ORDER
Donald Asher’s personal secretary used her position to incur and conceal fraudulent charges on Asher’s credit card over the course of three years during which Asher paid his bills in full. When he discovered the fraud and asked for reimbursement from Chase Bank, which issued the credit card, Chase eventually refused after a lengthy investigation. Asher sued Chase approximately eighteen months after discovering the fraud and eight months after receiving final notice that Chase would not reimburse him. Asher claimed that the bank’s refusal to repay him violated the Truth in Lending Act and, as the district court understood his complaint, constituted a breach of his cardholder agreement with Chase. The district court granted summary judgment for Chase, reasoning that the federal statutory claim was barred by the relevant statute of limitations and the state-law contract claim lacked evidentiary support. Asher appeals. Although the district court’s statute-of-limitations analysis is questionable, we affirm the judgment because a jury could not reasonably find for Asher on either his federal or his state claim.
I. Background
For over twenty years, Asher employed Carol MacKenzie as a secretary for his [914]*914family and the family business. He gave her the responsibility of preparing his credit-card statements for his review, including the statements for a VISA card issued by Chase (the card initially was issued by another bank and through a succession of ownership changes, was reissued by Bank One and then by Chase). If MacKenzie possessed receipts for individual charges appearing on the statements, she was to attach them and draw a line through the corresponding entry on the statement so that Asher could focus his review on those charges MacKenzie had not substantiated. When she presented the statements to Asher, MacKenzie also prepared a check in the amount of the bill for Asher to sign or, more frequently, for his mother or brother to sign on his behalf. MacKenzie abused her position by using the Chase VISA account number to incur fraudulent charges and then crossing out those entries on the corresponding statements in hopes that Asher would not notice them. Specifically, MacKenzie had opened a sign-making business, A Sign of the Tymes, which she was running out of her house. She had entered into a merchant agreement with PMT/Imperial Bank that allowed her to accept credit cards in payment for her signs, and in 2001 she began posting fictitious charges from Tymes to Asher’s card as though he was buying signs from her company. She did not create receipts for these transactions, but Asher did not question her about them. Asher paid his bills in full and did not discover the charges until 2004, by which time MacKenzie had collected $77,655. The most recent charges were incurred just days before Asher discovered the fraud.
Asher got wind of MacKenzie’s fraud in March 2004 when Chase (at that time the card issuer was still Bank One, but for simplicity we use “Chase” throughout) notified him about “excessive charges” on his account. Asher then reviewed his prior statements and discovered the Tymes charges going back to 2001. He notified Chase about the fraudulent charges, and by letter dated March 8, 2004, Chase acknowledged his fraud claim. Asher fired MacKenzie on March 23.
The following month Chase notified Ash-er that it would not reimburse him because after investigating his fraud claim, the bank had concluded that he was liable for the Tymes charges. But when Asher protested, Chase continued to evaluate his claim and on September 15, 2004, requested that he provide another affidavit of fraud. Finally, in a letter dated October 15, 2004, but apparently postmarked January 28, 2005, Chase gave final notice that it considered Asher liable for the Tymes charges. Chase had previously credited Asher’s account $16,785 as partial reimbursement for the Tymes charges, so it rebilled those transactions on his statement for the period ending in February 2005, for which payment was due on March 14, 2005.
In September 2005 Asher filed suit in state court against Chase and MacKenzie, and the following month the bank removed the action to federal court. MacKenzie later pleaded guilty to state theft charges and was dropped from the lawsuit. In Count I of his complaint, Asher claimed that by refusing to reimburse him, Chase had violated the Truth in Lending Act (“TILA”), 15 U.S.C. §§ 1601-1667Í, which provides in relevant part that “a cardholder incurs no liability from the unauthorized use of a credit card” beyond at most $50. Id. § 1643. In Count II of his complaint, Asher alleged that Chase had “contracted and agreed with Plaintiff that it would only pay and allow payments on charges and applications for reimbursement in accord with the authority set forth in the credit card agreements.” He claimed that the bank had “breached its duty to the Plain[915]*915tiff’ by allowing his VISA account to be charged for forged applications for payment, and by failing “to determine the authority by which fraudulent charges and applications for payments were allowed to be made.”
