BANKNORTH, NA v. BJ's Wholesale Club, Inc., 442 F. Supp. 2d 206 (M.D. Pa. 2006)

*207 Devin J. Chwastyk, Donald B. Kaufman, McNees Wallace & Nurick LLC, Harrisburg, PA, for Plaintiff.

Christopher A. Lewis, Richard L. Kremnick, Blank Rome Comisky & McCauley LLP, Philadelphia, PA, Andrew L. Swope, Kirkpatrick & Lockhart LLP, Harrisburg, PA, Christopher C. Taintor, Mark G. Lavoie, Norman, Hanson & Detroy, Portland, ME, Elizabeth E.W. Weinewuth, William Breck Weigel, Vorys, Sater, Seymour & Pease LLP, Cincinnati, OH, for Defendants.

Jennifer L. Carpenter, Wilmer Cutler Pickering Hale and Dorr LLP, Boston, MA, Mark L. Rhoades, Blank Rome LLP, Philadelphia, PA, for Defendants/Third Party Plaintiff.

Robert N. Feltoon, Conrad, O'Brien, Gellman & Rohn, PC, Philadelphia, PA, for Third Party Defendant.

CALDWELL, District Judge.

I. Introduction.

Plaintiff, Banknorth, N.A., filed this lawsuit against defendants, BJ's Wholesale Club, Inc., and Fifth Third Bank, after third parties allegedly hacked into a computer file maintained by BJ's and obtained Visa debit-card numbers of Banknorth customers. Banknorth incurred expenses for the cost of issuing new debit cards to replace the ones that had been compromised by the theft and for the cost of reimbursing those cardholders who had suffered unauthorized charges to their accounts.

Plaintiff seeks recovery of $186,000 it spent to issue new debit cards and $583,000 to cover unauthorized charges to customer's accounts. The lawsuit makes three claims against each defendant: breach of contract, negligence and equitable subrogation. Banknorth is a Maine bank and filed this case in the United States District Court for the District of Maine, but the case was transferred here on motion of the defendants since there are two other cases pending here against BJ's and Fifth Third that make similar claims arising from similar circumstances, Sovereign Bank v. BJ's Wholesale Club, *208 Inc., 395 F. Supp. 2d 183 (M.D.Pa.2005), and Pennsylvania State Employees Credit Union v. Fifth Third Bank, 398 F. Supp. 2d 317 (M.D.Pa.2005) ("PSECU").

We are considering BJ's motion for summary judgment, which argues the following. First, the contract claim against it fails because it is based on Banknorth's status as a third-party beneficiary of BJ's contract with Fifth Third and of an alleged contract between BJ's and Visa, but the former contract disclaims any third-party-beneficiary rights, and the latter contract does not exist. Second, the economic loss rule bars the negligence claim because Banknorth seeks damages only for economic losses, not for damages to persons or property. Third, the equitable subrogation claim (which seeks recovery for customer reimbursements) fails because Banknorth was paying on its own obligation, not that of its customers.

II. Standard of Review.

On a summary judgment motion under Fed.R.Civ.P. 56, the moving party, defendant BJ's, has the initial burden of showing that Plaintiff cannot establish one or more of the essential elements of its claims. See Hugh v. Butler County Family YMCA, 418 F.3d 265, 267 (3d Cir. 2005). Plaintiff as the nonmoving party cannot rest upon the allegations of its pleadings but must present specific facts showing a genuine issue for trial. Id. In ruling on the motion, the court must determine if there are any genuine issues of material fact that would allow a reasonable jury to find for the nonmoving party. See Debiec v. Cabot Corp., 352 F.3d 117, 128 n. 3 (3d Cir.2003). The court must also view the record, and any inferences to be drawn from it, in the light most favorable to the nonmoving party. Id. With this standard in mind, the following is the record for summary-judgment purposes.

III. Background.

"Visa U.S.A. . . . is a privately-held for profit association that supplies and supports Visa credit and debit cards issued by financial institutions to its customers . " (Compl.ś 8.) Banknorth is a national bank with its principal place of business in Portland, Maine, (id. ś 1), and issues debit cards to its customers, including Visa debit cards. (Id. ś 7.) It is an "Issuing Bank" within the Visa system. (Id. ś 9.)

