Source: http://programs.amwins.com/insights/article/social-engineering-an-increasing-risk-that-requires-increased-coverage_1-19
Timestamp: 2019-04-26 14:26:29+00:00

Document:
Organizations of all sizes, across all regions, and in all business sectors face an evolving risk from cyber criminals.1 As businesses have become increasingly dependent upon technology, criminals have shifted from theft of physical assets to the theft of electronic information. The growing use of technology-enabled processes exposes businesses to cybercrime -- from direct theft of data (leading to the potential loss of financial assets) to the theft of personal data (that can be used to assemble an attack on financial assets). Cybercrime can threaten processes from point-of-sale purchases by debit/credit cards in the retail environment, to ATM transactions in the banking environment, to e-commerce or on-line sales, and to electronic business communications.
Recent studies illustrate the wide-ranging threat of electronic crime. In 2017, more than three of four (78%) respondents to the U.S. State of Cybercrime Survey detected security events in the preceding twelve months, and more than one third (36%) reported that the number of security incidents had increased over the previous year. The average number of incidents is also significant, with increasing monetary loss.
While cyber criminals employ several measures to breach information security defenses and seize sensitive business information, technical security measures implemented in response to increased regulation (as a result of Sarbanes-Oxley, Gramm-Leach-Bliley, and the Health Insurance Portability and Accountability Act) make direct pure technological attacks more difficult and costly.
As a result, cyber criminals have shifted their focus away from such pure technological attacks and instead have increasingly attacked employees through the use of “social engineering” – a collection of techniques used to manipulate people into performing actions or divulging confidential information. Social engineering is not a new concept. A social engineer is nothing more than a con man who uses technology to swindle people and manipulate them into disclosing passwords or bank information or granting access to their computer.
Many businesses mistakenly believe that traditional commercial crime policies cover all cyber-related losses. Although traditional commercial crime policies contain a computer fraud and funds transfer fraud insuring agreement, courts interpreting such policies have generally distinguished between incidents (1) where a thief hacks the insured’s computer systems and, without any action by the insured, uses the computer to steal the insured’s property (either directly by transferring funds using the insured’s computer system or by convincing the insured’s bank to transfer the insured’s funds) and incidents (2) where the insured voluntarily transfers funds.
Depending upon the precise terms and conditions of the coverage provided, courts have generally held that the latter claims – many of which arise from social engineering – are not covered.
As the cases referenced explain, the computer crime insuring agreement and funds transfer fraud insuring agreement incorporated into standard commercial crime policies are designed to cover certain types of hacking incidents, not loss resulting from the insured’s conscious decision to proceed with a business transaction (even if induced by a fictitious or fraudulent computer submission). An insured seeking to cover the risk of loss from social engineering should consider insurance policies tailored to address such risks.
Subject to specific terms of coverage within the policy, social engineering coverage expands coverage traditionally afforded under commercial crime policies to address schemes arising from the impersonation of vendors, executives, and clients. Combined with strong internal controls, such coverage enables companies to better protect themselves against the growing risk of a catastrophic loss from social engineers.
Such coverage can be endorsed onto either a commercial crime policy or a cyber insurance policy. Because commercial crime policies are oriented toward covering first-party loss, an insured may prefer to endorse social engineering coverage to that policy while preserving the liability coverage afforded under a cyber policy in the event of a breach which results in substantial liability exposure.
The Professional Lines specialists at AmWINS, in partnership with AXIS Insurance Company, a leading Crime insurance carrier, have developed a solution specifically tailored to address losses from social engineering attacks. This solution offers limits up to $10M for social engineering (subject to underwriting criteria), policy language that responds to social engineering fraud losses, and free social engineering training for employees, as well as a significant discount for higher level training from the world’s largest security awareness training provider.
In the second part of our series, we will identify examples of schemes employed by social engineers and how to design and implement comprehensive security practices to mitigate the risk of a loss.
1 Recent studies illustrate the wide-ranging threat of electronic crime. 2014 U.S. State of Cybercrime Survey, available at http://www.pwc.com/us/en/increasing-it-effectiveness/publications/2014-us-state-of-cybercrime.jhtml (last visited September 3, 2014).