In October 2007 Chase moved for summary judgment. The bank, however, ignored Count II of Asher’s complaint and addressed its motion solely to his TILA claim. As to that claim, Chase first asserted that it was untimely under 15 U.S.C. § 1640(e), which provides that a civil action alleging a violation of TILA must be brought “within one year from the date of the occurrence of the violation.” The “occurrence of the violation,” Chase argued, is the date on which a card issuer “consummates” an allegedly unauthorized charge by posting it to the cardholder’s account. It follows, Chase reasoned, that Asher’s claim was too late because all of the Tymes charges were processed more than a year before he filed suit. Alternatively, Chase argued that Asher’s claim would fail on the merits because according to the bank, the charges made by MacKenzie were not “unauthorized.” For purposes of § 1643, TILA defines “unauthorized use” of a credit card as use “by a person other than the cardholder who does not have actual, implied, or apparent authority for such use and from which the cardholder receives no benefit.” 15 U.S.C. § 1602(o). The use of Asher’s account by MacKenzie, the bank asserted, was not “unauthorized” because Asher’s repeated payments of her transactions evidenced her apparent authority to charge purchases to the account.
The district court agreed with Chase’s statute-of-limitations argument and did not discuss the merits. The court reasoned, without citing authority, that the limitations period for the § 1643 claim began to run at the time of the transactions or, at the latest, when Asher discovered the fraudulent Tymes charges in March 2004. Either way, the court continued, Asher’s claim under TILA was untimely because he did not file suit until September 2005. In reaching this conclusion, the court apparently overlooked Asher’s contention that his claim under § 1643 did not even accrue until early 2005 when Chase definitively rejected his claim for reimbursement. And although its reasoning is difficult to discern, the court also rejected Asher’s contention that principles of equitable tolling or equitable estoppel rendered his TILA claim timely.
As for Count II of the complaint, however, the district court noted that Chase had said nothing about it in its motion for summary judgment. Chase then moved for summary judgment on Count II, which it characterized as a claim for breach of the cardholder agreement between Chase and Asher. Asher asked for and received more time to respond, but he did not assert by affidavit, see Fed. R. Civ. P. 56(f), that he needed additional discovery. He then responded to Chase’s motion and filed his own cross-motion for summary judgment, arguing in both submissions that Chase had breached not only the cardholder agreement (which according to Asher the bank had refused to produce) but also agreements between VISA and the bank that, in Asher’s view, gave him rights as a third-party beneficiary. The district court once again granted summary judgment for Chase, explaining that Asher could not prove a breach of contract because he “concedes” that he “failed to provide copies of any agreement or other record to support the alleged contract.” The court did not specifically mention Asher’s theory that he was a third-party beneficiary of agreements between VISA and Chase.
II. Discussion
A. TILA Statute of Limitations
Asher argues that the district court improperly granted summary judgment on [916]*916his TILA claim because, he contends, the court erred in determining when the claim accrued and should have applied tolling doctrines. The district court proposed two possible accrual dates — the time of the transactions or when Asher discovered them — but concluded that both were outside the limitations period. The court also rejected Asher’s tolling theories.
Although the Truth in Lending Act does not state explicitly that a cardholder can bring a suit claiming a violation of 15 U.S.C. § 1643, the majority of other circuit and district courts faced with such a claim have assumed, on similar facts, the existence of a cardholder claim under § 1643. See DBI Architects, P.C. v. Am. Express Travel-Related Servs. Co., 388 F.3d 886, 892-93 (D.C.Cir.2004) (implicitly recognizing § 1643 claim by cardholder); Minskoff v. Am. Express Travel Related Servs. Co., 98 F.3d 703, 708-10 (2d Cir.1996) (same); Draiman v. Am. Express Travel Related Servs. Co., 892 F.Supp. 1096, 1098-1100 (N.D.Ill.1995) (same); see also Permobil, Inc. v. Am. Express Travel Related Servs. Co., 571 F.Supp.2d 825, 830-36 (M.D.Tenn. 2008); Carrier v. Citibank (S.D.) N.A., 383 F.Supp.2d 334, 338-41 (D.Conn.2005), aff'd, 180 Fed.Appx. 296 (2d Cir.2006). But see Sovereign Bank v. BJ’s Wholesale Club, Inc., 533 F.3d 162, 174-75 (3d Cir.2008) (concluding, without discussing other authority, that card issuer’s claim of indemnification against merchant and acquirer failed because § 1643 does not impose duty on card issuer to reimburse cardholder for unauthorized charges). Like Chase and the majority of these courts, we also assume that a cardholder can bring a claim under § 1643. And like all TILA claims, a claim under § 1643 is subject to a one-year statute of limitations. See 15 U.S.C. § 1640(e) (“Any action under this section may be brought in any United States district court, or in any other court of competent jurisdiction, within one year from the date of the occurrence of the violation.”); Draiman, 892 F.Supp. at 1098 (applying one-year limitations period to § 1643 claim).
