Social engineering fraud, or as it is sometimes called, business instruction fraud, has unfortunately become all too common. In many instances, the defrauded companies’ losses are huge. In a recent insurance coverage dispute, the social engineering fraud loss involved was not as large as some of the others have been. Unfortunately, and notwithstanding the relatively small size of the loss, the court concluded that coverage for the company’s loss was precluded by the “voluntary parting” exclusion in its crime policy. As discussed below, there are still some lessons to be drawn from this case. Eastern District of Virginia Judge John A. Gibney, Jr.’s February 20, 2020 opinion in the case can be found here.
Continue Reading “Voluntary Parting” Exclusion Precludes Coverage for Social Engineering Fraud Loss
11th Circuit: Crime Policy Covers Payment Instruction Fraud Loss
Earlier this week, I published a post noting the challenges policyholders can face in establishing coverage under traditional crime and cyber liability insurance policies for losses arising from “payment instruction fraud” (sometimes called “social engineering fraud). I also discussed the recent availability of sublimited coverage extensions for these kinds of losses. In response to my earlier post, several readers sent me messages noting that several courts have, in fact, found coverage under commercial crime policies for payment instruction fraud losses. As if to prove their point, the same day as I published my post, the 11th Circuit issued an opinion affirming a district court ruling that a firm’s payment instruction fraud losses are covered under the “fraudulent instruction” provisions of the applicable commercial crime policy. The 11th Circuit’s December 9, 2019 opinion can be found here.
Continue Reading 11th Circuit: Crime Policy Covers Payment Instruction Fraud Loss
Payment Instruction Fraud and Cyber Insurance Coverage
As I have noted in prior posts, a recurring challenge many organizations face these days is the threat of “payment instruction fraud,” also sometimes called “social engineering fraud” or “payment impersonation fraud.” In these schemes scammers use official-seeming email communications to induce company employees to transfer company funds to the imposters’ account. Among the many issues arising when these kinds of scams occur is the question of insurance coverage for the loss. Some victims may expect that their cyber liability insurance will cover their loss.
However, as Lauri Floresca of Woodruff-Sawyer points out in her December 5, 2019 post on her firm’s blog entitled “Payment Impersonation Fraud: Why is This Common Cyber Problem Not a Valid Cyber Claim” (here), these claims rarely involve the kind of cyber security breach required to trigger cyber insurance coverage. Accordingly, there are other steps well-advised companies may want to take to try to protect themselves from these kinds of losses.
Continue Reading Payment Instruction Fraud and Cyber Insurance Coverage
Insurer’s Bid to Dismiss Complaint Seeking Coverage for Payment Instruction Loss Denied
One of the more challenging issues businesses must confront as wrongdoers have turned Internet tools into criminal devices has been the rising threat of payment instruction fraud, or, as it is sometimes called, social engineering fraud. Along with these crimes have come vexing questions of insurance coverage for the ensuing losses. Courts have struggled to determine whether or not payment instruction fraud losses are covered under Crime policies. A recent case in the Southern District of New York raises the question whether a payment instruction fraud loss is covered not under a Crime policy but rather under insurance policy containing both E&O and Cyber coverages.
Continue Reading Insurer’s Bid to Dismiss Complaint Seeking Coverage for Payment Instruction Loss Denied
SEC Warns of Need for Internal Controls to Prevent Cyberscams
The threat of cyberscams in the form of what has been called “social engineering fraud” or “payment instruction fraud” has become pervasive. In these swindles, imposters posing as senior corporate executives or company vendors direct company personnel to transfer funds to accounts that the imposters control. Losses from these frauds can be substantial, and, as I have noted on prior posts on this site, the insurance coverage questions these losses present can be challenging. Earlier this week, the SEC released an investigative report taking a look at what the agency called “business email compromises” at nine different public companies. The report underscores the need for companies to take cyber threats into account when implementing internal accounting controls. The report has some interesting insurance underwriting implications as well. The SEC’s October 16, 2018 press release about the report can be found here.
