Searching over 5,500,000 cases.


searching
Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.

PENNSYLVANIA ST. EMPLOYEES CREDIT UNION v. FIFTH THIRD BANK

October 18, 2005.

PENNSYLVANIA STATE EMPLOYEES CREDIT UNION, Plaintiff,
v.
FIFTH THIRD BANK AND BJ'S WHOLESALE CLUB, INC., Defendants, v. BJ'S WHOLESALE CLUB, INC., Third-Party Plaintiff, v. INTERNATIONAL BUSINESS MACHINES CORPORATION, Third-Party Defendant.



The opinion of the court was delivered by: WILLIAM CALDWELL, Senior District Judge

MEMORANDUM

I. Introduction.

This case stems from a breach of the computer system used by defendant, BJ's Wholesale Club, Inc., a wholesale club retailer. The system was hacked and bank-card numbers were stolen, allegedly because the computer program BJ's used to process card transactions improperly retained card numbers rather than merely keep them in the system only for the seconds required to validate the transaction.

  Some of the numbers stolen belonged to customers of plaintiff, Pennsylvania State Employees Credit Union (PSECU). PSECU filed this lawsuit seeking damages represented by the costs of replacing the cards that had been compromised by the theft. PSECU participates in the system operated by Visa USA Inc., so the cards were Visa cards.

  The case was filed in state court against BJ's and Fifth Third Bank, the bank that processes card transactions for BJ's. It was removed here on the basis of diversity jurisdiction. 28 U.S.C. §§ 1332(a) and 1441(a). PSECU then filed an amended complaint. The amended complaint has eight counts. The two defendants have each been sued for breach of contract, negligence, equitable indemnification, and unjust enrichment.*fn1

  BJ's added International Business Machines Corporation (IBM), the supplier of the software BJ's used to process transactions, as a third-party defendant, alleging that IBM's software failed to comply with BJ's request that it not retain card numbers. The third-party complaint sought recovery from IBM of whatever damages PSECU recovered from BJ's. On IBM's motion to dismiss, we allowed BJ's to seek recovery of the value of the compromised bank cards as blanks. See Pennsylvania State Employees Credit Union v. Fifth Third Bank, 2005 WL 1154594 (M.D. Pa. 2005). IBM has moved for reconsideration of that ruling, seeking complete dismissal of the complaint against it. The defendants have each filed separate motions to dismiss under Fed.R.Civ.P. 12(b)(6), arguing that none of the claims states a valid cause of action. BJ's motion argues principally as follows. First, PSECU's breach-of-contract claim (predicated on third-party-beneficiary status) fails because BJ's has no contract with Visa and its contracts with Fifth Third affirmatively exclude third-party beneficiaries. Second, PSECU's negligence claim fails because it is barred by the economic loss doctrine and by the gist of the action doctrine. Third, the equitable-indemnification claim fails because PSECU was fulfilling a contractual obligation of its own in replacing the cards and in these circumstances cannot look to BJ's for reimbursement. Fourth, the unjust enrichment claim fails because Plaintiff has not alleged it paid damages to a third party.

  In its motion, Fifth Third principally argues as follows. First, PSECU has no breach-of-contract claim against it because PSECU is not a third-party beneficiary of Fifth Third's contract with Visa, the basis of the contract claim against Fifth Third. Second, PSECU has no negligence claim because Fifth Third owed it no duty of reasonable care, an essential element of a negligence claim, because duty cannot be based on contractual obligations, as PSECU attempts to do here. Additionally, a negligence claim cannot be pursued without physical harm to person or property; purely economic losses are not sufficient. Third, the indemnity claim fails because: (1) PSECU is entitled to indemnity only if Fifth Third committed a tort against the cardholders, and it committed no tort; (2) PSECU is entitled to indemnity only if its cardholders suffered a loss, but they did not do so because federal law imposes the loss for the unauthorized charges on PSECU and excuses the cardholders; (3) PSECU cannot be secondarily liable to Fifth Third because PSECU accuses Fifth Third of failing to detect the defect in BJ's computer system, a theory of secondary liability itself; and (4) PSECU cannot be secondarily liable because both contractual obligations and federal law make PSECU primarily liable for the fraudulent transactions. Fourth, the unjust enrichment claim fails, in part, because PSECU was fulfilling a contractual obligation of its own in replacing the cards.

  II. Standard of Review.

  In considering Defendants' motions to dismiss, we must accept as true the factual allegations in the complaint and construe any inferences to be drawn from them in Plaintiff's favor. See Mariana v. Fisher, 338 F.3d 189, 195 (3d Cir. 2003). We may dismiss a complaint under Fed.R.Civ.P. 12(b)(6) only if it is clear that no relief could be granted to Plaintiff under "any set of facts that could be proven consistent with the allegations." Ramadan v. Chase Manhattan Corp., 229 F.3d 194, 195 (3d Cir. 2000). The court is not limited to evaluating the complaint alone; it can also consider documents attached to the complaint, matters of public record, and other documents that are indisputably authentic. Pension Ben. Guar. Corp. v. White Consol. Indus., 998 F.2d 1192, 1196 (3d Cir. 1993). The court may also consider "documents whose contents are alleged in the complaint and whose authenticity no party questions," even though they "are not physically attached to the pleading. . . ." Pryor v. Nat'l Collegiate Athletic Ass'n, 288 F.3d 548, 560 (3d Cir. 2002).