BJ's, with its principal place of business in Natick, Massachusetts, is a retailer which does business in Maine. (Id. ś 2.) It accepts Visa cards for payment of goods and services and is a "Merchant" within the Visa system. (Id. ś 10.)

Fifth Third is a bank with its principal place of business in Cincinnati, Ohio. (Id. ś 3.) It is the "Acquiring Bank" for BJ's. (Id.) An "Acquiring Bank" within the Visa system "helps the merchant fulfill Visa card payments from customers by providing authorization for card transactions, crediting the merchant's account, and then submitting the transaction to the Issuing Bank for settlement." (Id. ś 11.)

Acquiring Banks and Merchants have to abide by "Visa Operating Regulations" in regard to the use and processing of Visa credit and debit cards. (Id. śś 16, 18 and 24.) The regulations "prohibit Fifth Third Bank from allowing BJ's to disclose Visa account information, transaction information, or other cardholder information to third parties." (Id. ś 21.) They also require Fifth Third as the acquiring bank to ensure BJ's compliance with the regulations. (Id. ś 18.) Fifth Third's relationship with BJ's as its acquiring bank is contractual, embodied in a Merchant Agreement, and requires BJ's to comply with the Operating Regulations. (Id. ś 19.) The Merchant Agreement also provides that it is "for the benefit of, and may *209 be enforced only by, Bank and Merchant and their respective successors and permitted transferees and assignees, and is not for the benefit of, and may not be enforced by, any third party." (Doc. 16, Ex. A, penalty-of-perjury declaration of BJ's controller, Christina M. Neppl, Tab 1, ś 16).

Fifth Third has a contract with Visa which requires Fifth Third to guarantee: (1) BJ's will comply with the Visa Operating Regulations; (2) "BJ's will properly secure magnetic stripe information"; (3) "BJ's will not retain magnetic stripe information after a transaction"; and (4) "BJ's will not disclose such information to unauthorized third parties." (Compl. ś 23.) The regulations prohibit "BJ's from disclosing any Visa cardholder account numbers, magnetic stripe information, or transaction information to unauthorized third parties," (id. ś 25), "from retaining or storing any Visa card magnetic stripe information after the authorization of a credit card transaction," (id. ś 26), and require it "to properly secure and protect Visa cardholder information and magnetic stripe data from unauthorized disclosure or access." (Id. ś 27.)

"BJ's did not have any contractual relationship with Visa between July 1, 2003 and February 29, 2004 that related, in any way, to the security of consumer credit or debit card transactions." (Doc. 16, Ex. A, ś 4, Neppl's penalty-of-perjury declaration).^[1]

Banknorth guarantees its customers under the "Visa Zero Liability Policy" that they will not be responsible for fraudulent purchases on their debit cards. The policy advises cardholders: "If the card is lost or stolen and used fraudulently, you are not liable for purchases made online or at merchants." (Doc. 16, Ex. A, Tab 3). Visa advises cardholders that its zero liability policy "covers all Visa credit and debit card transactions processed over the Visa network online or off." (Id., Ex. A, Tab 3). The Visa Operating Regulations also provide:

Limitation of Cardholder Liability

A member that issues Visa Cards must comply with this section.

Upon receipt of notification from its Cardholder of unauthorized Visa Transactions, an Issuer must limit the Cardholder's liability for those Transactions to $0.

(Doc. 34, Ex. B, Visa Operating Regulations, § 3.2.G.2a).^[2]

For its breach-of-contract claim against BJ's, Banknorth alleges it was an intended third-party beneficiary of a contract between BJ's (as a Merchant) and Visa for the processing of Visa card transactions (id. ś 48), and an intended third-party beneficiary of the contract between Fifth Third, as the Acquiring Bank, and BJ's as the Merchant, for processing Visa card transactions. (Id. ś 49.) Plaintiff alleges BJ's breached both these contracts by retaining the magnetic-stripe information for its cardholders, by not securing the information and by allowing unauthorized third parties to access the information. As a result, Plaintiff incurred the cost of cancelling and reissuing Visa debit cards for its customers, about $186,000, and the cost of *210 reimbursing these customers for fraudulent transactions, about $583,000. (Id. śś 50, 52 and 53.) Plaintiff seeks recovery of those amounts.

