Source: https://propertycasualtyfocus.com/ninth-circuit-upholds-authorized-use-exclusion/
Timestamp: 2019-04-21 20:37:45+00:00

Document:
Losses from social engineering schemes continue to grow exponentially. According to FBI data published in early 2017, losses from these schemes totaled over $3 billion between 2013, when the FBI started tracking data, and the end of 2016. One recent estimate suggests projected growth to over $9 billion in 2018 alone. The problem is not going away; it’s getting much, much worse.
Carried out by transnational criminal organizations that employ lawyers, linguists, hackers, and social engineers, BEC can take a variety of forms. But in just about every case, the scammers target employees with access to company finances and trick them into making wire transfers to bank accounts thought to belong to trusted partners – except the money ends up in accounts controlled by the criminals.
These schemes often involve, but don’t exclusively rely on, the use of email specifically or computer systems generally. This facet of the scheme is at the heart of the coverage issues with which courts have struggled over the last couple years, because the fraudster is not so much using a computer, as they are using a human dupe, who then conducts authorized, non-fraudulent uses of a computer (or phone, etc.), unwittingly furthering the fraud.
Because wire transfers are the predominant focus of these schemes, financial institutions are uniquely vulnerable. Many financial institutions have looked to their insurers to cover losses from social engineering schemes under the “computer fraud” coverage of crime/fidelity/financial institution bonds. This has become one of the most hotly litigated “cyber” coverage issues, and the results are decidedly mixed.
One thing the coverage litigation has made clear is that computer fraud coverage was created long before the social engineering schemes that have recently garnered so much attention. Given the patchwork of coverage law that continues to evolve on the issue, policyholders, brokers, and insurers should carefully consider coverage for this particular risk. For policyholders, it is important to be up front, asking specifically about coverage for social engineering losses. Brokers should carefully follow the ever-changing landscape of coverage litigation on this issue to ensure they give policyholders the most up-to-date advice. The recent Ninth Circuit decision serves as a conspicuous reminder that precise policy language is necessary for the insurer and the insured to determine the scope of the coverage intended with respect to these risks, and if an insurer does not intend to cover social engineering loss under the computer fraud coverage of crime/fidelity policies, it should consider explicitly excluding the risk.
What is Computer Fraud Coverage Under a Fidelity Bond?
Typically, the computer fraud coverage in a fidelity policy covers loss “resulting directly” from the fraudulent use of or “change” to a computer system to cause a transfer of funds to an outside entity, or to cause some other defined fraud loss.
Consistent with this analysis, the Eighth Circuit Court of Appeals held that a direct hack of the insured bank’s computer network by an unauthorized (and unknown) user that resulted in the wiring of funds to a foreign account set up by the hacker was covered under the computer fraud coverage of its financial institution bond. See State Bank of Bellingham v. BancInsure, Inc., 823 F.3d 456 (8th Cir. 2016).
While the foregoing appellate cases provide some guidance, neither involved social engineering schemes. One of the first cases to deal with the issue was Apache Corp. v. Great Am. Ins. Co., No. 4:14-CV-237 (S.D. Tex. Aug. 7, 2015). The court addressed a typical social engineering scheme, by which the insured suffered $2.4 million in losses before it was detected. The court held that this was covered, because the fraudster’s scheme was perpetrated, in part, through the insured’s computer network, insofar as it involved email.
The decision was later cited favorably in Principle Solutions Group, LLC v. Ironshore Indem., Inc., No. 1:15-CV-4130-RWS (N.D. Ga. Aug. 30, 2016), where an insured suffered a $1.7 million loss from a similar scheme, and the court likewise held it was covered under a computer systems fraud rider.
The Policy defines Computer Fraud as “[t]he use of any computer to fraudulently cause a transfer….” Because computers are used in almost every business transaction, reading this provision to cover all transfers that involve both a computer and fraud at some point in the transaction would convert this Crime Policy into a “General Fraud” Policy. While [the insurer] could have drafted this language more narrowly, we believe protection against all fraud is not what was intended by this provision, and not what [the policyholder] could reasonably have expected this provision to cover.
Citing the Ninth Circuit decision, the Fifth Circuit followed suit and reversed the Texas ruling in Apache, finding no coverage. Like the Ninth Circuit, the Fifth Circuit pointed out the ubiquity of electronic communication. “[W]hen the policy was issued in 2012, electronic communications were, as they are now, ubiquitous, and even the line between ‘computer’ and ‘telephone’ was already blurred. In short, few – if any – fraudulent schemes would not involve some form of computer-facilitated communication.” Apache Corp. v. Great Am. Ins. Co., 662 Fed. Appx. 252 (5th Cir. Oct. 18, 2016).
