Pennsylvania State Employees Credit Union v. Fifth Third Bank

MEMORANDUM CALDWELL, District Judge. I. Introduction. This case stems from a breach of the computer system used by defendant, BJ’s Wholesale Club, Inc., a wholesale club retailer. The system was hacked and bankcard numbers were stolen, allegedly because the computer program BJ’s used to process card transactions improperly retained card numbers rather than merely keep them in the system only for the seconds required to validate the transaction. Some of the numbers stolen belonged to customers of plaintiff, Pennsylvania State Employees Credit Union (PSECU). PSE-CU filed this lawsuit seeking damages represented by the costs of replacing the cards that had been compromised by the theft. PSECU participates in the system operated by Visa USA Inc., so the cards were Visa cards. The case was filed in state court against BJ’s and Fifth Third Bank, the bank that processes card transactions for BJ’s. It was removed here on the basis of diversity jurisdiction. 28 U.S.C. §§ 1332(a) and 1441(a). PSECU then filed an amended complaint. The amended complaint has eight counts. The two defendants have each been sued for breach of contract, *320 negligence, equitable indemnification, and unjust enrichment. 1 BJ’s added International Business Machines Corporation (IBM), the supplier of the software BJ’s used to process transactions, as a third-party defendant, alleging that IBM’s software failed to comply with BJ’s request that it not retain card numbers. The third-party complaint sought recovery from IBM of whatever damages PSECU recovered from BJ’s. On IBM’s motion to dismiss, we allowed BJ’s to seek recovery of the value of the compromised bank cards as blanks. See Pennsylvania State Employees Credit Union v. Fifth Third Bank, 2005 WL 1154594 (M.D.Pa.2005). IBM has moved for reconsideration of that ruling, seeking complete dismissal of the complaint against it. The defendants have each filed separate motions to dismiss under Fed.R.Civ.P. 12(b)(6), arguing that none of the claims states a valid cause of action. BJ’s motion argues principally as follows. First, PSE-CU’s breach-of-contract claim (predicated on third-party-beneficiary status) fails because BJ’s has no contract with Visa and its contracts with Fifth Third affirmatively exclude third-party beneficiaries. Second, PSECU’s negligence claim fails because it is barred by the economic loss doctrine and by the gist of the action doctrine. Third, the equitable-indemnification claim fails because PSECU was fulfilling a contractual obligation of its own in replacing the cards and in these circumstances cannot look to BJ’s for reimbursement. Fourth, the unjust enrichment claim fails because Plaintiff has not alleged it paid damages to a third party. In its motion, Fifth Third principally argues as follows. First, PSECU has no breach-of-contract claim against it because PSECU is not a third-party beneficiary of Fifth Third’s contract with Visa, the basis of the contract claim against Fifth Third. Second, PSECU has no negligence claim because Fifth Third owed it no duty of reasonable care, an essential element of a negligence claim, because duty cannot be based on contractual obligations, as PSE-CU attempts to do here. Additionally, a negligence claim cannot be pursued without physical harm to person or property; purely economic losses are not sufficient. Third, the indemnity claim fails because: (1) PSECU is entitled to indemnity only if Fifth Third committed a tort against the cardholders, and it committed no tort; (2) PSECU is entitled to indemnity only if its cardholders suffered a loss, but they did not do so because federal law imposes the loss for the unauthorized charges on PSE-CU and excuses the cardholders; (3) PSE-CU cannot be secondarily liable to Fifth Third because PSECU accuses Fifth Third of failing to detect the defect in BJ’s computer system, a theory of secondary liability itself; and (4) PSECU cannot be secondarily liable because both contractual obligations and federal law make PSECU primarily liable for the fraudulent transactions. Fourth, the unjust enrichment claim fails, in part, because PSECU was fulfilling a contractual obligation of its own in replacing the cards. II. Standard of Review. In considering Defendants’ motions to dismiss, we must accept as true the factual allegations in the complaint and construe any inferences to be drawn from them in Plaintiffs favor. See Mariana v. Fisher, 338 F.3d 189, 195 (3d Cir.2003). We may *321 dismiss a complaint under Fed.R.Civ.P. 12(b)(6) only if it is clear that no relief could be granted to Plaintiff under “any set of facts that could be proven consistent with the allegations.” Ramadan v. Chase Manhattan Corp., 229 F.3d 194, 195 (3d Cir.2000). The court is not limited to evaluating the complaint alone; it can also consider documents attached to the complaint, matters of public record, and other documents that are indisputably authentic. Pension Ben. Guar. Corp. v. White Consol. Indus., 998 F.2d 1192, 1196 (3d Cir.1993). The court may also consider “documents whose contents are alleged in the complaint and whose authenticity no party questions,” even though they “are not physically attached to the pleading .... ” Pryor v. Nat’l Collegiate Athletic Ass’n, 288 F.3d 548, 560 (3d Cir.2002). III. Background. The complaint alleges the following. PSECU is a Pennsylvania credit union with its principal office in Harrisburg, Pennsylvania. (Doc. 61, Am. Compl. ¶¶ 1 and 6.) Defendant BJ’s, a seller of wholesale goods, is a Delaware corporation with its principal place of business in Massachusetts. (Id. ¶¶ 2 and 10.) Defendant Fifth Third is an Ohio corporation with its principal place of business in Ohio. (Id. ¶ 3.) “Visa is a privately-held, for-profit association, which supports Visa-brand cards issued by financial institutions (‘Issuing Banks’) to consumers, and processes transactions made with those cards on behalf of ‘Acquiring Banks’ and ‘Merchants’ enrolled in its program.” (Id. ¶ 7.) PSECU is an issuing bank, issuing Visa cards to its members (id. ¶ 8), for use in retail purchases from merchants. Fifth Third is an acquiring bank, processing Visa card transactions on behalf of merchants, and is the acquiring bank for BJ’s. (Id. ¶¶ 9 and 11.) BJ’s is a Visa merchant and accepts Visa card transactions from consumers. (Id. ¶¶ 10.) Visa has extensive operating regulations. (Id. ¶ 13.) The regulations require an acquiring bank to guarantee that its merchants will abide by them (id. ¶ 16), and to include in its contract with its merchants a provision requiring the merchant to abide by the regulations, including security regulations, specifically, those regulations prohibiting disclosure of account information, magnetic-stripe information and transaction information. (Id. ¶20.) The regulations “require Fifth Third to accept responsibility for any and all losses caused by BJ’s failure to comply with the” operating regulations. (Id. ¶ 22.) In turn, Fifth Third has a contract with Visa that requires Fifth Third to comply with the operating regulations. (Id. ¶ 14.) Under “Fifth Third’s contract with Visa, Fifth Third: guarantees BJ’s compliance with the Visa Operating Regulations ...; guarantees that BJ’s will properly secure magnetic stripe information; guarantees that BJ’s will not retain such information subsequent to authorization of a transaction; and, guarantees that BJ’s will not disclose such information to unauthorized third parties.” (Id. ¶ 23.) Fifth Third has a contract with BJ’s that requires BJ’s to comply with the operating regulations. (Id. ¶ 15; Doc. 69, BJ’s Exs. 1 and 2.) Those regulations forbid BJ’s from: (1) “disclosing any Visa cardholder account numbers, magnetic stripe information, or transaction information to third parties other than the Merchant’s agents,” the acquiring bank, or the acquiring bank’s agents; or (2) “retaining or storing Visa card magnetic stripe data subsequent to authorization of a transaction.” (Id., ¶¶ 26 and 27). Fifth Third and BJ’s have contracted by way of two merchant agreements. One governs the processing of debit-card trans *322 actions (Doc. 69,-BJ’s Ex. 1.) and the other credit-card transactions. (Id., BJ’s Ex. 2.) Both contain the following language, quoting in a pertinent part from paragraph 16 of each agreement: “This agreement is for the benefit of, and. may be enforced only by, Bank, and Merchant and their respective successors and permitted transferees and assignees, and is not for the benefit