory in sufficient detail. See Lancaster Cmty. Hosp., 940 F.2d at 405 (a RICO claim should “detail with particularity the time, place, and manner of each act of fraud, plus the role of each defendant in each scheme.”). Nor does the FAC cite any specific incidents of suspected cookie-stuffing activity by any Defendant. A pattern of activity should be pled with specificity in order to state a claim under RICO. See id. Accordingly, the motion to *1166dismiss the RICO claim will be granted, with leave to amend.
D. State Law Claims
The DPS corporate entity also seeks dismissal of eBay’s state law claims for fraud and violation of Cal.Penal Code § 502. The underlying basis for both claims is the fraudulent cookie stuffing scheme. Under Ninth Circuit case law, these claims are subject to the pleading requirements of Rule (9)(b). Vess v. Ciba-Geigy Corp. USA, 317 F.3d 1097, 1103-04 (9th Cir.2003) (“Rule 9(b) applies to ‘averments of fraud’ in all civil cases in federal district court ... [where] the claim is said to be ‘grounded in fraud’ or to ‘sound in fraud’... the pleading of that claim as a whole must satisfy the particularity requirement of Rule 9(b).”). For the reasons set forth above, eBay’s third and fourth causes of action against the DPS corporate entity will be dismissed, with leave to amend.
IV. ORDER
Good cause therefor appearing, IT IS HEREBY ORDERED that the motions of the Non-DPS Defendants to dismiss for improper venue are GRANTED, with leave to amend, and the motion of the DPS Defendants to dismiss for failure to state a claim upon which relief may be granted is GRANTED IN PART, with leave to amend.7 Any amended complaint shall be filed within thirty (30) days of the date of this order.