  III. Background.

  The complaint alleges the following. PSECU is a Pennsylvania credit union with its principal office in Harrisburg, Pennsylvania. (Doc. 61, Am. Compl. ¶¶ 1 and 6.) Defendant BJ's, a seller of wholesale goods, is a Delaware corporation with its principal place of business in Massachusetts. (Id. ¶¶ 2 and 10.) Defendant Fifth Third is an Ohio corporation with its principal place of business in Ohio. (Id. ¶ 3.) "Visa is a privately-held, for-profit association, which supports Visa-brand cards issued by financial institutions ("Issuing Banks") to consumers, and processes transactions made with those cards on behalf of "Acquiring Banks" and "Merchants" enrolled in its program." (Id. ¶ 7.) PSECU is an issuing bank, issuing Visa cards to its members (id. ¶ 8), for use in retail purchases from merchants. Fifth Third is an acquiring bank, processing Visa card transactions on behalf of merchants, and is the acquiring bank for BJ's. (Id. ¶¶ 9 and 11.) BJ's is a Visa merchant and accepts Visa card transactions from consumers. (Id. ¶¶ 10.)

  Visa has extensive operating regulations. (Id. ¶ 13.) The regulations require an acquiring bank to guarantee that its merchants will abide by them (id. ¶ 16), and to include in its contract with its merchants a provision requiring the merchant to abide by the regulations, including security regulations, specifically, those regulations prohibiting disclosure of account information, magnetic-stripe information and transaction information. (Id. ¶ 20.) The regulations "require Fifth Third to accept responsibility for any and all losses caused by BJ's failure to comply with the" operating regulations. (Id. ¶ 22.)

  In turn, Fifth Third has a contract with Visa that requires Fifth Third to comply with the operating regulations. (Id. ¶ 14.) Under "Fifth Third's contract with Visa, Fifth Third: guarantees BJ's compliance with the Visa Operating Regulations . . .; guarantees that BJ's will properly secure magnetic stripe information; guarantees that BJ's will not retain such information subsequent to authorization of a transaction; and, guarantees that BJ's will not disclose such information to unauthorized third parties." (Id. ¶ 23.)

  Fifth Third has a contract with BJ's that requires BJ's to comply with the operating regulations. (Id. ¶ 15; Doc. 69, BJ's Exs. 1 and 2.) Those regulations forbid BJ's from: (1) "disclosing any Visa cardholder account numbers, magnetic stripe information, or transaction information to third parties other than the Merchant's agents," the acquiring bank, or the acquiring bank's agents; or (2) "retaining or storing Visa card magnetic stripe data subsequent to authorization of a transaction." (Id., ¶¶ 26 and 27).

  Fifth Third and BJ's have contracted by way of two merchant agreements. One governs the processing of debit-card transactions (Doc. 69, BJ's Ex. 1.) and the other credit-card transactions. (Id., BJ's Ex. 2.) Both contain the following language, quoting in a pertinent part from paragraph 16 of each agreement: "This agreement is for the benefit of, and may be enforced only by, Bank and Merchant and their respective successors and permitted transferees and assignees, and is not for the benefit of, and may not be enforced by, any third party." Both agreements also have a choice-of-law provision, requiring them to be "governed, construed and enforced" under Ohio law. (Id., Exs. 1 and 2, ¶ 23.) Both also prohibit, in pertinent part, BJ's from disclosing a cardholder's name, address or account number to third parties without written consent. (Id., Exs. 1 and 2, ¶ 8.)

  From at least July 1, 2003, through February 29, 2004, BJ's retained, and failed to properly secure, Visa card magnetic-stripe information when Visa cards were used in retail transactions, including over 20,000 Visa cards issued by PSECU to its members. (Id. ¶¶ 31, 32 and 33.) As a result, unauthorized third parties were able to obtain from BJ's electronic records, the Visa card magnetic-stripe information retained by BJ's between at least July 1, 2003 and February 29, 2004, including the magnetic stripe information from 20,029 Visa cards issued by PSECU. (Id. ¶ 35.)

  The unauthorized third parties "were able to use some or all of the Visa card magnetic stripe information obtained to create counterfeit Visa cards and use or attempt to use those cards for fraudulent purposes." (Id. ¶ 36.) "[T]o mitigate the damage caused by the compromise of PSECU members' Visa card magnetic stripe information, PSECU canceled" the 20,029 Visa cards "and reissued Visa cards with new account numbers and magnetic stripe information. . . ." (Id. ¶ 39.) Plaintiff also replaced its members' Visa cards "to protect its legal rights and to fulfill a contractual obligation owed to its customers." (Id. ¶ 65.) The cancellation and reissuance cost PSECU $98,128.13. (Id. ¶ 40.)