Unless Congress has provided otherwise, a claim arising under federal law accrues when the plaintiff has discovered or reasonably should have discovered the injury. In re Copper Antitrust Lit., 436 F.3d 782, 789 (7th Cir.2006); Coda v. Baxter Healthcare Corp., 920 F.2d 446, 450 (7th Cir.1990). In his brief in this court, Asher contends that he discovered his injury in March 2004 when he first learned of the fraudulent charges, but as the district court noted, that was still more than a year before he filed suit in September 2005. Asher had argued in opposing summary judgment that his claim under § 1643 accrued in March 2005 when the fraudulent charges that Chase rebilled to his account became due, which was six months before he filed suit. But Chase has taken him at his word that he now intends 2004, and he did not assert in his reply brief or at argument that he made a mistake.
Asher then seems to concede that his TILA claim accrued in March 2004 when he discovered MacKenzie’s fraud, and for the moment we also will assume that the statute of limitations started to run at that point. Because Asher did not file suit until more than a year later, though, he is left to argue that the statute of limitations was tolled,1 either by equitable tolling or [917]*917equitable estoppel (he conflates the two doctrines), until Chase told him once and for all that it would not reimburse him for the fraudulent charges. Asher contends that Chase deceived him by saying it was investigating his claim when in fact it was not. There is no evidence, says Asher, that Chase actually undertook an investigation complying with 12 C.F.R. § 226.13(e), a regulation concerning billing errors by creditors that is one of a group of regulations (known collectively as “Regulation Z”) issued by the Federal Reserve Board in carrying out its mandate to enforce TILA. See 12 C.F.R. § 226.1-.36. It follows, says Asher, that a genuine issue of material fact still remains concerning whether the limitations period was tolled. MacKenzie’s final fraudulent transaction was made only a few days before Asher discovered her scheme, so regardless which accrual date is correct, some portion of Asher’s claim under § 1643 would be timely if, as he contends, the limitations period was tolled while Chase was purportedly investigating.
Asher’s discussion of tolling, both in the district court and here, is convoluted, and it is understandable if the district court had trouble following his reasoning. Equitable estoppel, a subset of which is fraudulent concealment, applies when the plaintiff shows that the defendant misled him or took active steps to prevent him from filing suit before the statutory period expired. Smith v. Potter, 445 F.3d 1000, 1010 (7th Cir.2006); In re Copper Antitrust Lit., 436 F.3d at 790-91; Cada, 920 F.2d at 450-51. Equitable tolling, by contrast, applies when the plaintiff, though diligent, could not have obtained the information necessary to file a claim before the end of the limitations period. Lewis v. City of Chicago, 528 F.3d 488, 493 (7th Cir.2008); Cada, 920 F.2d at 451. The latter doctrine does not require fault on the part of the defendant, but it is used sparingly and only when the plaintiff shows extraordinary circumstances. Bensman v. U.S. Forest Serv., 408 F.3d 945, 964 (7th Cir.2005); Modrowski v. Mote, 322 F.3d 965, 967 (7th Cir.2003). The plaintiff bears the burden of proving his entitlement to either doctrine. See Hamilton v. Komatsu Dresser Indus., Inc., 964 F.2d 600, 606 (7th Cir. 1992); Stark v. Dynascan Corp., 902 F.2d 549, 551 (7th Cir.1990).
Neither doctrine quite fits here. With regard to equitable estoppel, Asher has the burden backwards; At summary judgment Chase had no obligation to establish the propriety of its investigation of Asher’s fraud claim. Asher did not produce concrete evidence that Chase had misled him or actively sought to prevent him from suing in time. Asher has a better argument for equitable tolling, but it is still a rough fit. Equitable tolling usually demands “extraordinary circumstances,” and here the lengthy period it took Chase to resolve a $77,655 claim of three years’ worth of fraudulent charges does not seem altogether extraordinary. Besides, the ongoing investigation did not prevent Asher from going ahead with his lawsuit even before he received a definitive answer from Chase.