of, and may not be enforced by, any third party.” Both agreements also have a choice-of-law provision, requiring them to be “governed, construed and enforced” under Ohio law. (Id, Exs. 1 and 2, ¶ 23.) Both also prohibit, in pertinent part, BJ’s from disclosing a cardholder’s name, address or account number to third parties without written consent. (Id., Exs. 1 and 2, ¶ 8.) From at least July 1, 2003, through February 29, 2004, BJ’s retained, and failed to properly secure, Visa card magnetic-stripe information when Visa cards were used in retail transactions, including over 20,000 Visa cards issued by PSEGU to its members. (Id. ¶¶ 31, 32 and 33.) As a result, unauthorized third parties were able to obtain from BJ’s electronic records, the Visa card magnetic-stripe information retained by BJ’s between at least July 1, 2003 and February 29, 2004, including the magnetic stripe information from 20,029 Visa cards issued by PSECU. (Id. ¶ 35.) The unauthorized third parties “were able to use some or all of the Visa card magnetic stripe information obtained to create counterfeit Visa cards and use or attempt to use those cards for fraudulent purposes.” (Id. ¶ 36.) “[T]o mitigate the damage caused by the compromise of PSECU members’ Visa card magnetic stripe information, PSECU canceled” the 20,029 Visa cards “and reissued Visa cards with new account numbers and magnetic stripe information .... ” (Id. ¶ 39.) Plaintiff also replaced its members’ Visa cards “to protect its legal rights and to fulfill a contractual obligation owed to its customers.” (Id. ¶ 65.) The cancellation and reissuance cost PSECU $98,128.13. (Id. ¶ 40.) The first two counts of the complaint are for breach of contract, count I against Fifth Third and count II against BJ’s. In count I, PSECU alleges that it is a third-party beneficiary of the contract between Fifth Third and Visa, that Fifth Third breached the agreement by failing to insure that BJ’s complied with the operating regulations that required BJ’s not to retain or store cardholder information and not to disclose the information to unauthorized third parties. (Id. ¶¶ 42-43.) Fifth Third also breached the agreement by refusing to accept responsibility for BJ’s breach of the regulations and reimburse Plaintiff for the cost of replacing the cards. (Id. ¶ 44.) In count II, PSECU alleges that it is a third-party beneficiary of BJ’s merchant agreement with .Fifth Third, that BJ’s breached .the agreement by failing to comply with the operating regulations requiring it not to retain or store cardholder information, and thereby damaged PSE-CU by requiring it to incur the cost of replacing the cards. (Id. ¶¶ 48, 50 and 52.) Counts III and IV are for negligence. In count III, Plaintiff alleges that Fifth Third had a duty to issuing banks like PSECU to ensure that its merchants complied with the Visa operating regulations and that Fifth Third breached this duty by failing to take reasonable actions to cause BJ’s to process retail transactions so that BJ’s either: (1) deleted magnetic-stripe information after a transaction had been approved; or (2) safeguarded the information so that unauthorized persons could not obtain it. (Id. ¶¶ 54 and 55.) In count IV, Plaintiff alleges that BJ’s had a duty to comply with Visa operating regulations, to properly safeguard the *323 magnetic stripe information, and not to retain it after a transaction had been processed. (Id. ¶ 58.) BJ’s breached this duty by: (1) failing to safeguard the information; (2) improperly retaining it; and (3) allowing unauthorized persons to obtain it. (Id. ¶ 55.) Counts V and VI are for equitable indemnification, count V against BJ’s and count VI against Fifth Third. In both counts, PSECU alleges that the conduct of BJ’s and Fifth Third “necessitated the replacement of PSECU’s members’ Visa cards,” that “PSECU replaced its members’ Visa cards to protect its legal rights and to fulfill a contractual obligation owed to its customers,” and that BJ’s and Fifth Third “benefited from PSECU’s replacement of PSECU’s customers’ Visa cards, in that this cancellation and replacement halted continued fraudulent use of those card numbers and permitted PSECU’s members to resume use of their Visa cards, which mitigated BJ’s potential liability to PSECU and PSECU’s members.” Plaintiff accordingly asserts that “[ejquity demands” that BJ’s and Fifth Third “pay the costs of replacement of PSECU’s members’ Visa cards.” (Id. ¶¶ 64-67 and 69-72.) Counts VII and VIII are for unjust enrichment, count VII against BJ’s and count VIII against Fifth Third. In both counts, PSECU alleges that BJ’s and Fifth Third “benefited from PSECU’s cancellation and replacement of its members’ Visa cards, in that this cancellation and replacement halted continued fraudulent use of those card numbers and permitted PSECU’s members to resume use of their' Visa cards, which mitigated” BJ’s and Fifth Third’s “potential liability to PSECU and PSECU’s members.” (Id. ¶¶ 74 and 79.) Both BJ’s and Fifth Third “appreciated the benefits conferred by PSECU’s cancellation and replacement of its members’ Visa cards.” (Id. ¶¶ 75 and 80.) BJ’s and Fifth Third’s “acceptance and retention of the benefits conferred by PSECU’s cancellation and replacement of its members’ Visa cards, without payment” by BJ’s and Fifth Third “of compensation to PSECU, would be inequitable.” (Id. ¶¶ 76 and 81.) Plaintiff alleges that BJ’s and Fifth Third were thus “unjustly enriched by PSECU’s cancellation and replacement of its members’ Visa cards,” (id. ¶¶ 77 and 82), and requests as damages the cost of replacing them. TV. Discussion. A. BJ’s Motion to Dismiss. 1. PSECU Has No Breachr-of-Contract Claim. Acknowledging that it has no contract with BJ’s, Plaintiff asserts its contract claim as a third-party beneficiary of the contracts between BJ’s and Fifth Third. 2 BJ’s credit— and debit-card contracts with Fifth Third require BJ’s to comply with Visa regulations, and Plaintiff alleges BJ’s thus breached the contracts by retaining cardholder information and failing to protect it from third parties in violation of the regulations. In moving to dismiss, BJ’s argues •that PSECU has no contract claim against it because its contracts with Fifth Third specifically exclude third parties as beneficiaries of the agreements. As the relevant provisions read: “This agreement is for the benefit of, and may be enforced only by, Bank and Merchant and their respec *324 tive successors and permitted transferees and assignees, and is not for the benefit of, and may not be enforced by, any third party.” BJ’s argues that Ohio law rejects third-party-beneficiary claims when such a contractual exclusion is present, citing Hill v. Sonitrol of Southwestern Ohio Inc., 36 Ohio St.3d 36, 521 N.E.2d 780 (1988); CMC Elec. Co. v. J.D. Williamson Constr. Co., 1999 WL 1073685 (Ohio App.1999); and Matheny v. Ohio Bancorp., 1994 WL 738734 (Ohio App. 1994). 3 We agree with this argument. Hill is not directly on point but is relevant because it adopted the Restatement (Second) of Contracts § 302 (1981) as the law of Ohio for determining who qualifies as a third-party beneficiary of a contract. 521 N.E.2d at 784. While section 302 recognizes that a nonsignatory to a contract can be an intended beneficiary of the contract if certain conditions are met, it recognizes the right of the contracting parties to exclude third parties from invoking the benefits of their agreement. It begins “[u]n-less otherwise agreed between promisor and promisee, a beneficiary of a promise is an intended beneficiary if recognition of a right to performance in the beneficiary is appropriate to effectuate the intentions of the parties and ...” Restatement § 302(1). In the instant case, the promisor (BJ’s) and the promisee (Fifth Third) “otherwise agreed.” They included in their contracts a paragraph specifically providing that the contracts were not for the benefit of, and not intended to be enforced, by any third party. Hence, Plaintiff is not a third-party beneficiary of the contracts between BJ’s and Fifth Third and cannot bring a breach-of-contract claim for BJ’s alleged failure to follow the Visa regulations. See Matheny, supra, 1994 WL 738734, at *5 (“Section 302 of the Restatement clearly provides that one who might otherwise satisfy the definitional elements of an intended third-party beneficiary will not be treated under the law as such when it is ‘otherwise agreed between promisor and promisee.’ ”). In addition to Matheny and CMC Elec. Co., supra, 1999 WL 1073685, at *2, the other nonprecedential opinion from the Ohio Court of Appeals, other courts have also concluded that a third party cannot sue on a contract that affirmatively excludes third parties from the contract’s benefits. See India.Com, Inc. v. Dalal, 412 F.3d 315, 321-22 (2d Cir.2005) (New York law); Riscorp, Inc. v. Norman, 915 So.2d 1142, 1151-52, 2005 WL 628832, at *8 (Ala.2005); Hrushka v. State, 117 N.H. 1022, 381 A.2d 326, 327 (1977); Cities Service Co. v. Gulf Oil Corp., 797 P.2d 1009, 1011-12 (Okla.Civ.App.1990) (collecting cases and noting that contractual exclusion of third-party beneficiaries is the majority rule); Villanova, Ltd. v. Convergys, 2001 WL 868662, at *2 (E.D.Pa.2001) (interpreting Pennsylvania law); In re Gulf Oil/Cities Service Tender Offer Litigation, 725 F.Supp. 712, 731 (S.D.N.Y.1989) (Delaware law); Gannon v. Baldt Anchor and Chain, 459 F.Supp. 457, 459 (E.D.Pa.1978) (interpreting Pennsylvania law). Against dismissal of its contract claim, PSECU makes three arguments. First, it relies on cases where the contract does not specifically exclude third-party beneficia *325 ries, citing among others, Hill, supra; Scarpitti v. Weborg, 530 Pa. 366, 609 A.2d 147 (1992); and Chitlik v. Allstate Ins. Co., 34 Ohio App.2d 193, 299 N.E.2d 295 (1973). Using the analysis from these cases, it maintains it is entitled to third-party-beneficiary status, pointing to the contractual provisions requiring BJ’s to abide by the Visa operating regulations and noting the importance to an issuing bank that it do so since it is the financial information of the issuing bank’s customers that is at risk from a merchant’s careless handling of that information. However, the exclusion makes the difference. As noted, Restatement of Contracts § 302(1) recognizes third-party-beneficiary rights, but not if the contracting parties agree that third parties shall have no rights under the contract. This limitation on third-party-beneficiary rights makes sense because contracting parties should be able to control who may sue on the contract. See also Hrushka, supra, 381 A.2d at 327 (courts should enforce the expressed intent of contracting parties to deny a third party who may benefit from the contract any right to enforce the contract) (quoting 4 A. Corbin, Contracts § 777 (1951)). In its second argument, Plaintiff maintains that the exclusion does not prevent it from being a third-party beneficiary of the merchant agreements. It cites two cases where the courts have not enforced an exclusion of third-party rights. However, they are distinguishable. In State Farm Mut. Auto. Ins. Co. v. HHS Assocs., Inc., 1995 WL 739703 (E.D.Pa.), plaintiff State Farm, the buyer of real property, sued the defendant seller and a second defendant, an environmental-assessment company. The claim against the latter defendant was that it had breached a contract between itself and the seller by failing to accurately assess the environmental damage to the property. The court allowed the contract claim to proceed in the face of the exclusion, but in the circumstances of the case the only purpose the contract served was to benefit the plaintiff buyer (as also supported by deposition testimony). Additionally, as the court itself came close to acknowledging, its ruling bordered on dictum since the seller had assigned its rights under the contract to plaintiff State Farm in any event. 1995 WL 739703, at *4 n. 2. Here, in contrast, the merchant agreements had not been made for the sole benefit of PSECU. In Twin City Constr. Co. v. ITT Indus. Credit Co., 358 N.W.2d 716 (Minn.App.1984), the plaintiff construction company, at the behest of the defendant loan company, had given up significant rights as against the owner of the hotel that was being built (basically agreeing to complete construction without any recourse against the owner) so that the owner could obtain a loan from the defendant to complete the hotel. During construction, the defendant made progress payments directly to the plaintiff, but failed to make the last one, leading to the suit. The court ruled that under these circumstances the plaintiff could sue on the loan agreement, despite an exclusion of third-party rights. 3 Ill. Dec. 320, 358 N.E.2d at 718-19. Here, in contrast, PSECU was not directly involved in the negotiation of the merchant agreements between BJ’s and Fifth Third nor did it surrender significant rights to have those agreements consummated. Plaintiffs third argument, citing Martin Marietta Materials, Inc. v. Redland Genstar, Inc. (In Re Bacx Corp.), Civ. No. JFM-99-42, 1999 WL 33955337 (D.Md. Sept. 8, 1999) (unpublished, available on Loislaw.com), is that the exclusion conflicts with, and hence must yield to, “the more specific recognition” of its rights as an issuing bank by the obligation imposed on BJ’s to abide by the Visa operating regulations. *326 In Martin Marietta a case originating in bankruptcy, the district court held that an unsecured creditor could sue as a third-party beneficiary of an asset-purchase agreement to enforce a provision requiring the buyer to pay unsecured creditors seventy-five percent of accounts receivable in excess of a threshold amount. The agreement contained an exclusion of third-party-beneficiary rights, but the court held that the exclusion had to yield to the unsecured-creditors provision, described by the court as “providing] a clear intended benefit to unsecured creditors.” The court reasoned that this specific provision took precedence under contract law over a general one like the exclusion. We think that Martin Marietta is distinguishable for the same reason that State Farm and Twin City Constr. Co. are. In Martin Marietta, the unsecured-creditors provision obligated the buyer to make direct payments to unsecured creditors for monies owed them, albeit under a certain formula. Such an important and significant right of unsecured creditors would lead a court to disregard the third-party beneficiary exclusion. In contrast, PSE-CU can assert no such direct and substantial right under BJ’s merchant agreements with Fifth Third. We will therefore dismiss the breach-of-contract claim against BJ’s. 2. The Aikens Economic Loss Doctrine Bars the Negligence Claim. As noted, PSECU seeks as damages the cost of replacing the cards that had been compromised by the breach of BJ’s computer system. BJ’s argues PSECU’s negligence claim is thus barred by the economic loss doctrine because Plaintiff is not claiming compensation for any physical damage to person or property. BJ’s relies on a line of cases beginning with Aikens v. Baltimore & Ohio RR. Co., 348 Pa.Super. 17, 20, 501 A.2d 277, 278 (1985). In Aikens, the Pennsylvania Superior Court held that workers who lost wages because a train derailment damaged the factory where they worked could not bring a negligence claim for their “purely economic loss[es],” id. at 20, 501 A.2d at 278, unless there was also physical injury, either to the person or property. The court acknowledged the roots of the rule in Robins Dry Dock & Repair Co. v. Flint, 275 U.S. 303, 48 S.Ct. 134, 72 L.Ed. 290 (1927), and also adopted Restatement (Second) of Torts § 766C (1979) as stating the general rule. 4 The superior court offered two rationales for the rule. First, the putative tortfeasor could not foresee the harm: “the negligent actor has no knowledge of the contract or prospective relation and thus has no reason to foresee any harm to the plaintiffs interest.” 348 Pa.Super. at 21, 501 A.2d at 279 (citations omitted). Second, public policy dictated a limitation on the right of recovery in negligence for economic losses: “To allow a cause of action for negligent cause of purely economic loss would be to open the door to every person in the economic chain of the negligent person or business to bring a cause of action. Such an outstanding burden is clearly inappropriate and a danger to our economic system.” Id. at 21, 501 A.2d at 279. *327 Athens’s economic loss rule has been followed, in subsequent cases to bar negligence claims seeking recovery for “economic damages” or “losses” unless there has also been physical injury either to a person or property. See Spivack v. Berks Ridge Corp., 402 Pa.Super. 73, 78, 586 A.2d 402, 405 (1990); Adams v. Copper Beach Townhome Communities, L.P., 816 A.2d 301, 305 (Pa. Super. 