For its negligence claim against BJ's, Banknorth alleges BJ's had a duty to Banknorth to comply with the regulations, particularly the obligation to secure and protect the cardholder information and not to retain or store it after a transaction, that BJ's breached its duty of care to Banknorth by retaining the information and failing to protect it for about eight months, from July 1, 2003, to February 29, 2004, (Compl. śś 30-32, 34; śś 60-61), that, as a result, unauthorized third parties obtained the magnetic-stripe information from Visa debit cards owned by Banknorth customers from BJ's electronic records, (id. ś 35), and that the third parties used the information for fraudulent purposes, (id. ś 37), causing Plaintiff to incur the costs of cancelling and reissuing Visa debit cards for its customers. (Id. ś 63.)

For its equitable subrogation claim against BJ's, Plaintiff alleges that BJ's breach of its duties to protect Visa card customers' magnetic-stripe information caused Banknorth to incur the costs of reimbursing its affected debit-card customers for the fraudulent charges to their accounts, (id., ś 66), that Banknorth reimbursed its customers "to protect its own secondary rights and/or to fulfill a contractual obligation owed to its customers," (id. ś 67), and that consequently "Banknorth is equitably subordinated to the claims of its affected Visa debit card customers against BJ's as a result of its negligent and/or wrongful conduct." (Id. ś 68). This claim thus does not seek recovery for the cost of reissuing debit cards.

IV. Discussion.

A. The Contract Claim.

Plaintiffs contract claim is two-pronged. It alleges it is a third-party beneficiary (1) of a contract between BJ's and Visa and (2) of a contract between BJ's and Fifth Third.

BJ's argues that Plaintiff cannot be a beneficiary of a contract between BJ's and Visa because no such contract exists. We agree with Defendant that the record shows there is no such contract and hence no basis for a third-party-beneficiary claim. Plaintiff alleges "upon information and belief' that BJ's has a contract with Visa that requires BJ's compliance with the regulations, (Compl.ś 28), but on summary judgment we must look beyond the pleadings, and the record establishes there was no contract between BJ's and Visa during the pertinent time. See Melley v. Pioneer Bank, N.A., 834 A.2d 1191, 1202 (Pa.Super.2003) ("For appellees to be third party beneficiaries of a contract there must be a contract.") (Pennsylvania law).

On the claim based on the contract between BJ's and Fifth Third, BJ's argues that Plaintiff cannot be a beneficiary of BJ's merchant agreement with Fifth Third because, as we already decided in Sovereign Bank, supra, 395 F.Supp.2d at 190-91; PSECU, supra, 398 F. Supp. 2d at 323-24, the merchant agreement's disclaimer of third-party-beneficiary rights defeats the contract claim.

The parties agree that the law of Ohio, Maine and Pennsylvania is the same on this aspect of third-party-beneficiary law, all three applying the Restatement (Second) of Contracts § 302 (1981). See Hill v. Sonitrol of Southwestern Ohio Inc., 36 Ohio St.3d 36, 40, 521 N.E.2d 780, 784 (1988); F.O. Bailey Co. v. Ledgewood, Inc., 603 A.2d 466, 468 (Me.1992); and Searpitti v. Weborg, 530 Pa. 366, 370-71, 609 A.2d 147, 149-50 (1992). Restatement § 302, in setting forth conditions under which a third party may claim the benefits of an *211 Agreement, allows the contracting parties to exclude a third party from suing under the agreement. That section begins: "[u]nless otherwise agreed between promisor and promisee, a beneficiary of a promise is an intended beneficiary if recognition of a right to performance in the beneficiary is appropriate to effectuate the intentions of the parties and . . ." Restatement § 302(1).

