Cumis Insurance Society v. BJ's Wholesale Club

24 Mass. L. Rptr. 117

• Court: Massachusetts Superior Court
• Decided: June 4, 2008
• Docket: No. 20051158J
• Status: Published

Opinion

Fremont-Smith, Thayer, J.

INTRODUCTION

The plaintiffs, CUMIS Insurance Society, Inc. (“CUMIS”) and one hundred seven separate credit unions (the “credit unions”) seek damages against the defendants, BJ’s Wholesale Club, Inc. (“BJ’s”) and Fifth Third Bank Corp. (“Fifth Third”), for fraud, negligent misrepresentation, violations of G.L.c. 93A, equitable indemnification and subrogation.³ The claims arise from an alleged security breach in which unauthorized third parties obtained information and made fraudulent purchases from Visa, U.S.A., Inc. (“Visa”) and MasterCard International (“MasterCard”) debit and credit cards which had been issued by the credit unions and used by customers at BJ’s prior to February 2004. CUMIS reimbursed the credit unions for significant financial loses they incurred as a result of the fraudulent use of counterfeit debit and credit cards. The plaintiffs bring this suit against BJ’s and Fifth Third alleging that they wrongfully retained credit card information which had been gleaned from the magnetic stripes on Visa and MasterCard debit and credit cards used at BJ’s⁴ resulting in the theft of BJ’s customers’ credit information and the creation of fraudulent credit cards.

This matter is before the Court on three separate motions for summary judgment. The plaintiffs’ have filed a motion for partial summary judgment as to misrepresentation. The defendants BJ’s and Fifth Third Bank have each filed a motion for summary judgment on all of the plaintiffs’ remaining claims against BJ’s; i.e., fraud, negligent misrepresentation and violations of G.L.c. 93A, and pursuant to the November 5, 2007 Stipulation and Order, request that the Court dismiss the plaintiffs’ follow-on claims for equitable indemnification and subrogation.

BACKGROUND

The undisputed material facts as established by the pleadings and as correctly recited in Judge Quinlan’s Memorandum of Decision and Order on the defendants’ Motion to Dismiss [23 Mass. L. Rptr. 550], are as follows. The plaintiff credit unions each issued Visa and/or MasterCard credit cards⁵ to their credit union members who used them inter alia for purchases at BJ’s. CUMIS insured the credit unions for losses resulting therefrom, and reimbursed them for fraudulent credit card charges. Fifth Third processed the Visa and MasterCard credit card transactions.⁶

Both Visa and MasterCard have operating regulations that govern the conduct of acquiring banks and merchants such as BJ’s, with which defendants agreed to comply. These operating regulations forbade defendants, subsequent to completing a sale transaction, from retaining or storing cardholder account numbers’ personal information, Visa and MasterCard magnetic stripe information and/or Visa and MasterCard transaction information, and from disclosing such information to any third party. The obligations imposed upon BJ’s and Fifth Third were reduced to contracts whereby each defendant agreed to comply with these requirements.

In violation of the operating regulations and Fifth Third’s and BJ’s obligations under the regulations, BJ’s and Fifth Third retained and stored such Visa and MasterCard debit and credit card magnetic stripe information after completion of authorized transactions. In February 2004, it was discovered that unauthorized persons had gained access to the Visa and MasterCard account data stored by the defendants, enabling such persons to use the information from the magnetic stripe to create counterfeit Visa and MasterCard credit cards for fraudulent purchases.

The plaintiffs allege that Visa and MasterCard had previously informed acquiring banks, including Fifth Third, that merchants such as BJ’s were storing and retaining magnetic stripe information in violation of the regulations, so that Fifth Third should have taken steps to ensure that BJ’s was in compliance with the operating regulations.