But was he required to do that? A rule that would compel the cardholder to sue while the card issuer is still investigating a claim could lead to wasteful litigation; had Chase resolved Asher’s claim in his favor, there would have been no reason to sue. [918]*918Chase, after all, did not defraud Asher, MacKenzie did, and it is difficult to see how Chase wronged Asher by investigating whether the disputed charges were in fact unauthorized. Chase has taken the position that a card issuer violates § 1643 when it posts allegedly unauthorized charges. Logically, though, it would seem that the card issuer violates § 1643 not when it initially posts a transaction that it has no reason to believe is unauthorized, but instead when it rejects the cardholder’s fraud claim and insists that the cardholder is liable. Asher comes close to realizing this point when he asserts, albeit in his discussion of tolling rather than accrual, that “Chase made a conclusive decision in January, 2005 — effective in February, 2005 — that caused the accrual of the time for prosecuting a claim under TILA.”
We have not found a published appellate decision, in this or any circuit, that addresses when a claim under § 1643 accrues. Section 1643 limits a cardholder’s liability for “unauthorized use” of the cardholder’s credit card. Unauthorized use is defined as use “by a person other than the cardholder who does not have actual, implied, or apparent authority for such use and from which the cardholder receives no benefit.” 15 U.S.C. § 1602(o). The TILA statute of limitations begins to run when a “violation” of TILA occurs, see 15 U.S.C. § 1640(e), but neither § 1640 nor § 1643 identify which date that is or what action constitutes the “violation” of § 1643. Cf. Nash v. First Fin. Sav. & Loan Ass’n, 703 F.2d 233, 237-39 (7th Cir.1983) (analyzing when “violation” occurred under another provision of TILA to determine when statute accrued).
Neither Asher, nor Chase, nor the district court has articulated a persuasive theory about when a violation of § 1643 occurs. Asher, who does not maintain a consistent position about the date of accrual, goes so far as to suggest that the statute of limitations never began to run because the charges were fraudulent and so he was never contractually obligated to pay them. As the district court observed, if this reading was correct, then § 1643 would be superfluous: Cardholders would not need the protections provided in § 1643 because they would never be obligated to pay unauthorized charges. Chase barely addresses the question of accrual in its brief here, but asserts in a footnote that a violation occurs on the date the credit transaction “is consummated and the consumer becomes contractually obligated.” Chase does not elaborate on this sentence and as authority cites only an unpublished decision from the Northern District of Illinois, see Durham v. Loan Store, Inc., No. 04 C 6627, 2006 WL 3422183, at *4 (N.D.Ill. Nov. 27, 2006) (unpublished), and the Regulation Z definition of “consummation,” see 12 C.F.R. § 226.2(a)(13). The district court suggested that violations of § 1643 occur “at the time of the transactions” or perhaps when the cardholder discovers them.
This existing case law is unpersuasive because a conclusion that § 1643 is violated when a sale transaction is “consummated” is inconsistent with TILA’s statutory scheme, the Federal Reserve Board’s interpretation of its Regulation Z, and the text of § 1643. The Sixth Circuit, in an unpublished and nonprecedential decision, and the Northern District of Illinois have both concluded, without much explanation, that a violation of § 1643 occurs when the unauthorized charge is made or posted. Borg v. Chase Manhattan Bank USA, 247 Fed.Appx. 627, 635 (6th Cir.2007) (unpublished); Draiman, 892 F.Supp. at 1098. The case Chase cites for the proposition that a violation occurs when the transaction is consummated does not involve an action under § 1643 but rather the disclosures required for a mortgage loan. Dur[919]*919ham, 2006 WL 3422183. Durham states that “[a] violation occurs when the credit transaction is consummated” and concludes that the transaction was consummated at the plaintiffs first closing on the loan. Id. at *4. The Durham court did not provide a citation for this proposition, perhaps because it is so well established in the context of loan contracts. See Nash, 703 F.2d at 238. Tracing it back through the caselaw, however, the proposition stems from a provision in Regulation Z, Subpart C, on “closed-ended credit,” and within the section addressing when a creditor must make disclosures required by TILA: “The creditor shall make disclosures before consummation of the transaction.” 12 C.F.R. § 226.17(b).