2003) (“The Economic Loss Doctrine provides that no cause of action exists for negligence that results solely in economic damages unaccompanied by physical injury or property damage.”). BJ’s argues that the doctrine applies here because BJ’s conduct allegedly made PSECU’s performance of its contract with its cardholders more expensive by requiring the issuance of replacement cards. The claim for the damages here, the cost of replacement cards, thus comes within Restatement (Second) of Torts § 766C(b), adopted by the court in Aikens, prohibiting claims for economic losses resulting from conduct making the plaintiffs performance of a contract more expensive. In opposition, Plaintiff argues that BJ’s has misconstrued the economic loss doctrine, that recently the Pennsylvania Supreme Court held that such losses are recoverable in tort even in the absence of physical injury to person or property. PSECU also argues that the economic loss doctrine only bars a negligence claim when the parties are in privity of contract. Finally, Plaintiff contends that it did suffer physical damage because “BJ’s negligence rendered [its] cards useless and necessitated their replacement. The loss of these cards — physical tangible items — constitutes property damage that obviates the economic loss doctrine.” (Doc. 73, Pl.’s Opp’n Br. at 20). Plaintiffs first argument is based on Bilt-Rite Contractors, Inc. v. Architectural Studio, 581 Pa. 454, 866 A.2d 270 (2005), where the Pennsylvania Supreme Court held that Restatement (Second) of Torts § 552 (1977) applied to professionals like architects, thus allowing the plaintiff construction company there to sue for the architect’s negligent misrepresentations increasing the plaintiffs costs of constructing a school. Biltr-Rite is the first case in which the Pennsylvania Supreme Court has addressed the economic loss doctrine. In rejecting the use of that doctrine to bar the negligence claim, the supreme court adopted the approach of the South Carolina Supreme Court, quoting from Tommy L. Griffin Plumbing & Heating Co. v. Jordan, Jones & Goulding, Inc., 320 S.C. 49, 463 S.E.2d 85 (1995). That approach views the role of the economic loss doctrine as “maintain[ing] the dividing line between tort and contract while recognizing the realities of modern tort law.” Bilt-Rite, 581 Pa. at 483, 866 A.2d at 288 (quoting Tommy L. Griffin Plumbing, supra, 463 S.E.2d at 88). The Pennsylvania Supreme Court then stated, continuing to quote from Tommy L. Griffin Plumbing: The question, thus, is not whether the damages are physical or economic. Rather, the question of whether the plaintiff may maintain an action in tort for purely economic loss turns on the determination of the source of the duty plaintiff claims the defendant owed. A breach of a duty which arises under the provisions of a contract between the parties must be redressed under contract, and a tort action will not lie. A breach of duty arising independently of any contract duties between the parties, however, may support a tort action. Bilt-Rite, 581 Pa. at 483, 866 A.2d at 288 (quoting Tommy L. Griffin Plumbing, supra, 463 S.E.2d at 88) (citation in Tommy Griffin omitted in Bilt-Rite). Concluding, the Pennsylvania Supreme Court stated: *328 Like South Carolina, Pennsylvania has long recognized that purely economic losses are recoverable in a variety of tort actions including the professional malpractice actions noted by the South Carolina Supreme Court. We agree with that court that a plaintiff is not barred from recovering economic losses simply because the action sounds in tort rather than contract law. Bilt-Rite, 581 Pa. at 483, 866 A.2d at 288. Bilt-Rite is certainly friendlier to PSE-CU’s negligence claim than the cases from the superior court. Bilt-Rite seems to take the opposite approach to the economic loss doctrine than the superior court. For the superior court, the type of damages sought determines whether the tort claim can proceed, but for the supreme court, the type of damages is irrelevant; the court says as much. It also notes that economic losses are a routine recovery in many tort actions. Further, the supreme court seems to view the economic loss doctrine as closely related to the gist of the action doctrine, see eToll, Inc. v. Elias/Savion Advertising, Inc., 811 A.2d 10 (Pa.Super.2002), since it will allow a tort action to lie if the plaintiff can show a breach of a duty arising independently of any contractual obligation. Nonetheless, we reject Plaintiffs reliance on Bilt-Rite. As BJ’s points out, the case addressed the economic loss doctrine in the context of a negligent-misrepresentation claim, and it is the only case in which the state supreme court has addressed that doctrine. At the same time, the state superior court has applied the doctrine in a number of cases dealing with other types of negligence claims. See Aikens, supra, 348 Pa.Super. 17, 501 A.2d 277; Spivack, supra, 402 Pa.Super. 73, 586 A.2d 402; Adams, supra, 816 A.2d 301; Duquesne Light Co. v. Pennsylvania American Water Co., 850 A.2d 701 (Pa.Super.2004); General Public Utilities v. Glass Kitchens of Lancaster, Inc., 374 Pa.Super. 203, 542 A.2d 567 (1988); Margolis v. Jackson, 375 Pa.Super. 182, 543 A.2d 1238 (1988); Moore v. Pavex, Inc., 356 Pa.Super. 50, 514 A.2d 137 (1986). As a federal court exercising diversity jurisdiction, we have to apply state law as interpreted by the state’s highest court, Buczek v. Continental Cas. Ins. Co., 378 F.3d 284, 288 n. 2 (3d Cir.2004), but the instant case is not a negligent-misrepresentation case, and Bilt-Rite was not an expansive examination of the economic loss doctrine, 581 Pa. at 483, 866 A.2d at 288 (“Thus, we hold that the economic loss rule does not apply to claims of negligent misrepresentation sounding under Section 552.”), so Bilt-Rite does not control here. See also Samuel Grossi & Sons, Inc. v. United States Fid. & Guar. Co., 2005 WL 1522043, at *6 n. 2 (Phila.Ct.Com.Pl.2005) (applying the economic loss doctrine to bar a negligence claim arising from a construction dispute and distinguishing Bilt-Rite because it was a negligent-misrepresentation case). In these circumstances, we should follow the superior court’s case law “unless we are convinced by other persuasive data that the highest court of the state would decide otherwise.” Houbigant, Inc. v. Federal Ins. Co., 374 F.3d 192, 199 n. 9 (3d Cir.2004) (quoted case and internal quotation marks omitted); see also Chemical Leaman Tank Lines, Inc. v. Aetna Cas. & Sur. Co., 177 F.3d 210, 217 (3d Cir.1999) (“We do not disregard a decision of an intermediate appellate state court on an issue of controlling state law unless we are ‘convinced by other persuasive data’ ” that the state supreme court would rule otherwise) (quoted cases omitted). In this case, there are no other data that would convince us to ignore the line of superior-court cases. Hence, Bilt-Rite does not defeat the defense argument based on the economic loss doctrine. *329 PSECU’s second argument is that a negligence claim for economic losses is only barred when the parties are in privity of contract, citing Bilt-Rite, 581 Pa. at 483, 866 A.2d at 288; Duquesne Light Co. v. Westinghouse Elec. Corp., 66 F.3d 604, 620 (3d Cir.1995); and Sun Company, Inc. v. Badger Design & Constructors, Inc., 939 F.Supp. 365, 371 (E.D.Pa.1996). Pointing out that BJ’s argues that PSECU has no contract with it, Plaintiff maintains that its negligence claim should be allowed to proceed at this time (the pleading stage) as an alternative to its contract claim. 5 We reject this argument. In Bilir-Rite, on its way to saying that the plaintiff could pursue a negligent-misrepresentation claim for economic losses, the state supreme court did note that the plaintiff had no contract with the defendant architectural firm and that therefore it could not pursue a breach-of-contract claim, but the court never stated that if the parties had been in contractual privity, it would not have recognized the cause of action. Indeed, it stated it would have been “nonsensical” not to allow the claim when the plaintiff had satisfied all the elements of the cause of action. 