DISCUSSION

Legal Standard

Summary judgment shall be granted where there are no genuine issues of any material fact and where the moving party is entitled to judgment as a matter of law. Mass.R.Civ.P. 56(c); Cassesso v. Commissioner of Correction, 390 Mass. 419, 422 (1983); Community Nat’l Bank v. Dawes, 369 Mass. 550, 553 (1976). The moving party bears the burden of demonstrating the absence of a triable issue, and that the summary judgment record entitles the moving party to judgment as a matter of law. Pederson v. Time, Inc., 404 Mass. 14, 16-17 (1989). The moving party may satisfy this burden either by submitting affirmative evidence that negates an essential element of the opposing party’s case or by demonstrating that the opposing party has no reasonable expectation of proving an essential element of his case at trial. Flesner v. Technical Communications Corp., 410 Mass. 805, 809 (1991); Kourouvacilis v. General Motors Corp., 410 Mass. 706, 716 (1991).

Summary Judgment Analysis

Plaintiffs move for partial summary judgment as to whether BJ’s and Fifth Third made any representations that would support plaintiffs’ claims for misrepresentation, unfair trade practices, and their remaining claims. Defendants move for summary judgment on all of the plaintiffs’ remaining claims, including whether public notices that merchants were storing magnetic stripe information precludes the plaintiffs from establishing justifiable reliance on representations made by defendants.⁷ Plaintiffs’ fraud and negligent misrepresentation claims hinge upon whether Fifth Third’s and BJ’s participation in the Visa and MasterCard system are sufficient to constitute representations so as to support this claim. Likewise, plaintiffs’ G.L.c. 93A, indemnification and subrogation claims all depend upon actionable wrongdoing on the part of BJ’s and Fifth Third and are therefore depen-dant on the same facts.

Plaintiffs originally contended that they are entitled to recover because: (1) they were third-party beneficiaries to the agreements between BJ’s and Fifth Third and Visa and MasterCard; (2) they suffered damages as a result of BJ’s and Fifth Third’s negligent failure to adhere to their contractual obligations; (3) the defendant’s failure to adhere to their contractual obligations amounted to misrepresentation and violation of G.L.c. 93A; and (4) they are entitled to recovery on equitable indemnification and subrogation.

With respect to plaintiffs’ contention that they are entitled to sue as a result of defendants’ breach of the credit card regulations and of their contracts to abide by same, Judge Quinlan, by her Order on defendant’s motions to dismiss dated December 1, 2005, found that plaintiffs were not “intended third-pariy beneficiaries” of these contracts in light, inter alia, of the fact that the contracts specifically disavowed any such intention.⁸ A similar result was recently reached in the only other court to consider the issue, in Sovereign Bank v. BJ’s Wholesale Club, Inc., WL 1722398 (M.D.Pa. 2006). There, even though a Visa representative (La Paglia) had testified in deposition that the regulations were intended to benefit all participants in the system, including issuing banks, the Court found, as did Judge Quinlan, that:

In the face of this evidence of Visa’s intent, we do not believe that the single August 1993 reference to benefitting issuers nor the ambiguous “core purpose” statement is sufficient evidence to lead a reasonable jury to find for plaintiff on the contract claim.

Both judges concluded that, in light of all the evidence, the credit card regulations were primarily intended to protect the credit card system, and that the acquiring banks were, at most, “incidental” rather than “intended” beneficiaries under the controlling law.⁹

With respect to plaintiffs’ second contention that they have a cause of action for negligent performance of a contract as a result of defendants’ negligent failure to adhere to their credit card contracts resulting in foreseeable injury to the plaintiffs, see: Banaghan v. Dewey, 340 Mass. 73, 80 (1959), Judge Quinlan dismissed plaintiffs’ negligence claim on the ground that it was barred by the “economic loss doctrine,” citing Aldrich v. ADD, Inc., 437 Mass. 213, 222 (2002); FMR Corp. v. Boston Edison Co., 415 Mass. 393, 395 (1993); Garweth Corp. v. Boston Edison Co., 415 Mass. 303, 305 (1993); and Bay State-Spray & Provincetown S.S., Inc. v. Caterpillar Tractor Co., 404 Mass. 103, 107 (1989).