In the instant case, the promisor (BJ's) and the promisee (Fifth Third) "otherwise agreed." They included in the merchant agreement a paragraph specifically providing that the contract was not for the benefit of, and not intended to be enforced by, any third party. Hence, Plaintiff is not a third-party beneficiary of the contract between BJ's and Fifth Third and cannot bring a breach-of-contract claim for BJ's alleged failure to follow the Visa regulations. See also Matheny v. Ohio Bancorp., 1994 WL 738734 (Ohio App.1994) (recognizing contracting parties' right to disclaim third-party-beneficiary rights); Pejepscot Indus. Park, Inc. v. Maine Cent. R. Co., 297 F. Supp. 2d 326, 331 (D.Me.2003) (same) (Maine law); Villanova, Ltd. v. Convergys, 2001 WL 868662, at *2 (E.D.Pa.2001) (same) (Pennsylvania law).

B. The Negligence Claim and the Economic Loss Rule.

In this lawsuit, Plaintiff is only seeking recovery of economic damages, the cost of reissuing debit cards and of paying for the unauthorized transactions. BJ's asserts that the economic loss rule bars the negligence claim.

The economic loss rule, adopted in many states, bars recovery in a negligence claim of economic damages alone. This is a statement of the rule at its most abstract level. A review of the case law would reveal that many state courts have finetuned the rule, depending on the factual circumstances of the case and the individual court's view of the rule's purpose.

The Supreme Judicial Court of Maine has addressed the economic loss rule in only one context, a products liability claim, and has applied the rule to bar a negligence claim seeking only economic damages when the claim alleges damage to the product caused by the product itself. See Oceanside at Pine Point Condo. Owners Ass'n v. Peachtree Doors, Inc., 659 A.2d 267 (Me.1995). In Oceanside, the products were condominium units with defective windows that had been made part of each unit. The defective windows allowed water damage to the units. Unit owners sued to recover for the cost of repair and correction. In adopting the rule, and barring the negligence claim, the court relied on the reasoning of East River S.S. Corp. v. Transamerica Delaval Inc., 476 U.S. 858, 872, 106 S. Ct. 2295, 2302-03, 90 L. Ed. 2d 865, 878 (1986), a case involving allegedly defective turbines: damage to the product itself only means that the product had insufficient value or quality, which should be the subject of express and implied warranties, not tort. 659 A.2d at 270.

The difficulty in applying Oceanside here is that the instant case does not involve a defective product that has injured only itself, but the alleged negligent provision of services, so that Oceanside's rationale does not appear to support the application of the rule to Banknorth's claim. Nonetheless, citing a variety of cases from other jurisdictions, BJ's contends that Maine would apply the economic loss rule to bar Banknorth's negligence claim, as indicated by the state supreme court's ready adoption of the rule in the products-liability context. Defendant also relies on the application of the rule in other factual contexts by lower Maine *212 courts and federal courts in Maine. Conversely, Plaintiff argues that in Oceanside, the state supreme court applied the rule only to products liability cases and gave no hint that it would approve its use in other contexts. Banknorth also argues that the other federal and state Maine cases BJ's cites only applied the rule where there was privity of contract between the parties, an element absent here if we reject its claim of being a third-party beneficiary of the contract between BJ's and Fifth Third or the alleged contract between BJ's and Visa.^[3]

Our job as a federal court sitting in diversity is to predict how Maine's highest court would decide this issue. In performing this task, "`we must consider relevant state precedents, analogous decisions, considered dicta, scholarly works, and any other reliable date tending convincingly to show how the highest court in the state would decide the issue at hand.'" British Ins. Co. v. Safety Nat'l Cas., 335 F.3d 205, 211 (3d Cir.2003) (quoted case omitted). After considering the parties' arguments, including those not specifically mentioned above, we conclude that Maine's highest court would apply the economic loss rule in the circumstances here to bar the negligence claim.