581 Pa. at 483, 866 A.2d at 288. In any event, privity was not an issue the supreme court had to address since there was no contract between the parties. As to the other cases Plaintiff cites on its privity argument, it is important to realize that the economic loss doctrine is applied in two different factual circumstances. BJ’s relies upon the rule as it has been applied in cases like Aikens, supra, where recovery is sought for economic damages caused by the defendant’s allegedly negligent conduct. However, the economic loss doctrine has also been applied in cases where the economic losses were allegedly caused by a defect in a product, perhaps causing damage to the product itself but causing no damage to person or property. In the latter context, courts have refused to allow recovery in tort for economic damages alone, with the modern trend being prompted by East River S.S. Corp. v. Transamerica Delaval, Inc., 476 U.S. 858, 106 S.Ct. 2295, 90 L.Ed.2d 865 (1986). In the products-liability context, the rule is applied because economic losses can be protected against by contract or warranty, with warranty protecting a manufacturer against unlimited liability in tort for “persons downstream” from the initial transaction. 476 U.S. at 871-875, 106 S.Ct. at 2302-04, 90 L.Ed.2d at 877-79. Parties are thus left to whatever contractual remedies they bargained for and if they did not bargain for recovery of economic damages, they are not permitted to do so in tort. In REM Coal Co. v. Clark Equip. Co., 386 Pa.Super. 401, 563 A.2d 128 (1989), the Pennsylvania Superior Court adopted the rationale of East River and applied the economic loss doctrine to preclude recovery of economic damages in tort in a products-liability case. As Sun Company, supra, one of the cases Plaintiff cites, makes clear, East River has been applied to contracts outside the products-liability context. Plaintiffs privity argument depends on these latter cases, but these cases only say, at. most, that parties in a contractual relationship are barred by the economic loss doctrine from seeking economic damages by way of a tort claim. This is not the same as Plaintiffs position, that the only time a plaintiff is barred from recovering economic damages in tort is when the plaintiff has a contract with the defendant. And in fact the Aikens line of cases disproves Plaintiff argument because eco- *330 nomie losses were not allowed to be recovered in tort in cases where the plaintiffs had no contract with the defendants. See, e.g, Aikens, supra, 348 Pa.Super. 17, 501 A.2d 277; Spivack, supra, 402 Pa.Super. 73, 586 A.2d 402; Margolis, supra, 375 Pa.Super. 182, 543 A.2d 1238; Moore, supra, 356 Pa.Super. 50, 514 A.2d 137. Plaintiffs third argument is that the economic loss doctrine does not apply here because BJ’s did nonetheless cause property damage to the cards that had to be replaced. PSECU bases this argument on the fact that the cards are tangible property and.that the loss, of the use of these cards, “physical tangible items — constitutes property damage that obviates the economic loss doctrine.” (Doc. 73, Pl.’s Opp’n Br. at 20). We disagree. A plaintiff must show physical damage to property, not its tangible nature, to avoid the application of the economic loss doctrine. The damages sought here, the costs of replacing the cards, are economic losses. See Rose Fuel Oil & Heating Co. v. Kia Motors of America, Inc., 2004 WL 1202901 at *2 (E.D.Pa.). 6 3. The Equitable-Indemnification Claim Fails. Plaintiff has made an equitable-indemnification claim against BJ’s for the cost of replacing its customers’ cards. PSECU has alleged that BJ’s conduct “necessitated the replacement of PSECU’s members’ Visa cards,” that “PSECU replaced its members’ Visa cards to protect- its legal rights and to fulfill a contractual obligation owed to its customers,” and that BJ’s “benefited from PSECU’s replacement of PSECU’s customers’ Visa cards. Plaintiff asserts that “[e]quity demands” that BJ’s “pay the costs of replacement of PSECU’s members’ Visa cards.” (Id. ¶¶ 64-67.) BJ’s moves to dismiss this claim on several grounds, but we need consider, only- one, that PSECU has not alleged that it paid damages to a third party, a requisite element of an indemnification claim. When one party must pay damages to another based on some legal obligation, common-law (equitable) indemnity permits that party to recover its payment from another person if the former’s liability is “secondary” to the “primary” liability of the latter. Sirianni v. Nugent Bros., Inc., 509 Pa. 564, 569-70, 506 A.2d 868, 870-71 (1986). Secondary liability is different in degree and kind from primary liability. Id. at 570, 506 A.2d at 871. Secondary liability is “constructive only, being based on some legal relation between the parties, or arising from some positive rule of common or statutory law or because of a failure to discover or correct a defect or remedy a dangerous condition caused by the act of the one primarily responsible.” Id., 506 A.2d at 871. As defendant BJ’s argues, before one can be indemnified one has to have paid damages, but Plaintiff has not alleged that it paid any damages; only that it has fulfilled a contractual obligation to its customers by replacing their Visa cards, and incurring costs in doing so. We will therefore dismiss the equitable-indemnification claim. 4. Plaintiff Fails to State an Unjust Enrichment Claim Against BJ’s. PSECU claims that BJ’s was unjustly enriched by Plaintiffs replacement of the *331 compromised Visa cards because the replacement of the cards eliminated BJ’s potential liability for fraudulent use of the card numbers. Under Pennsylvania law: To prevail on a claim for unjust enrichment, a plaintiff must prove: (1) benefits conferred on defendant by plaintiff; (2) appreciation of such benefits by defendant; and (3) acceptance and retention of such benefits under such circumstances that it would be inequitable for defendant to retain the benefit without payment of value. Temple University Hosp., Inc. v. Healthcare Management Alternatives, Inc., 832 A.2d 501 (Pa.Super.2003). Walter v. Magee-Womens Hosp., 876 A.2d 400, 407 (Pa.Super.2005). “The most important factor ... is whether the enrichment of the defendant is unjust.” Id. (quoted case omitted). A claim for unjust enrichment cannot be made simply because the defendant may have been benefited in some way. Id. In moving to dismiss the unjust enrichment claim, BJ’s argues as follows. First, Plaintiff has failed to allege facts showing that it conferred a benefit on BJ’s because, as Plaintiff has pled, it replaced the cards to fulfill a contractual obligation to do so. Defendant relies on Allegheny Gen. Hosp. v. Philip Morris, Inc., 228 F.3d 429, 447 (3d Cir.2000), to argue that when a party is fulfilling its own obligations any benefit conferred on another is merely incidental and cannot be recovered under Pennsylvania law of unjust enrichment. Second, any benefit is measured by the defendant’s gain, not the plaintiffs loss. See Scaramuzza v. Sciolla, 2004 WL 2063062, at *5 (E.D.Pa.). Here, Plaintiff seeks recovery for its cost of replacing the cards, but alleges a different benefit conferred on BJ’s, the elimination of BJ’s potential, and unquantified, liability for fraudulent charges. Finally, BJ’s retention of any benefit would not be unjust since Plaintiff had no reasonable expectation of reimbursement because PSECU gave no notice before replacing the cards that it would seek reimbursement from BJ’s nor has it alleged that BJ’s indicated it would reimburse Plaintiff. In support of the last argument, BJ’s cites EFCO Importers v. Halsobrunn, 500 F.Supp. 152, 158 (E.D.Pa.1980); and Aloe Coal Co. v. Dep’t of Transp., 164 Pa.Cmwlth. 453, 475, 643 A.2d 757, 767-68 (1994). In opposition, PSECU maintains that it did confer a benefit on BJ’s because otherwise BJ’s would be facing liability for fraudulent use of the cards. Retention of the benefit would also be unjust because PSECU was not at fault for the circumstances requiring replacement of the cards. Plaintiff did not have to give notice before incurring these replacement costs since even a passive recipient of a benefit, without regard to intention, can be liable for unjust enrichment, citing Torchia v. Torchia, 346 Pa.Super. 229, 236, 499 A.2d 581, 584 (1985). We agree with Defendant- that the unjust enrichment claim fails. We need only rely on its argument that no benefit was conferred because PSECU replaced the cards based on a contractual obligation to do so. See Allegheny Gen. Hosp., supra, 228 F.3d at 447. In these circumstances, when no benefit, except an incidental one, is conferred, an unjust enrichment claim fails. 7 *332 B. Fifth Third’s Motion to Dismiss. 