Judge Quinlan, however, denied defendants’ motions to dismiss the plaintiffs’ fraud, negligent misrepresentation and c. 93A claims, ruling that the complaint stated a cause of action in those regards, in part because the economic loss doctrine is inapplicable to an action for negligent misrepresentation. See Nota Construction Corp. v. Keyes Assoc., 45 Mass.App.Ct. 15, 20 (1998), citing Craig v. Everett M. Brooks Co., 351 Mass. 497, 499-501 (1967); Nycal Corp. v. KPMG Peat Marwick, LLP, 426 Mass. 491, 495-96 (1998); Golber v. Baybank Valley Trust Co., 46 Mass.App.Ct. 256, 257 (1999). These claims are the subject of the present motions.

The plaintiffs claim that the defendants’ negligent failure to comply with the Visa and MasterCard regulations constituted negligent misrepresentation.

Unlike intentional misrepresentation, negligent misrepresentation does not require a showing that the defendant ever knew that the statements made were false or that the defendant actually intended to deceive the plaintiff. Kitner v. CTW Transport, Inc., 53 Mass.App.Ct. 741, 749 (2002). In order to recover for negligent misrepresentation a plaintiff need only prove that the defendant, in the course of his business, negligently supplied false information for the guidance of others in their business transactions resulting in pecuniary loss to others who had reasonably relied thereon. Nota Construction Corp. v. Keyes Assoc., Inc., 45 Mass.App.Ct. 15, 20 (1998); Fox v. F&J Gattozzi Corp., 41 Mass.App.Ct. 581, 587-88 (1996); see Restatement (Second) of Torts §552 (1977).

There is no evidence, however, that either Fifth Third or BJ’s made any direct representations, negligent or otherwise, to the plaintiffs or supplied them with false information to induce them to issue Visa or MasterCards or to continue to participate in the credit card system. It is admitted by plaintiffs that neither Fifth Third nor BJ’s had any direct agreements, contacts, communications or interactions with the plaintiffs. Instead, plaintiffs claims are based on their alleged reliance on the defendants’ contracts with one another and with Visa and MasterCard.

However, defendants’ separate and individual membership agreements with each other and with Visa and MasterCard cannot be viewed as constituting representations to third-party plaintiffs, except in the particular circumstances where a professional has rendered services under a contract to another which the professional knows is to be relied upon by a third party. Nycal v. KPMG Peat Marwick, LLP, 426 Mass. 491, 495-96 (1996), citing Craig v. Everett M. Brook Co., 351 Mass. 497 (1967). This so-called “Craig principle of foreseeable reliance,” is “limited to situations where the defendant knew that a particular plaintiff would rely on the defendant’s services.” Id. at 495.

Nor, even if defendants’ contractual obligations to others could be considered misrepresentations made to the plaintiffs, is there any evidence presented upon which a juiy could find that plaintiffs reasonably relied to their detriment on the defendants’ contract obligations. The exception to the economic loss doctrine that permits negligent misrepresentation claims for purely economic recovery applies only where the plaintiff reasonably and foreseeably relied on the defendant’s promise to someone other than the plaintiff. Craig v. Everett M. Brooks Co., 351 Mass. 497, 501 (1967); Vitetta Group v. Town of Plymouth, 1996 U.S.Dist.LEXIS 5639 (D.Mass. March 21, 1996) (Wolf, D.J.). Plaintiffs here could not have reasonably relied on the defendants’ contractual obligations as to which they were not third-party beneficiaries, as plaintiffs had been notified several times before the fraud was discovered that a number of merchants and acquiring banks were probably storing confidential data in violation of their contracts, but did not alter their business dealings or their participation in the credit card system.¹⁰ In fact, the regulations upon which plaintiffs claim to have relied, themselves indicate that the system is not guaranteed to be fool-proof, as they provide for an elaborate dispute resolution procedure and for fines for non-compliance.¹¹ The record, moreover, is devoid of a single affidavit from any of the plaintiffs or from any expert that, but for defendants’ dereliction in adhering to their contracts, plaintiffs would have acted any differently. Nor is there any evidence that plaintiffs did alter their participation after being notified of the fraudulent transactions which were discovered in 2004. In fact, at the hearing, plaintiffs admitted that they continue to reasonably rely on the system because it is 99.94% effective.¹² Plaintiffs, then reasonably relied upon the over-all reliability of the system, rather than on its being totally fool-proof. The very fact that plaintiffs sought and received insurance coverage for such losses indicates that they anticipated and assumed such risk when participating in the system.