But a creditor does not violate § 1643 by failing to make required disclosures, so a provision governing when they must be made is inapplicable. Indeed, the Federal Reserve Board specifically provides in its commentary to the definition of “consummation,” 12 C.F.R. § 226.2(a)(13), that the term does not apply to “sales”: “[Consummation does not occur when the consumer becomes contractually committed to a sale transaction, unless the consumer also becomes legally obligated to accept a particular credit arrangement.” Federal Reserve Board Truth in Lending Official Staff Commentary to Regulation Z, 12 C.F.R. pt. 226, Supp. I § 226.2(a)(13)(2) (distinguishing consummation of credit versus sale transaction); see Anderson Bros. Ford v. Valencia, 452 U.S. 205, 219, 101 S.Ct. 2266, 68 L.Ed.2d 783 (1981) (directing courts to defer to Board’s regulations implementing TILA legislation and to its interpretation of those regulations). Moreover, § 1643 is within Subpart B of Regulation Z, which governs “open-ended credit,” and has a separate set of rules from those in Subpart C governing “closed-ended credit” (and an entirely different disclosure provision, though neither disclosure provision applies here). See 12 C.F.R. § 226.12(b) (concerning “Special Credit Card Provisions” corresponding to the text of § 1643 and located within Sub-part B of Regulation Z); see also 12 C.F.R. pt. 226, Table of Contents.
Finally, a conclusion that § 1643 is violated when the card is used or the transaction is posted is inconsistent with the text of § 1643. That section provides that a cardholder is liable for “unauthorized use” of the card only in specific circumstances. It seems a stretch to conclude that a card issuer violates the statute even before the cardholder has claimed that a particular use was unauthorized, much less before that claim has been investigated and rejected. It is more logical to conclude that a violation occurs when the card issuer notifies the cardholder that despite the cardholder’s claim of fraud, the card issuer will not reimburse the cardholder for the disputed amount. Here, the violation occurred and the limitations period commenced when Chase notified Asher that it deemed him liable — -for the final time, in January 2005. Asher’s suit in September 2005 therefore is not time-barred.
B. Merits of the TILA Claim
We can affirm the grant of summary judgment on any basis that Chase asserted previously, see Wis. Cent., Ltd. v. Shannon, 539 F.3d 751, 761 (7th Cir.2008), and in this court Chase reasserts its contention that MacKenzie possessed apparent authority to incur the Tymes charges. We agree, and for that reason the charges were not “unauthorized.”
Chase argues that MacKenzie’s charges to Asher’s card, although fraudulent, were not “unauthorized” within the meaning of § 1643 and § 1602(o) because MacKenzie had apparent authority to use the account. See DBI Architects, 388 F.3d 886. Section 1602(o) defines “unauthorized use” as use “by a person other than the cardholder [920]*920who does not have actual, implied, or apparent authority for such use.” Courts have concluded that Congress intended agency law to govern whether use by someone other than the cardholder was authorized, DBI Architects, 388 F.3d at 890; Towers World Airways Inc. v. PHH Aviation Sys. Inc., 933 F.2d 174, 176-77 (2d Cir.1991), and in its commentary to Regulation Z, the Federal Reserve Board has made explicit that “whether authority exists must be determined under state or other applicable law,” Federal Reserve Board Truth in Lending Official Staff Commentary to Regulation Z, 12 C.F.R. pt. 226, Supp. I § 226.12(b)(1). Illinois law and federal common law are in accord with the Restatement (Second) of Agency on the issue of apparent authority. Opp v. Wheaton Van Lines, Inc., 231 F.3d 1060, 1064 (7th Cir.2000). Apparent authority arises when the principal’s words or conduct cause a third person to reasonably believe that the putative agent’s conduct on the principal’s behalf is authorized. See Moriarty v. Glueckert Funeral Home, Ltd., 155 F.3d 859, 866 & n. 15 (7th Cir.1998); York v. Rush-Presbyterian-St. Luke’s Med. Ctr., 222 Ill.2d 147, 305 Ill. Dec. 43, 854 N.E.2d 635, 655-60 (Ill.2006); Restatement 2d of Agency §§ 8, 27 (1958); see also Restatement 3d of Agency § 2.03 (2006). The principal may not then deny the agent’s authority to a third party who has relied upon it. See Minskoff, 98 F.3d at 708; Harrison v. Dean Witter Reynolds, Inc., 974 F.2d 873, 883-84 (7th Cir.1992) (applying Illinois agency law); York, 305 Ill.Dec. 43, 854 N.E.2d at 655-60; State Sec. Ins. Co. v. Burgos, 145 Ill.2d 423, 164 Ill.Dec. 631, 583 N.E.2d 547, 551 (1991); Restatement 2d of Agency § 8B, 8 cmt. d; see also Restatement 3d of Agency § 2.03.