1. The Contract Claim Against Fifth Third. For its breach-of-contract claim against Fifth Third, Plaintiff claims to be a third-party beneficiary of Fifth Third’s contract with Visa. That contract requires Fifth Third to assure that its merchants will comply with Visa’s operating regulations, which Fifth Third allegedly failed to do since BJ’s retained customer information in violation of the regulations. Fifth Third argues that PSECU’s third-party-beneficiary claim fails because under Ohio law Plaintiff is not a third-party beneficiary of the contract between Fifth Third and Visa. 8 Both Ohio and Pennsylvania have adopted the Restatement (Second) of Contracts § 302 (1981) for determining third-party-beneficiary status. See Hill v. Sonitrol of Southwestern Ohio, Inc., 36 Ohio St.3d 36, 521 N.E.2d 780, 784 (1988); Scarpitti v. Weborg, 530 Pa. 366, 370-71, 609 A.2d 147, 149-50 (1992). In Scarpitti, the Pennsylvania Supreme Court summarized third-party-beneficiary law as follows: [A] party becomes a third party beneficiary only where both parties to the contract express an intention to benefit the third party in the contract itself, Spires, supra, unless, the circumstances are so compelling that recognition of the beneficiary’s right is appropriate to effectuate the intention of the parties, and the performance satisfies an obligation of the promisee to pay money to the beneficiary or the circumstances indicate that the promisee intends to give the beneficiary the benefit of the promised performance. Guy, supra. Id. at 372-73, 609 A.2d at 150-51 (emphasis in original). 9 As indicated, there are two tests for third-party-beneficiary status. As the citation to Spires v. Hanover Fire Ins. Co., 364 Pa. 52, 70 A.2d 828 (1950), shows, the first one requires that the parties to the agreement indicate in the agreement itself that the purported beneficiary is a third-party beneficiary. The second test does not require an affirmative recognition of the purported beneficiary in the contract itself but imposes two requirements. First, the circumstances must be so compelling that recognition of the beneficiary’s right is appropriate to effectuate the intention of the parties. Second, (1) the performance satisfies an obligation of the promisee to pay money to the beneficiary or (2) the circumstances indicate that the promisee intends to give the beneficiary the benefit of the promised performance. Elaborating on this second test, the Pennsylvania Supreme Court stated: The first part of the test sets forth a standing requirement which leaves discretion with the court to determine whether recognition of third party beneficiary status would be appropriate. *333 The second part defines the two types of claimants who may be intended as third party beneficiaries. If a party satisfies both parts of the test, a claim may be asserted under the contract. Scarpitti, supra, 530 Pa. at 371, 609 A.2d at 150. In resolving Fifth Third’s motion to dismiss, we will start with Plaintiffs exposition of its third-party-beneficiary claim in its brief in opposition to Fifth Third’s mo: tion. PSECU relies on the second test to establish its status. On the first part of this test, the standing requirement, we note Plaintiffs reliance on the provision of the membership agreement between Visa and Fifth Third requiring Fifth Third to ensure that its merchants will abide by Visa operating regulations, including the regulation that merchants not retain customer information. PSECU maintains that the purpose of this contractual obligation on Fifth Third’s part is “to ensure the security and stability of the Visa network” and that “it is for this reason that Visa insists that Acquiring Banks incorporate the Operating regulations into their contracts with Merchants.” (Doc. 74, Pl.’s Opp’n Br. at p. 8.) Thus, Plaintiff argues Visa intended PSECU to benefit from the agreement. As the argument continues, so did Fifth Third since it would have been aware that the Operating Regulations were intended to protect issuing banks. (Id., at p. 9.) In turn, this purpose behind the agreement means that the promisor (Fifth Third) and the promisee (Visa) contemplated a third-party relationship with issuing banks like PSECU whose customers used their credit or debit cards at merchants like BJ’s. It follows that the first part of the second test is satisfied since it would be appropriate to recognize PSECU’s third-party-beneficiary status. As to the second part of the test, Plaintiff impliedly relies on that prong evaluating whether the circumstances indicate that the promisee intends to give the beneficiary the benefit of the promised performance, contending that Visa, the prom-isee, as argued above, did intend to give PSECU the benefit of Fifth Third’s performance as promisor. (Id. at p. 8.) 10 In Plaintiffs view, it follows that it is a third-party beneficiary of the agreement between Fifth Third and Visa since both parts of the second test are satisfied. Plaintiff likens its claim to the one in Scarpitti, supra, where the Pennsylvania Supreme Court recognized the right of plaintiff new-home buyers to sue as third-party beneficiaries of a contract between the defendant architect and the developer of the subdivision where the new homes would be built. The architect had agreed with the developer to review the construction plans for the new homes to ensure that they complied with the subdivision’s restrictions. He rejected the plaintiffs’ plans as violative of a restriction on three-car garages, required them to modify their plans accordingly, but allowed other homeowners to build with three-car garages. In deciding that the plaintiff home buyers were third-party beneficiaries of the contract between the developer and the architect, the supreme court, reasoned as follows. First, it determined that the “obvious purpose” of the “underlying contract” between the. architect as promisor and the developer as promisee “was to make the lots more attractive to prospective purchasers by assuring that other homeowners in the subdivision would be required to abide by the recorded subdivision restrictions.” 530 Pa. at 373, 609 A.2d at 151. The court opined: “It is the home *334 owners who have the greatest interest in uniform enforcement of restrictions and it is the homeowners who were benefítted by the establishment of a vehicle to enforce the restrictions.” Id., 609 A.2d at 151. It followed that the homeowners were reasonable in believing that the promise to enforce the subdivision restrictions “manifest[ed] an intention to confer a right on them,” id., 609 A.2d at 151, and from there for the court to conclude that “recognition of a right to uniform enforcement of the deed restrictions in [the plaintiffs] is appropriate to effectuate the intention of the parties,” id., 609 A.2d at 151, thereby satisfying the standing requirement of the second test for third-party-beneficiary status. As to the second part of the test, the supreme court found that part satisfied by the prong dealing with whether the circumstances indicate that the promisee intends to give the beneficiary the benefit of the promised performance. The court found that the promisee developer did intend to give this “limited class” the benefit of the architect’s performance. (Indeed, the court found that the architect intended to benefit them as well.) Closing, the court noted that no other purpose for the contract had been advanced. Id. at 373-74, 609 A.2d at 151. PSECU says Scarpitti requires recognition of its third-party-beneficiary status. Analogizing to Scarpitti, the underlying agreement is between a promisor Fifth Third and its promisee, Visa, to ensure that Fifth Third’s merchants will abide by the operating regulations (specifically the operating regulation forbidding merchants from retaining customer information). One can thus glean from the circumstances that the purpose of the agreement was to make the Visa network safe for issuing banks, either those already in the network or those contemplating joining it, by assuring them that their customer information will only be in a merchant’s possession long enough to make a transaction. The issuing banks would have reasonably relied on Fifth Third’s contractual assurance in this regard, and the third-party-beneficiary relationship for issuing banks would have been within the contemplation of Visa and Fifth Third at the time of contracting. Finally, since Visa intended to give issuing banks like PSECU the benefit of Fifth Third’s performance, PSECU’s third-party-beneficiary status under the member’s agreement is established and PSECU can sue for breach of that contract. In moving to dismiss, Fifth Third argues that Plaintiff ignores three fatal defects in its third-party-beneficiary claim: (1) the member agreement does not express any intention to benefit PSECU; (2) the “intentions of the contracting parties, as disclosed by their contract, can be effectuated without recognition of PSECU’s alleged third-party-beneficiary rights”; and (3) the performance of the contract would not satisfy an obligation of the promisee, VISA, to pay money to PSECU. (Doc. 70, Def.’s Br. in Supp. p. 7.) 