We agree with Plaintiff that Oceanside gives no hint that the state supreme court would apply the economic loss doctrine outside the context of products liability. See Debbie Elliot, Inc. v. Hancock, 2005 WL 3340067 at *2 (Me.Super. Oct. 27, 2005) (noting that Oceanside was decided in the products liability context and rejecting a broad interpretation supporting its use to preclude recovery of economic damages where a contract exists). However, courts interpreting Maine law have applied the doctrine to service contracts. See Gannett v. Pettegrow, 2005 WL 217036 at *8 (D.Me. Jan.28, 2005) (Kravchuk, M.J.), report adopted in 2005 WL 763276 (D.Me. Feb.17, 2005); Maine Rubber Int'l v. Envtl. Mgmt. Group, Inc., 298 F. Supp. 2d 133, 136 (D.Me.2004) (deciding that Oceanside's logic extends to service contracts); Bayreuther v. Gardner, 2000 WL 33675355 at *2 (Me.Super. June 21, 2000).

We agree that the economic loss rule can be extended to service contracts. The rationale for doing so is set forth in Fireman's Fund Ins. Co. v. SEC Donohue, Inc., 176 Ill. 2d 160, 166-67, 223 Ill.Dec. 424, 679 N.E.2d 1197, 1200 (1997), quoted in Fireman's Fund Ins. Co. v. Childs, 52 F. Supp. 2d 139 (D.Me.1999), in the latter court's discussion of the unsettled nature of the economic loss rule in Maine:

A provider of services and his client have an important interest in being able to establish the terms of their relationship prior to entering into a final agreement. The policy interest supporting the ability to comprehensively define a relationship in a service contract parallels the policy interest supporting the ability to comprehensively define a relationship in a contract for the sale of goods. It is appropriate, therefore, that [the economic loss doctrine] should apply to the service industry. Just as a seller's duties are defined by his contract with a buyer, the duties of a provider of services may be defined by the contract he enters into with his client. When this is the case, the economic loss doctrine applies to prevent the recovery of purely economic loss in tort.

52 F. Supp. 2d at 145 (brackets added in Childs). This rationale echoes one mentioned in East River but not cited in Oceanside (perhaps because the plaintiffs in Oceanside were consumers, the condo-minium *213 owners), that contract law "is well suited to commercial controversies" involving a defective product that causes only economic injury because commercial parties, usually being equal in bargaining power, can "set the terms of their own agreements" and thereby allocate the risks. East River, supra, 476 U.S. at 873, 106 S. Ct. at 2302, 90 L. Ed. 2d at 878.

Having decided that Maine would extend the economic loss rule to service contracts, we are still only partway to applying it in this case because, as Plaintiff notes, a rejection of its contract claim means there is no privity of contract between it and BJ's. However, we agree with BJ's that privity is not a requirement, once again analogizing to the cases involving products.

As cited by BJ's, in Miller v. U.S. Steel, 902 F.2d 573 (7th Cir.1990), the Seventh Circuit held that privity of contract was not essential for the application of the economic loss rule to a negligence claim based upon a sale of defective steel, reasoning as follows:

The insight behind the doctrine is that commercial disputes ought to be resolved according to the principles of commercial law rather than according to tort principles designed for accidents that cause personal injury or property damage. A disputant should not be permitted to opt out of commercial law by refusing to avail himself of the opportunities which that law gives him. Back when U.S. Steel was urging Mr. Miller to specify Cor-Ten steel for the walls of his building, he could have asked U.S. Steel for an express warranty, which he could then have enforced in a suit for breach of warranty. . . . Alternatively, Miller could have extracted (again, for all we know, did extract) suitable warranties from the general contractor, which might in turn have extracted a warranty from U.S. Steel.

Id. at 575. As BJ's argues, just as the plaintiff in Miller could have obtained protection from the supplier of the steel or from the general contractor on the building, Banknorth could have bargained for allocating the risk of fraudulent transactions with Visa before signing its Visa contract. See also Corporex Dev. & Constr. Mgmt., Inc. v. Shook, Inc., 106 Ohio St.3d 412, 415, 835 N.E.2d 701, 705 (2005) (project owner could not evade the economic loss rule by suing a subcontractor in negligence; owner had to sue the general contractor for breach of contract and the general contractor could in turn sue the subcontractor).