Continue Reading SEC Warns of Need for Internal Controls to Prevent Cyberscams
Insurer Seeks Rehearing of Ruling That Payment Instruction Fraud is Covered
The insurer on the receiving end of the recent Sixth Circuit ruling that the a payment instruction fraud loss is covered under the Computer Fraud section of a Commercial Crime policy has filed a petition for rehearing or rehearing en banc. In its July 27, 2018 petition (here), the insurer contends that in its decision, the Sixth Circuit’s analysis was at odds with its own prior precedent, and as a result the appellate court applied the wrong causation analysis in determining whether or not the fraudulent email “directly” caused the loss of the policyholder, American Tooling Center (ATC).
Continue Reading Insurer Seeks Rehearing of Ruling That Payment Instruction Fraud is Covered
6th Circ.: Crime Policy’s Computer Fraud Section Covers Email Scheme Losses
In the second policyholder-favorable federal appellate court decision on the issue in a matter of days, the Sixth Circuit has held that the Computer Fraud provisions of a commercial crime policy cover a company’s losses from an email payment instruction fraud scheme. Just last week, the Second Circuit ruled in the Medidata case that Computer Fraud coverage applied to losses incurred in a similar email scam. However, the Sixth Circuit’s decision may be even more helpful for policyholders as, unlike the Second Circuit’s decision, the policyholder-favorable ruling is not as dependent on very specific factual determinations about the way the fraudster manipulated the harmed company’s email program. The Sixth Circuit’s July 13, 2018 decision in the American Tooling Center (ATC) opinion can be found here.
Continue Reading 6th Circ.: Crime Policy’s Computer Fraud Section Covers Email Scheme Losses
Second Circuit: Computer Fraud Coverage Section Covers Fraudulent Email Funds Transfer
In a much anticipated decision, on July 6, 2018 the Second Circuit, applying New York law, affirmed a district court ruling that the computer fraud provisions of a commercial crime coverage section covered the losses Medidata incurred when the company’s employees transferred funds in response to a spoofed email. The appellate court’s opinion could prove valuable for other policyholders seeking to establish that their crime policies provide coverage for losses incurred as a result of social engineering fraud (also known as payment instruction fraud). The Second Circuit’s July 6, 2018 opinion can be found here.
Continue Reading Second Circuit: Computer Fraud Coverage Section Covers Fraudulent Email Funds Transfer
Ninth Circuit: No Crime Policy Coverage for Social Engineering Fraud Losses
Along with all of the other risks arising from companies’ increasing dependence on electronics communications and data storage technology has come not only the risks of a data breach caused by a hacker, but also the risk of a company’s transfer of funds by one of its employees who has been duped into believing the transfer was legitimate and authorized. These kinds of losses, which have been called “payment instruction fraud” or “social engineering fraud,” raise of a host of potential issues under traditional insurance policies, owing to the voluntary nature of the funds transfer made by a person authorized to access the company’s computer system. A recent decision by the Ninth Circuit illustrates the kinds of coverage problems that can arise from these circumstances. The Ninth Circuit’s unpublished April 17, 2018 opinion in Aqua Star (USA) Corp. v. Travelers Casualty & Surety Company of America can be found here. The Wiley Rein’s law firm’s April 19, 2018 post about the Ninth Circuit decision can be found here.
Continue Reading Ninth Circuit: No Crime Policy Coverage for Social Engineering Fraud Losses
Guest Post: Groundbreaking Cyber Insurance Decision
Over the last several days, I have published several posts discussing important insurance developments relating to social engineering fraud, sometimes called payment instruction fraud. In the following guest post, Peter S. Selvin of the TroyGould PC law firm takes a detailed look at one of these recent decisions, the July 2017 decision in the Southern District of New York involving Medidata (discussed here), and compares it to the subsequent American Tooling Center decision out of the Eastern District of Michigan (discussed here). A version of this article previously appeared in the San Francisco Daily Journal. I would like to thank Peter for his willingness to publish his article as a guest post on this site. I welcome guest post submissions from responsible authors in topics of interest to this site’s readers. Please contact me directly if you would like to submit a guest post. Here is Peter’s article.
Continue Reading Guest Post: Groundbreaking Cyber Insurance Decision