Sovereign Bank v. Bj's Wholesale Club, Inc.

• Decision Date: 18 October 2005
• Docket Number: No. Civ. 1:CV-05-1150.,Civ. 1:CV-05-1150.
• Citation: 395 F.Supp.2d 183
• Parties: SOVEREIGN BANK, Plaintiff v. BJ'S WHOLESALE CLUB, INC., Fifth Third Bankcorp. Defendants.
• Court: U.S. District Court — Middle District of Pennsylvania

395 F.Supp.2d 183

SOVEREIGN BANK, Plaintiff v. BJ'S WHOLESALE CLUB, INC., Fifth Third Bankcorp. Defendants.

No. Civ. 1:CV-05-1150.

United States District Court, M.D. Pennsylvania.

October 18, 2005.

COPYRIGHT MATERIAL OMITTED

COPYRIGHT MATERIAL OMITTED

COPYRIGHT MATERIAL OMITTED

Christopher Grant Barnes, Stevens & Lee PC, Cherry Hill, NJ, Joseph Wolfson, Stevens & Lee, P.C., King of Prussia, PA, for Plaintiff.

Christopher A. Lewis, Mark L. Rhoades, Richard L. Kremnick, Blank Rome LLP, Philadelphia, PA, Andrew L. Swope, Christopher R. Nestor, Kirkpatrick & Lockhart Nicholson Graham LLP, Harrisburg, PA, Melvin A. Bedree, William B. Weigel, Vorys Sater Seymour and Pease LLP, Cincinnati, OH, for Defendants.

MEMORANDUM

CALDWELL, District Judge.

I. Introduction.

This case stems from a breach of the computer system used by defendant, BJ's Wholesale Club, Inc., a wholesale club retailer. The system was hacked and bank-card numbers were stolen, allegedly because the computer program BJ's used to process card transactions improperly retained card numbers rather than merely keep them in the system only for the seconds required to validate the transaction.

Some of the numbers stolen belonged to customers of plaintiff, Sovereign Bank. Sovereign filed this lawsuit seeking damages, mainly for the cost of issuing new credit cards to replace the ones that had been compromised by the theft and for the cost of reimbursing those card holders who had suffered unauthorized charges to their accounts. Sovereign participates in the system operated by Visa USA Inc., so the cards were Visa cards.

The case was filed in state court against BJ's and Fifth Third Bank Corp., an affiliate of Fifth Third Bank, the bank that processes card transactions for BJ's.¹ It was removed here on the basis of diversity jurisdiction. 28 U.S.C. §§ 1332(a) and 1441(a). The complaint has six counts. The two defendants have each been sued for breach of contract, negligence and indemnity.²

The defendants have filed separate motions to dismiss under Fed.R.Civ.P. 12(b)(6), arguing that none of the claims states a valid cause of action. BJ's motion argues as follows. First, Sovereign has no breach-of-contract claim against it because Sovereign is not a party to BJ's contract with Fifth Third, the contract at issue, and it is also not a third-party beneficiary of that contract either, because of a specific exclusion in the contract of third parties as beneficiaries. Second, Sovereign has no negligence claim because it bases that claim on BJ's breach of alleged contractual duties, and Pennsylvania's "gist of the action" doctrine bars a negligence claim that merely restates a breach-of-contract claim, even when that breach-of-contract claim is itself invalid. Additionally, the negligence claim fails on the causation element because any damages Sovereign incurred were caused by the criminal actions of those who broke into BJ's computer system, not BJ's negligence. Further, Sovereign has alleged only economic losses, and such losses are barred from recovery in a negligence claim by the economic loss doctrine. Third, the indemnity claim fails because Sovereign cannot show that its liability to its cardholders is secondary to BJ's liability, a necessary element of a noncontractual indemnity claim.

In its motion, Fifth Third argues as follows. First, Sovereign has no breach-of-contract claim against it because Sovereign is not a third-party beneficiary of Fifth Third's contract with Visa, the basis of the contract claim against Fifth Third. Second, Sovereign has no negligence claim because Sovereign cannot rely upon a breach of duty arising from alleged contractual obligations to establish a breach of the duty of reasonable cause in a negligence claim. Also, under the economic loss doctrine Sovereign cannot seek recovery in negligence without physical harm to person or property. Third, the indemnity claim fails because: (1) Sovereign is entitled to indemnity only if Fifth Third committed a tort against the cardholders, and it committed no tort; (2) Sovereign is entitled to indemnity only if its cardholders suffered a loss, but they did not do so because federal law imposes the loss for the unauthorized charges on Sovereign and excuses the cardholders; (3) Sovereign cannot be secondarily liable to Fifth Third because Sovereign accuses Fifth Third of failing to detect the defect in BJ's computer system, a theory of secondary liability itself; and (4) Sovereign cannot be secondarily liable because both contractual obligations and federal law make Sovereign primarily liable for the fraudulent transactions.