In opposition to our conclusion that the economic loss rule bars Banknorth's negligence claim, Banknorth makes the following arguments. First, it argues that Maine law bars a negligence claim only when the party has an alternative warranty or contract claim. However, Plaintiff cites no authority for this proposition. Second, Banknorth argues that the economic loss rule should not be applied so that a party has no remedy at all, either in contract or tort. This argument misses the point of the rule, that in a commercial context parties are expected to allocate the risk of loss through their contract, not supplement the contract with a tort remedy. See also Fireman's Fund Ins. Co. v. SEC Donohue, Inc., supra, 176 Ill. 2d at 164, 223 Ill.Dec. 424, 679 N.E.2d at 1199 ("[a] plaintiff seeking to recover purely economic losses due to defeated expectations of a commercial bargain cannot recover in tort, regardless of the plaintiff's inability to recover under an action in contract.") (quoted case omitted).

Third, Plaintiff argues that in applying the rule courts are often concerned with unlimited liability if a negligence claim is *214 not foreclosed, see, e.g., Aikens v. Baltimore & Ohio RR. Co., 348 Pa.Super. 17, 21, 501 A.2d 277, 279 (1985), but here BJ's liability would be limited to those issuing banks in the Visa system whose cardholder's information had been compromised. We reject this argument because there are many rationales for the economic loss rule, and we believe application of the rule is justified here because of the parties' ability to bargain.

Fourth, Plaintiff argues that the Visa network qualifies as a "special relationship" that is excepted from the rule, citing in support Florida Bldg. Inspection Services, Inc. v. Arnold Corp., 660 So. 2d 730 (Fla.App.1995). However, that case dealt with factually different circumstances, the liability to third parties of those who provide a service, such as attorneys and realestate appraisers, when the third party was an intended beneficiary of the service or it was well recognized that the third party would rely on the work performed. Id. at 733. Here, BJ's disclaimed third-party-beneficiary status for Plaintiff. We also note that Banknorth could have bargained against the risk it incurred, but did not.

Finally, Plaintiff argues that Maine has allowed the recovery of economic losses in tort in Lindsey v. Mitchell, 544 A.2d 1298 (Me.1988), and Wendward Corp. v. Group Design, Inc., 428 A.2d 57 (Me.1981). Those cases provide no guidance because the issue of whether the damages were recoverable in tort was not raised in either case and they were both decided before Oceanside, supra. See Fireman's Fund Ins. Co. v. Childs, supra, 52 F. Supp. 2d at 144 and n. 4.

C. The Equitable Subrogation Claim.

BJ's contends that Plaintiff cannot rely on equitable subrogation to recover the amounts it paid to cover the unauthorized charges on its cardholders' accounts because in covering those charges Banknorth was simply discharging its own obligation to its cardholders and under Maine law equitable subrogation cannot be used to recover for the payment of one's own debt as the primary obligor.^[4]

As factual support, BJ's points to Plaintiffs admission in its complaint that it covered these charges "to fulfill a contractual obligation to its customers." (Compl.ś67).^[5] It also points to Banknorth's guarantee to customers under the "Visa Zero Liability Policy" that they will not be responsible for fraudulent purchases on their debit cards. The policy advises cardholders: "If the card is lost or stolen and used fraudulently, you are not liable for purchases made online or at merchants." (Doc. 16, Ex. A, Tab 3). Visa advises cardholders that its zero liability policy "covers all Visa credit and debit card transactions processed over the Visa network online or off." (Id., Ex. A, Tab 3).

As further support for its argument that Banknorth has primary liability for the unauthorized transactions, BJ's cites in its reply brief the following provision from the Visa Operating Regulations:

Limitation of Cardholder Liability

A member that issues Visa Cards must comply with this section.

Upon receipt of notification from its Cardholder of unauthorized Visa Transactions, an Issuer must limit the Cardholder's *215 liability for those Transactions to $0.

(Doc. 34, Ex. B, Visa Operating Regulations, § 3.2.G.2a).^[6] In its reply brief, BJ's also argues for the first time that Plaintiff is not entitled to equitable subrogation because § 3.2.G.2a means that Banknorth customers had no debt for the unauthorized transactions, and a party can only invoke equitable subrogation if it has paid the debt of another.