  The first two counts of the complaint are for breach of contract, count I against Fifth Third and count II against BJ's. In count I, PSECU alleges that it is a third-party beneficiary of the contract between Fifth Third and Visa, that Fifth Third breached the agreement by failing to insure that BJ's complied with the operating regulations that required BJ's not to retain or store cardholder information and not to disclose the information to unauthorized third parties. (Id. ¶¶ 42-43.) Fifth Third also breached the agreement by refusing to accept responsibility for BJ's breach of the regulations and reimburse Plaintiff for the cost of replacing the cards. (Id. ¶ 44.)

  In count II, PSECU alleges that it is a third-party beneficiary of BJ's merchant agreement with Fifth Third, that BJ's breached the agreement by failing to comply with the operating regulations requiring it not to retain or store cardholder information, and thereby damaged PSECU by requiring it to incur the cost of replacing the cards. (Id. ¶¶ 48, 50 and 52.)

  Counts III and IV are for negligence. In count III, Plaintiff alleges that Fifth Third had a duty to issuing banks like PSECU to ensure that its merchants complied with the Visa operating regulations and that Fifth Third breached this duty by failing to take reasonable actions to cause BJ's to process retail transactions so that BJ's either: (1) deleted magnetic-stripe information after a transaction had been approved; or (2) safeguarded the information so that unauthorized persons could not obtain it. (Id. ¶¶ 54 and 55.)

  In count IV, Plaintiff alleges that BJ's had a duty to comply with Visa operating regulations, to properly safeguard the magnetic stripe information, and not to retain it after a transaction had been processed. (Id. ¶ 58.) BJ's breached this duty by: (1) failing to safeguard the information; (2) improperly retaining it; and (3) allowing unauthorized persons to obtain it. (Id. ¶ 55.) Counts V and VI are for equitable indemnification, count V against BJ's and count VI against Fifth Third. In both counts, PSECU alleges that the conduct of BJ's and Fifth Third "necessitated the replacement of PSECU's members' Visa cards," that "PSECU replaced its members' Visa cards to protect its legal rights and to fulfill a contractual obligation owed to its customers," and that BJ's and Fifth Third "benefited from PSECU's replacement of PSECU's customers' Visa cards, in that this cancellation and replacement halted continued fraudulent use of those card numbers and permitted PSECU's members to resume use of their Visa cards, which mitigated BJ's potential liability to PSECU and PSECU's members." Plaintiff accordingly asserts that "[e]quity demands" that BJ's and Fifth Third "pay the costs of replacement of PSECU's members' Visa cards." (Id. ¶¶ 64-67 and 69-72.)

  Counts VII and VIII are for unjust enrichment, count VII against BJ's and count VIII against Fifth Third. In both counts, PSECU alleges that BJ's and Fifth Third "benefited from PSECU's cancellation and replacement of its members' Visa cards, in that this cancellation and replacement halted continued fraudulent use of those card numbers and permitted PSECU's members to resume use of their Visa cards, which mitigated" BJ's and Fifth Third's "potential liability to PSECU and PSECU's members." (Id. ¶¶ 74 and 79.) Both BJ's and Fifth Third "appreciated the benefits conferred by PSECU's cancellation and replacement of its members' Visa cards." (Id. ¶¶ 75 and 80.) BJ's and Fifth Third's "acceptance and retention of the benefits conferred by PSECU's cancellation and replacement of its members' Visa cards, without payment" by BJ's and Fifth Third "of compensation to PSECU, would be inequitable." (Id. ¶¶ 76 and 81.) Plaintiff alleges that BJ's and Fifth Third were thus "unjustly enriched by PSECU's cancellation and replacement of its members' Visa cards," (id. ¶¶ 77 and 82), and requests as damages the cost of replacing them.

  IV. Discussion.

  A. BJ's Motion to Dismiss.

  1. PSECU Has No Breach-of-Contract Claim.

  Acknowledging that it has no contract with BJ's, Plaintiff asserts its contract claim as a third-party beneficiary of the contracts between BJ's and Fifth Third.*fn2 BJ's credit- and debit-card contracts with Fifth Third require BJ's to comply with Visa regulations, and Plaintiff alleges BJ's thus breached the contracts by retaining cardholder information and failing to protect it from third parties in violation of the regulations. In moving to dismiss, BJ's argues that PSECU has no contract claim against it because its contracts with Fifth Third specifically exclude third parties as beneficiaries of the agreements. As the relevant provisions read: "This agreement is for the benefit of, and may be enforced only by, Bank and Merchant and their respective successors and permitted transferees and assignees, and is not for the benefit of, and may not be enforced by, any third party." BJ's argues that Ohio law rejects third-party-beneficiary claims when such a ...


Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.