Unsurprisingly, the Fifth Circuit’s decision was cited by the insurer in a motion for reconsideration in the Georgia Principle Solutions case, and was cited by the insurer in a similar case pending at the time in New York federal court. In the meantime, the Ninth Circuit reaffirmed its position in another order finding no coverage for a social engineering loss. See Taylor & Lieberman v. Federal Ins. Co., 681 Fed. Appx. 627 (9th Cir. 2017).
Nevertheless, what appeared to be a developing trend has been thrown into considerable doubt by some recent district court rulings, and appeals on this coverage issue are pending in the Second, Sixth, and Eleventh Circuits.
In American Tooling Center, Inc. v. Travelers Cas, & Surety Co. of Am., No. 16-12108 (E.D. Mich., Aug. 1, 2017), a Michigan federal court followed what appeared to be the developing trend after the Fifth and Ninth Circuit’s guidance discussed above. In American Tooling, the court similarly held there was no coverage under the computer fraud provision of a fidelity policy for a scheme where the insured’s VP received instructions to change the wiring of payment for legitimate invoices to a new bank account. The policyholder has appealed and that decision is now pending in the Sixth Circuit Court of Appeals.
On the other hand, a district court in New York made waves in finding coverage for a similar scheme. See Medidata Solutions, Inc. v. Federal Ins. Co., No. 15-CV-00907 (S.D.N.Y. July 21, 2017). In this long, winding saga, and after the court called for supplemental summary judgment briefing with expert analyses on the inner-workings of email technology, the court found coverage for a social engineering scheme under a computer fraud rider. The insurer appealed, and the appeal remains pending in the Second Circuit.
In Principle Solutions, discussed above, after reconsideration based on the insurer’s submission of supplemental authority from the Fifth and Ninth Circuit cases, the court nevertheless maintained its ruling in favor of coverage for a social engineering scheme under the insured’s commercial crime policy, specifically distinguishing Apache and Pestmaster.
One of the defendant insurer’s arguments in Principle Solutions was that the company had separate coverage available for “Cyber Deception” which it contended was designed for the type of scheme at issue, and which the insured had declined to purchase. The court gave that argument short shrift, finding that language from an insurance policy not at issue was not relevant and, therefore, inadmissible at the summary judgment stage. The insurer appealed, and the case is pending in the Eleventh Circuit.
As we anxiously await those rulings, the Ninth Circuit has again spoken on this issue, and is again ahead of the curve. In Aqua Star (USA) Corp. v. Travelers Casualty & Surety Co., No. 16-35614 (9th Cir. April 17, 2018), the court reviewed a Washington federal district court decision. In that case, the plaintiff, Aqua Star, a Seattle-based seafood company, sued its crime insurer, alleging it must cover losses the company suffered when it was manipulated into wiring funds to a fraudster who posed as a vendor in emails, arguing, as other policyholders have, that its crime policy does not limit coverage to direct hacking incidents. Rather, it asserted that the computer fraud provision in its crime policy extended coverage to scenarios where the policyholder was fraudulently induced into sending money to a criminal.
So what are the lessons in all of this? What are insurers, policyholders, and/or brokers to do? First, social engineering fraud will only continue to increase in complexity and frequency. Every company in the market for insurance coverage should inquire specifically about coverage for social engineering schemes. A sublimit can provide some clarity for insurers and insureds.
For insurers, establishing a sublimit may reduce the risk to the extent that any questions arise in connection with a loss involving a social engineering scheme. For insureds, a sublimit should put them on notice that they have limited coverage for such risks, and if they desire coverage for social engineering schemes they will need a cyber policy to complement their fidelity coverage. Second, brokers should continue to keep abreast of the ever-changing coverage landscape in this arena to ensure they are giving policyholders accurate, up-to-date advice and meeting their insureds’ needs. Third, it may not be enough for insurers to simply point to the availability of standalone cyber coverage specifically designed for social engineering losses, as the insurer in Principle Solutions learned. Rather, a more prudent approach may be to exclude social engineering fraud explicitly from the computer fraud coverage grant altogether, while the courts continue to struggle with the issue.
Republished with permission from Law360. View original publication here.

References: v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v.