In opposition, Plaintiff concedes that the zero liability policy protects cardholders from fraud losses but argues that its contractual obligation to reimburse those losses was secondary to BJ's primary liability for causing those losses in the first place and that Maine law allows equitable subrogation for Banknorth in these circumstances. Plaintiff contends that "[u]nder Maine law, a party is entitled to equitable subrogation, even if it makes payments pursuant to a contractual obligation, so long as the other party's liability is primary." (Doc. 28, Pl.'s Opp'n Br. p. 31).

Plaintiff also argues that BJ's reliance on the zero liability policy is incomplete for summary judgment because BJ's has not set forth those portions of the Visa Operating Regulations showing how the policy works. Plaintiff points to that part of the zero liability policy that requires only "provisional credit for fraud losses" within five business days. (Doc. 16, Ex. A, Tab 2). Banknorth thus contends that even if it had a contractual obligation to its cardholders, this record establishes that its obligation was only provisional, and the policy does not resolve whether its obligation was primary relative to BJ's.

We agree with defendant BJ's that a person who "pays a debt in performance of his own obligation" is the "primary obligor" and hence not entitled to equitable subrogation under Maine law. McCain Foods, Inc. v. Gerard, 489 A.2d 503, 504 (Me.1985). However, we are not sure that the quoted descriptions of the zero liability policy or the quoted language from section 3.2.G.2a establish that Banknorth was the primary obligor.

In McCain, BJ's principal case in support of its primary-obligor argument, the plaintiff seeking recovery of medical expenses from its former employee had directly agreed to pay for the medical expenses under an employee medical plan. No such direct promise by Banknorth to cover unauthorized transactions is present in this record. The language from the zero liability policy merely informs Banknorth cardholders that they will not be liable for fraudulent transactions, and section 3.2.G.2a only provides that Banknorth must limit the cardholder's liability for unauthorized transactions to zero. At most, these provisions establish that Banknorth cannot charge the cardholder for unauthorized transactions, not that Banknorth itself has to pay for the unauthorized transactions. We recognize, as BJ's points out, that Banknorth avers that it "reimbursed" its cardholders "to fulfill a contractual obligation owed to its customers," (Compl.ś 67), but that contractual obligation might have been simply not to charge cardholders for unauthorized transactions, not a contractual obligation to cover the transactions directly.

However, we agree with BJ's on the argument it made for the first time in its reply brief, that Plaintiff cannot make *216 an equitable subrogation claim because its cardholders incurred no debt that Banknorth can be subrogated to. Under Maine law, subrogation is " the substitution of one person in place of another, whether as a creditor or as the possessor of any other rightful claim, so that he who is substituted succeeds to the rights of the other in relation to the debt or claim and its rights, remedies or securities.'" McCain, supra, 489 A.2d at 504 (quoted case omitted). Here, Banknorth's cardholders incurred no debt because they had no liability for the unauthorized transactions. It follows that Banknorth has no subrogation rights.

IV. Conclusion.

Based on the foregoing, we will dismiss all claims against BJ's and we will issue an appropriate order.

AND NOW, this 13th day of April, 2006, it is ordered that the motion (doc. 15) for summary judgment of defendant BJ's is granted and the Clerk of Court shall enter judgment in favor of BJ's and against Plaintiff on all claims against BJ's, Counts II, IV and V.

[1] Conversely, the complaint alleges "upon information and belief" that BJ's does have a contract with Visa that requires BJ's compliance with the regulations. (Id. ś 28.)

[2] An issuing bank can increase the liability of a cardholder for fraudulent transactions if it determines based on substantial evidence that the cardholder "was grossly negligent or fraudulent in the handling or use of the account or Card." (Id., Ex. B, Visa Operating Regulations, § 3.2.G.2b).

[3] As noted above, we have rejected both those claims.

[4] In this claim. Banknorth seeks recovery only of the cost of the fraudulent transactions, not the cost of replacing compromised debit cards.

[5] Banknorth also alleges in the same paragraph of the complaint that it did so to protect its "secondary rights."

[6] An issuing bank can increase the liability of a cardholder for fraudulent transactions if it determines based on substantial evidence that the cardholder "was grossly negligent or fraudulent in the handling or use of the account or Card." (Id., Ex. B, Visa Operating Regulations, § 3 .2 .G.2b).