Chase explains that in DBI Architects the court held that the company clothed its employee with apparent authority to use its AMEX account, despite the fact that the employee added herself as a cardholder without the management’s knowledge or approval, because for ten months the company paid without protest all of the employee’s fraudulent charges after receiving statements that identified the employee as a cardholder and itemized her charges. 388 F.3d at 888, 893-94. The court declined to hold that the plaintiff created apparent authority in the employee solely by failing to review the account statements, id. at 891-93, as the Second Circuit had held in Minskoff, 98 F.3d 703, although this is a rather fine distinction. The court reasoned that the Federal Reserve Board’s official staff interpretation of 12 C.F.R. § 226.12(b)(3) supports the conclusion that a consumer could still be entitled to protection under § 1643 even if the consumer did not exercise his right to protest an inaccurate billing statement under the Fair Credit Billing Act, see 15 U.S.C. § 1666, and that failing to contest charges would not create apparent authority. DBI Architects, 388 F.3d at 892-93. On the other hand, the court continued, the company’s repeated payment of its employee’s fraudulent charges led the card issuer to reasonably believe that she had the authority to make charges on the account. Id. at 893-94. The court concluded that this result would obtain under both D.C. agency law and the federal common law because they were the same. Id. at 890.
Asher offers no meaningful response to this argument; in his briefs he does not even discuss DBI Architects. The situation discussed in that decision, as well as in the case it draws support from, Minskoff, 98 F.3d 703, is similar to what happened here. Both of those decisions involved a corporate cardholder that over a period spanning many months paid its bills without protest even though those bills included charges made by an employee who did not have the company’s approval to use the account. DBI Architects, 388 F.3d at 888; [921]*921Minskoff, 98 F.3d at 706-07. If anything, Chase has a stronger argument for apparent authority because in DBI Architects and Minskojf the employees who made the fraudulent charges were the same ones paying the bills on behalf of the cardholders, whereas in this case Asher or his brother or mother were at least signing off on the checks to Chase. Asher paid his bills in full, including the Tymes charges, for three years without protest. This scenario makes a compelling case for concluding that MacKenzie had apparent authority to make charges on Asher’s account. And while in DBI Architects the court remanded for further proceedings concerning the point at which the employee’s apparent authority arose, 388 F.3d at 894, Asher makes no argument that a similar determination is necessary in this case.
C. State-law Contract Claim
Finally, Asher contends that the district court improperly granted Chase’s .motion for summary judgment on his state-law contract claim and instead should have granted his cross-motion for summary judgment. The district court apparently understood Asher to be claiming only that Chase breached its cardholder agreement with Asher, and on that theory the court held that Chase was entitled to summary judgment because Asher had not even produced the cardholder agreement and thus could not point to any provision that was breached. The court’s conclusion is unassailable to the extent that Asher’s contract theory concerns his cardholder agreement with Chase, and Asher does not even attempt to undermine the court’s reasoning.
Instead, Asher focuses on his theory that he was a third-party beneficiary to contracts between Chase and VISA, and between Mackenzie and PMT/Imperial, her acquiring bank for credit-card transactions at A Sign of the Tymes. Those contracts were produced at summary judgment, but the district court did not address this theory of purported liability. As between Chase and VISA, Asher seems to argue that Chase was obligated by its agreement with VISA to determine whether there were signed receipts for the disputed charges, that Chase did not adequately investigate his claim of fraud, and that Chase should have charged the Tymes transactions back to PMT/Imperial. As far as MacKenzie’s contract with PMT/Imperial, however, it is not clear how Asher thinks that he has rights under that contract.
Asher failed to produce any evidence at summary judgment that could establish he is a third-party beneficiary of any of these contracts. Asher sought to link himself to Chase’s agreement with VISA by pointing in his statement of material facts to a provision defining the process of “issuing cards” to include entering “direct contractual relationships as the principal party with holders of cards.” That provision does not suffice to show that the parties entered the VISA agreement for the benefit of individual cardholders, and it does not overcome the strong presumption in Illinois law (which the parties agree applies here) against recognizing third-party beneficiaries. See Estate of Willis v. Kiferbaum Constr. Corp., 357 Ill.App.3d 1002, 294 Ill.Dec. 224, 830 N.E.2d 636, 643 (2005). On this record, Asher’s theory of contract liability is meritless.
Accordingly, we AFFIRM the grant of summary judgment for Chase on the TILA claim but on the alternate ground that MacKenzie’s use of Asher’s credit card was not “unauthorized” because she had apparent authority. We also AFFIRM the grant of summary judgment for Chase on Asher’s state-law contract claim.