3 Taylor & Lieberman v. Fed. Ins. Co., 2017 U.S. App. LEXIS 4205, *3-4 (9th Cir. Mar. 9, 2017); Apache v. Great Am. Ins., 662 F. App’x 252, 258-59 (5th Cir. 2016); Kraft Chem. Co. v. Fed. Ins. Co., 2016 Ill. Cir. LEXIS 1, at *17 (Ill. Cir. Ct. Jan. 5, 2016); Universal Am. Corp. v. Nat’l Union, 959 N.Y.S.2d 849, 853 (Sup. Ct. 2013), aff’d, 972 N.Y.S.2d 241, 242 (App. Div. 2013), aff’d, 37 N.E.3d 78, 81 (N.Y. 2015); Great American Ins. Co. v. AFS/IBEX Fin. Servs., Inc., No. 07-cv-924, 2008 U.S. Dist. LEXIS 55532 at *45 (N.D. Tex., July 21, 2008); Pinnacle Processing Group, Inc. v. Hartford Cas. Ins. Co., 2011 U.S. Dist. LEXIS 128203, 2011 WL 5299557 (W. D. Wash. Nov. 4, 2011).
4 Pinnacle Processing Group, Inc. v. Hartford Cas. Ins. Co., 2011 U.S. Dist. LEXIS 128203, 2011 WL 5299557 (W. D. Wash. Nov. 4, 2011) (rejecting the insured's contention that computer fraud coverage is implicated simply because a computer was used in the scheme).
5 Brightpoint, Inc. v. Zurich Am. Ins. Co., No. 1:04-CV-2085, 2006 U.S. Dist. LEXIS 26018 (S.D. Ind. Mar. 10, 2006).
6 Id.; see also Pestmaster Serv. v. Travelers Cas. & Sur. Co. of Am., CV 13-5039-JFW, 2014 U.S. Dist. LEXIS 108416 (C.D. Ca., July 17, 2014).
7 Taylor, 2017 U.S. App. LEXIS 4205 at *3.
8 268 F. Supp. 3d 471 (S.D.N.Y. 2017), aff’d, 729 Fed. Appx. 117 (2d Cir., July 6, 2018).
9 Id., 268 F. Supp. 3d at 480.
11 Id. at 118; see also American Tooling Center, Inc. v. Travelers Casualty and Surety Company of America, 2018 U.S. App. LEXIS 19208 (6th Cir., July 13, 2018) (finding coverage under policy coverage “use of any computer to fraudulent cause a transfer of Money, Securities or other Property….”, on the theory that transmittal of email involved the use of a computer).
12 Id., 268 F. Supp. 3d at 480.
14 Apache, 662 F. App’x at 254. Principle v. Ironshore, 2016 WL 4618761 (N.D. Ga. 2016) cited the district court’s decision Apache v. Great Am. Ins., 2015 U.S. Dist. LEXIS 161683 (S.D. Tex. Aug. 7, 2015). The district court’s decision in Apache was subsequently reversed by the Fifth Circuit (662 F. App’x 252, 258-59 (5th Cir. 2016)). Principle is currently on appeal.
16 Black’s law dictionary defines a “fraudulent act” as “[c]onduct involving bad faith, dishonesty, a lack of integrity, or moral turpitude.” Black’s Law Dictionary 687 (8th ed. 1990). This definition requires proof of an intent to deceive: “mere irregularities committed without such intent do not constitute acts of fraud or dishonesty.” 13 Couch, Insurance 2d, § 46:55, p 58.
17 Sb1 Fed. Credit Union v. FinSecure, LLC, NO. 13-6399, 2014 U.S. Dist. LEXIS 49596 (E.D. Pa. Apr. 9, 2014); Morgan Stanley Dean Witter & Co. v. Chubb, 2005 N.J. Super. Unpub. LEXIS 798 (N.J. App. Div. Dec. 2, 2005); Northside Bank v. American Cas. Co. of Reading, No. GD 97-19482, 2001 WL 34090139 (Pa. Commw. Pl. Jan. 10, 2001).

References: v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 § 46
 v. 
 v. 
 v.