11 We reject these arguments. First, the member agreement does not have to express any specific intention to benefit PSECU as long as PSECU satisfies the second test for third-party-beneficiary status. Second, a third party’s rights under a contract are not determined by whether the intentions of the parties to the contract can be effectuated without recognition of the alleged third-party-beneficiary rights. Further, as noted above in our discussion *335 of Scarpitti, we can look beyond the contract to determine the parties’ purpose. Finally, PSECU does not rely upon an obligation of the promisee, VISA, to pay money to PSECU but on the intent of Visa, the promisee, to give PSECU the benefit of Fifth Third’s performance as promisor. Fifth Third has also cited a number of cases which it describes as having rejected claims by participants in the Visa system that they are third-party beneficiaries of the contracts between other participants in the system: Owner-Operator Indep. Drivers Ass’n, Inc. v. Concord EFS, Inc., 59 S.W.3d 63 (Tenn.2001)(rejecting cardholders’ claim of being third-party beneficiaries of contracts between acquiring banks and merchants to challenge merchants’ surcharges on credit-card fuel purchases); Cherry v. Bank of America, 90 Fed.Appx. 246, 247 (9th Cir.2004) (nonprecedential) (under Arizona law airline credit-card holder was not a third-party beneficiary of an agreement between the issuing bank and the airline to lower interest rates on the card after the cardholder received his card); American Express Travel Related Services Co. v. American Fine Art and Frame Co., 2004 WL 1144103 (N.D.Tex.2004) (a cardholder is not a third-party beneficiary of the agreement between the association creating the credit-card network and a merchant for his claim disputing a charge where “the agreement merely sets forth a procedure for resolving disputes over payment to the merchant”); Nova Info. Sys., Inc. v. Greenwich Ins. Co., 365 F.3d 996 (11th Cir.2004) (the entity that processes credit-card transactions as a subcontractor of an acquiring bank is not a third-party beneficiary of a surety-ship agreement between the merchant cruise line and its insurer guaranteeing reimbursement to cruise-line customers if the line failed to perform). Broadly speaking, Fifth Third may have correctly described these cases’ holdings, but as Plaintiff points out, none of them deal with the factual situation at hand. We have reviewed these eases and find them unhelpful for that reason. However, we will briefly mention why Owner-Operator, supra, does not persuade us. In Owner-Operator, the plaintiff tractor-trailer drivers filed suit contesting surcharges imposed by merchants on diesel-fuel purchases made with Visa and MasterCard credit cards. The cardholders claimed to be third-party beneficiaries of contracts between the acquiring banks and the merchants selling the fuel that required the merchants to abide by Visa and MasterCard regulations. Those regulations prohibited surcharges on credit-card purchases. The Tennessee Supreme Court rejected the claim, in part, because under Restatement section 302(l)(b) it decided that the prohibition on surcharges was not intended to benefit cardholders but to benefit the acquiring bank by encouraging card usage, thereby maximizing its profits. 59 S.W.3d at 73. Owner-Operator offers no guidance here because the regulation at issue is materially different. When an acquiring bank requires its merchants not to surcharge credit-card purchases, it is a reasonable conclusion that the bank intends to benefit only itself. Further, under Scarpitti, which does take into account the reaction of the potential third-party beneficiaries, the average cardholder probably does not even think about a no-surcharge provision. On the other hand, a requirement concerning the security of the basic transaction in a credit-card network would be intended to benefit more than just the acquiring bank, 12 and an issuing bank would consider *336 it of the upmost importance that a merchant be required to safeguard cardholder information. In conclusion, we agree with PSECU that it is a third-party beneficiary of the membership agreement between Visa and Fifth Third. As PSECU asserts, the underlying agreement between the promisor, Fifth Third, and its promisee, Visa, required Fifth Third to ensure that its merchants would abide by Visa’s operating regulations (specifically the operating regulation forbidding merchants from retaining customer information). The purpose of the agreement was to make the Visa network safe for issuing banks, either those already in the network or those contemplating joining it, by assuring them that their customer information will only be in a merchant’s possession long enough to make a transaction. 13 Thus, the third-party-beneficiary relationship for issuing banks was within the contemplation of Visa and Fifth Third at the time of contracting. Further, since Visa intended to give issuing banks like PSECU the benefit of Fifth Third’s performance, PSECU has third-party-beneficiary status under Fifth Third’s member agreement with Visa. We therefore deny the motion to dismiss PSECU’s contract claim against Fifth Third. 14 2. The Negligence Claim Fails. Fifth Third has moved to dismiss Plaintiffs negligence claim on the grounds that Fifth Third owed PSECU no duty of reasonable care, an essential element of a negligence claim, and that the economic loss doctrine, prohibiting recovery in negligence for economic losses absent physical harm to person or property, bars the claim. 15 The arguments the parties make are substantively similar to the ones made in connection with BJ’s invocation of the doctrine in moving to dismiss Plaintiffs negligence claim against it. Based on our discussion above of BJ’s motion, we dismiss the negligence claim against Fifth Third for the same reason. 16 3. PSECU Has No Equitable-Indemnification Claim Against Fifth Third. As it did against BJ’s, Plaintiff has made an equitable-indemnification claim against Fifth Third for the cost of replacing its customers’ cards. PSECU has alleged *337 that Fifth Third’s conduct “necessitated the replacement of PSECU’s members’ Visa cards,” that “PSECU replaced its members’ Visa cards to protect its legal rights and to fulfill a contractual obligation owed to its customers,” and that Fifth Third “benefited from PSECU’s replacement of PSECU’s customers’ Visa cards .... ” Plaintiff asserts that “[elquity demands” that Fifth Third “pay the costs of replacement of PSECU’s members’ Visa cards.” (Id. ¶¶ 69-72.) Fifth Third moves to dismiss this claim on several grounds, but we need consider only one, that PSE-CU has not alleged that it paid damages to a third party, a requisite element of an indemnification claim. As noted above with regard to BJ’s motion to dismiss, when one party must pay damages to another based on some legal obligation, common-law (equitable) indemnity permits that party to recover its payment from another person if the former’s liability is “secondary” to the “primary” liability of the latter. Sirianni v. Nugent Bros., Inc., 509 Pa. 564, 569-70, 506 A.2d 868, 870-71 (1986). But as Fifth Third argues, before one can be indemnified one has to have paid damages, but Plaintiff has not alleged that it paid any damages; only that it has fulfilled a contractual obligation to its customers by replacing their Visa cards, and incurring costs in doing so. We will therefore dismiss the equitable-indemnification claim against Fifth Third. 