The Court therefore concludes that plaintiffs have no reasonable expectation of successfully establishing their misrepresentation claims, or their derivative c. 93A, subrogation and indemnification claims, at trial.

ORDER

For the foregoing reasons and those stated in defendants’ briefs in support and by defendants’ counsel at the hearing, it is ORDERED that the defendants’ motions for summary judgment are ALLOWED and that the plaintiffs’ motion for partial summary judgment is DENIED.

3 The plaintiffs’ additional counts for breach of contract and negligence were dismissed by the Court on December 1, 2005 (Quinlan, J.) [23 Mass. L. Rptr. 550].

4 BJ’s and Fifth Third Bank (which processed the credit card transactions) had each contracted with Visa and MasterCard not to retain such confidential credit card information after completion of a credit card transaction.

5 Typical participants in the Visa and MasterCard payment systems are issuing banks, acquiring banks, merchants, and cardholders.

6 Merchant banks which process the credit card transactions are called “acquiring banks.”

7 Plaintiffs do not move for summaiy judgment on this issue because they believe this to be an issue of material fact for the jury. However, if “the undisputed facts are so clear as to permit only one conclusion” these claims need not go to the jury. Nota Construction Corp. v. Keyes Assoc., Inc., 45 Mass.App.Ct. 15, 20 (1998).

8 In BJ’s and Fifth Third’s Merchant Agreement the parties explicitly state: ‘This agreement is for the benefit of, and may be enforced only by, Bank and Merchant and their respective successors and permitted transferees and assignees, and is not for the benefit of, and may not be enforced by, any third party.” Moreover, in the regulations the credit card companies also reserved to themselves the “sole and exclusive right to ‘interpret and enforce the regulations.’ ”

9 Representatives of both Visa and MasterCard stated at depositions that the primary purpose of the regulations is to protect the integrity of the payment system as a whole. Although they admitted that the issuing banks (such as plaintiffs) and acquiring banks (such as Fifth Third) are part of the over-all system intended to be benefitted, the Court does not consider these statements to be sufficient to alter the conclusion of Judge Quinlan and of the Pennsylvania court, which had some but not all of this evidence, that plaintiffs are merely incidental, rather than intended, beneficiaries of the contracts and of the embodied credit card regulations. Judge Quinlan’s decision, moreover, was issued on December 1, 2005, and was never made the object of a motion for reconsideration.

10 On May 20, 2003 Visa posted an Online article entitled “Issuers and Acquirers Are at Risk When Magnetic-Stripe Data is Stored.” Similarly, MasterCard issued a number of Security Alerts, warning of account data security compromises, dated April 8, 2003, September 30, 2003, and April 16, 2004.

11 Many issuing banks, other than the plaintiffs, did avail themselves of this procedure and recovered a substantial part of their losses from the credit card companies which, in turn, levied substantial fines against the defendants.

12 “99.94 of every hundred dollars is a valid transaction, [so] we clearly can rely upon the system.” Hearing, Tr. 27. “This has been a system that works. My clients rely on that.” Tr. 26.