II. Standard of Review.

In considering Defendants' motions to dismiss, we must accept as true the factual allegations in the complaint and construe any inferences to be drawn from them in Plaintiff's favor. See Mariana v. Fisher, 338 F.3d 189, 195 (3d Cir.2003). We may dismiss a complaint under Fed.R.Civ.P. 12(b)(6) only if it is clear that no relief could be granted to Plaintiff under "any set of facts that could be proven consistent with the allegations." Ramadan v. Chase Manhattan Corp., 229 F.3d 194, 195 (3d Cir.2000). The court is not limited to evaluating the complaint alone; it can also consider documents attached to the complaint, matters of public record, and other documents that are indisputably authentic. Pension Ben. Guar. Corp. v. White Consol. Indus., 998 F.2d 1192, 1196 (3d Cir.1993). The court may also consider "documents whose contents are alleged in the complaint and whose authenticity no party questions," even though they "are not physically attached to the pleading...." Pryor v. Nat'l Collegiate Athletic Ass'n, 288 F.3d 548, 560 (3d Cir.2002).

III. Background.

The complaint alleges the following. Sovereign is a federal savings and loan association with its principal place of business in Wyomissing, Pennsylvania. (Doc. 2, Attach.1, Compl.¶ 1.) Visa is a "membership association" owned and controlled by its members. (Id. ¶¶ 6 and 8.) An "issuing member" issues Visa cards to cardholders; the relationship is contractual. (Id. ¶ 10.) An "acquiring member" enters into contracts with "merchants," (id. ¶ 11), to process card transactions at the retail end. For the purposes of the lawsuit, Sovereign is an issuing bank and Fifth Third an acquiring bank. (Id. ¶¶ 13 and 14.) A "merchant" allows cardholders to access the Visa payment system by using their Visa cards to pay for the goods or services the merchant offers. (Id. ¶ 12.)

Fifth Third and BJ's have contracted by way of two merchant agreements. One governs the processing of debit-card transactions (Doc. 3, BJ's Ex. A) and the other credit-card transactions. (Id., BJ's Ex. B.) Both contain the following language, quoting in pertinent part from paragraph 16 of each agreement: "This agreement is for the benefit of, and may be enforced only by, Bank and Merchant and their respective successors and permitted transferees and assignees, and is not for the benefit of, and may not be enforced by, any third party." Both agreements also have a choice-of-law provision, requiring them to be "governed, construed and enforced" under Ohio law. (Id., Exs. A and B, ¶ 23.)

A bank card contains account information on the cardholder in a magnetic stripe on the back of the card. (Compl. ¶¶ 19 and 20.) To complete a transaction, the merchant often runs the card through a magnetic-stripe terminal, which acquires the cardholder information and sends it to the issuing bank. (Id. ¶ 19.) The issuing bank then reviews the information and if everything is valid, approves the transaction. (Id. ¶ 20.) The merchant then completes the transaction with the cardholder. (Id. ¶ 21.)

Visa has extensive by-laws and operating regulations. (Id. ¶ 7.) To become a member, a financial institution must agree to abide by the operating regulations. (Id. ¶ 16.) The operating regulations require an acquiring bank to compel its merchants to abide by the operating regulations. (Id. ¶ 59.) The operating regulations prohibit a merchant from storing or retaining cardholder information. (Id. ¶¶ 22, 51 and 60.)

Sovereign cardholders used their Visa cards at BJ's, and BJ's retained the cardholders' information after Sovereign had approved the transactions, contrary to the operating regulations. (Id. ¶¶ 24 and 25.) Thereafter, third parties obtained the cardholder information to make unauthorized purchases. (Id. ¶ 27.) Sovereign paid for the fraudulent transactions and incurred other damages: the expense of issuing new cards, the loss of fees and commissions while the cards were being replaced, and loss of good will. (Id. ¶¶ 30 and 32.)

The first two counts of the complaint are negligence claims, count I against BJ's and count II against Fifth Third. In count I, Sovereign alleges that "BJ's had a duty to exercise reasonable care in deleting or erasing cardholder information after a transaction had been approved and/or safeguard such information," (id. ¶ 34), breached that duty by failing to delete the information promptly after Sovereign had approved the transaction, (id. ¶ 37), and that as a result, the cardholder information was stolen, causing damage to Sovereign. (Id. ¶¶ 39 and 40.)

In count II, Sovereign alleges that "Fifth Third had a duty to exercise reasonable care in monitoring how BJ's processed transactions so as to ensure that BJ's complied with its duties to delete or erase Cardholder Information after a transaction had been approved and/or safeguard such information to prevent the unauthorized possession and/or misuse of the information" (id. ¶ 42), that it breached this duty by failing to adequately monitor BJ's (id. ¶¶ 43 and 44), and that as a result, the cardholder information was stolen, causing damage to Sovereign. (Id. ¶¶ 46 and 47.)

The next two counts are contract claims, count III against BJ's and count IV against Fifth Third. In count III, Sovereign alleges that it is a third-party beneficiary of BJ's merchant...