4. Plaintiff Fails to State an Unjust Enrichment Claim Against Fifth Third. PSECU claims that Fifth Third was unjustly enriched by Plaintiffs replacement of the compromised Visa cards because the replacement of the cards eliminated Fifth Third’s potential liability for fraudulent use of the card numbers. Under Pennsylvania law: To prevail on a claim for unjust enrichment, a plaintiff must prove: (1) benefits conferred on defendant by plaintiff; (2) appreciation of such benefits by defendant; and (3) acceptance and retention of such benefits under such circumstances that it would be inequitable for defendant to retain the benefit without payment of value. Temple University Hosp., Inc. v. Healthcare Management Alternatives, Inc., 832 A.2d 501 (Pa.Super.2003). Walter v. Magee-Womens Hosp., 876 A.2d 400, 407 (Pa.Super.2005). “The most important factor ... is whether the enrichment of the defendant is unjust.” Id. (quoted case omitted). A claim for unjust enrichment cannot be made simply because the defendant may have been benefited in some way. Id. In moving to dismiss the unjust enrichment claim, Fifth Third presents several arguments, but we need address only one, an argument that essentially duplicates one we accepted from BJ’s, that Plaintiffs replacement of the cards in fulfilling a contractual obligation to do so establishes that any benefit Fifth Third received was not unjust. In other words, no benefit was conferred because PSECU replaced the cards based on a contractual obligation to do so, see Allegheny Gen. Hosp., supra, 228 F.3d at 447, and consequently the unjust enrichment claim fails. C. Third-party Defendant, IBM’s, Motion for Reconsideration of Its Motion to Dismiss BJ’s Complaint Against It. As noted, BJ’s added International Business Machines Corporation (IBM), the supplier of the software BJ’s used to process transactions, as a third-party defendant, alleging that IBM’s software failed to comply with BJ’s request that it not retain card numbers. The third-party complaint *338 sought recovery from IBM of whatever damages PSECU recovered from BJ’s. On IBM’s motion to dismiss, we allowed BJ’s to seek recovery of the value of the compromised bank cards as blanks. See Pennsylvania State Employees Credit Union v. Fifth Third Bank, 2005 WL 1154594 (M.D.Pa.2005). IBM has moved for reconsideration of that ruling, seeking complete dismissal of the complaint against it. We will dismiss sua sponte the third-party complaint against IBM. Based on our analysis above, none of PSECU’s claims against BJ’s survives BJ’s motion to dismiss. Since BJ’s complaint against IBM seeks recovery only of damages that PSECU might recover against BJ’s, and PSECU’s complaint against BJ’s will be dismissed, BJ’s third-party complaint against IBM should also be dismissed. IBM’s motion for reconsideration will therefore be dismissed as moot. V. Conclusion. Based on the forgoing, all four counts against BJ’s for breach of contract, negligence, equitable indemnification, and unjust enrichment will be dismissed. The contract claim against Fifth Third will survive but the remaining counts, negligence, equitable indemnification, and unjust enrichment will be dismissed. We will issue an appropriate order. ORDER AND NOW, this 18th day of October, 2005, it is ordered that: 1. The motion (doc. 68) of defendant BJ’s to dismiss the complaint against it is granted and BJ’s is hereby dismissed from this action. 2. The motion (doc. 66) of defendant Fifth Third Bank to dismiss the complaint against it is granted only as to counts III, VI and VIII and the motion is denied as to count I, the contract claim. 3. Defendant BJ’s third-party complaint (doc. 21) against International Business Machines Corporation (IBM) is hereby dismissed. 4. Third-party defendant IBM’s motion for reconsideration (doc. 51) is dismissed as moot. Footnotes [1] Sovereign Bank also had customer bankcard numbers stolen and has filed a similar suit against BJ's and Fifth Third Bank Corp., an affiliate of Fifth Third Bank, Sovereign Bank v. BJ’s Wholesale Club, Inc., No. 1:CV-05-1150, 2005 WL 2916568 (M.D.Pa.) (Caldwell, J.). Many of the issues are similar. [2] The amended complaint also bases a contract claim against BJ’s on an alleged contract between BJ's and Visa. (Doc. 61, Am. Compl. ¶¶ 47 and 50.) However, Plaintiff has not pursued this theory in the face of the two contracts BJ’s has submitted as the only contractual relationships it has as part of the Visa system. [3] The agreements provide that they ghall be “governed, construed and enforced” under Ohio law. In a diversity case, a federal court applies the law of the state where it sits, including its choice-of-law rules. J.C. Penney Life Ins. Co. v. Pilosi, 393 F.3d 356, 360 (3d Cir.2004). Generally, Pennsylvania will enforce choice-of-law provisions in contracts. Echols v. Pelullo, 377 F.3d 272, 275 (3d Cir.2004). Hence, we apply Ohio law to the contract claim. In any event, we see no conflict between Pennsylvania and Ohio law on the third-party-beneficiary issue. [4] Section 766C, captioned “Negligent Interference with Contract or Prospective Contractual Relation,” reads as follows: One is not liable to another for pecuniary harm not deriving from physical harm to the other, if that harm results from the actor's negligently (a) causing a third person not to perform a contract with the other, or (b) interfering with the other's performance of his contract or making the performance more expensive or burdensome, or (c) interfering with the other's acquiring a contractual relation with a third person. [5] We have already decided that Plaintiff has no contract claim against BJ's, but this makes Plaintiff's argument even more important to its case. [6] BJ's also argues that the gist of the action doctrine bars the negligence claim. We disagree. That doctrine only applies when the plaintiff and the defendant have a contract, see eToll, Inc. v. Elias/Savion Advertising, Inc., 811 A.2d 10, 14 (Pa.Super.2002)(''To permit a promisee to sue his promisor in tort for breaches of contract inter se would erode the usual rules of contractual recovery and inject confusion into our well-settled forms of actions.''), and we have decided there is no contract between PSECU and BJ's. [7] We note, however, that Defendant's notice argument is not persuasive. EPCO Importers, supra, 500 F.Supp. 152, and Aloe Coal Co., supra, 164 Pa.Cmwlth. 453, 643 A.2d 757, are factually distinguishable. [8] Fifth Third asserts that Ohio law controls the interpretation of its contract with Visa and PSECU's contract claim but also takes the position that there is no conflict between Ohio and Pennsylvania law dealing with third-party beneficiaries. It cites Pennsylvania cases along with Ohio ones. We therefore also rely on Pennsylvania cases. [9] This summary incorporates the substance of Section 302(1), which reads as follows: (1) Unless otherwise agreed between promisor and promisee, a beneficiary of a promise is an intended beneficiary if recognition of a right to performance in the beneficiary is appropriate to effectuate the intentions of the parties and either (a) the performance of the promise will satisfy an obligation of the promisee to pay money to the beneficiary; or (b) the circumstances indicate that the promisee intends to give the beneficiary the benefit of the promised performance. [10] In fact, PSECU argues that Fifth Third also intended to give it the benefit of its performance (id.., at p. 9), but we need not rely on that on this part of the test. [11] Defendant has also framed this as a pleading argument, that PSECU failed to plead these necessary factual averments. However, notice pleading is used in federal courts, see Fed.R.Civ.P. 8(a), not fact pleading. [12] While the acquiring bank in Owner-Operator was able to proffer an alternative purpose *336 for the regulation challenged there, Fifth Third has not offered an alternative explanation of the purpose of the requirement that a merchant not retain cardholder information nor has it said who benefits from this provision, other than the issuing bank. [13] Scarpitti permits the court to make this inference of purpose as a matter of law. [14] We note that in responding to PSECU’s argument that there is no alternative-dispute-resolution procedure to its breach-of-contract claim, Fifth Third argues that Visa regulations provide a compliance procedure for resolving members’ financial disputes. (Doc. 75, Def.’s Reply Br. at p. 5.) At least one court has denied third-party-beneficiaiy status based in part on enforcement procedures found in the contract. See Register.Com, Inc. v. Verio, Inc., 356 F.3d 393 (2d Cir.2004). We do not consider it here because Fifth Third has not directly argued that PSECU’s third-party-beneficiaiy status is defeated by the operating regulations’ dispute-resolution procedure, and it was raised for the first time in the reply brief. [15] Fifth Third asserts that the negligence claim is also governed by Ohio law but again takes the position that there is no conflict between Ohio and Pennsylvania law and cites case from both jurisdictions. [16] We only add that Ohio has adopted the economic loss doctrine. See Laurent v. Flood Data Services, Inc., 146 Ohio App.3d 392, 766 N.E.2d 221, 227 (2001).