Differing district court opinions make it difficult to prepare for email fraud.
Large companies with significant cash flows are increasingly the target of criminals who represent, via email, that they are the president of the company requesting that employees send large sums of money to fraudulent accounts. Contractors should take note.
James Vorhis, in a sobering article in NOSSAMAN’s INSURANCE RECOVERY REPORT, discusses this issue.
Obtaining meaningful insurance coverage for “’fake president’ fraud, which is also known as business e-mail compromise, or social engineering fraud” is problematic because the coverage is based upon the definition of a “fraudulent entry or changing of data in the policyholder’s computer system.” What this phrase means is problematic.
Mr. Vorhis details two court cases that illuminate this problem.
In Medidata Solutions, Inc. v. Federal Ins. Co., Case No. 15-CV-907 (S.D.N.Y. July 21, 2017), “a fraudster imitating the president of Medidata Solutions, Inc. directed an employee in the accounts payable department to wire money overseas for a company acquisition.” After performing standard due diligence to determine this transaction was authorized by the company president, the employee wired $4.8 million dollars.
Medidata’s insurance policy contained “a computer fraud provision” that provided protection for a fraudulent entry in the company’s computer system. Upon appeal, the District Court ruled “that the entry was indeed fraudulent because the fraudster used a computer code to alter a series of email messages to make them appear as if they originated from the company’s president.” The Court ruled in favor of the insured.
In American Tooling Center, Inc. v. Travelers Casualty and Surety Co., Case No. 5:16-cv-12108, 2017 U.S. Dist. Lexus 120473 (E.D. Mich. Aug. 1, 2017), the key provision in the insured’s computer fraud provision was also the definition of “direct loss resulting from the use of ‘any computer’ to ‘fraudulently cause’ a ‘direct loss’ by money transfer.”
The court ruled in favor of the insurer, based upon facts almost identical to those in Medidata, “because it found that the term ‘direct loss’ was synonymous with the term immediate, and there were steps in between the fraudulent emails and the wiring of the money.”
Two cases with similar facts resulted in “opposite holdings.” This places contractors in a difficult situation. Mr. Vorhis’ advises business owners to have the computer fraud provisions of their insurance policies carefully reviewed by an attorney or insurance broker.
Source—
Two Court Rulings Show Coverage Difficulties for “Fake President” Fraud, James Vorhis, NOSSAMAN’s INSURNACE RECOVERY REPORT, Aug. 2, 2017.