• Abstract and Figures
• Public Full-text

MEALEY’S 1 Emerging Insurance Disputes Email Phishing Scams And Computer Fraud Coverage: Causation Is Key by Karen Cestari and Bryce Friedman Simpson Thacher & Bartlett LLP New York, NY A commentary article reprinted from the March 19, 2020 issue of Mealey’s Emerging Insurance Disputes 1 MEALEY’S Emerging Insurance Disputes Vol. 25, #6 March 19, 2020 Commentary Email Phishing Scams And Computer Fraud Coverage: Causation Is Key By Karen Cestari and Bryce Friedman [Editor’s Note: Bryce Friedman is a Partner at Simpson email domain names are nearly identical to those of the Thacher & Bartlett LLP and is based in the Firm’s New legitimate parties. By the time the scam is discovered, York office. He advises clients in complex disputes, trials and the fraudulently-induced wire transfers have been effec- arbitrations, and devotes a significant part of his practice tuated and the devastating financial losses are often to representing members of the insurance and reinsurance unrecoverable. As such, victims of such phishing scams industries in litigated matters. Karen Cestari is an Attorney routinely seek insurance coverage for unrecovered losses. at Simpson Thacher & Bartlett LLP and is based in the Firm’s New York office. She focuses on insurance and rein- In the past few years, a body of case law that addresses surance law. Any commentary or opinions do not reflect the scope of insurance coverage for such incidents has the opinions of Simpson Thacher & Bartlett LLP or Lex- begun to develop. More specifically, several federal dis- isNexis1, Mealey Publicationsä.Copyright# 2020 by trict and appellate courts have addressed the parameters Simpson Thacher & Bartlett LLP. Responses are welcome.] of coverage for phishing schemes under a Computer Fraud provision. This emerging area of insurance law Cybercrime is big business, and showing no signs of suggests that the determinative issue in many such cyber slowing down. Companies, both large and small, are coverage disputes is the causal connection (or lack falling victim to cyberattacks that frequently result in thereof) between the use of a computer and the ensuing significant expense. According to one source, cyber- financial loss. More specifically, courts have focused related crimes accounted for approximately $2 trillion on whether and under what circumstances a fraudu- in loss last year, and are likely to reach the $6 trillion lently-induced wire transfer or other monetary loss is mark by 2021.1 Email phishing scams, in particular, deemed to have resulted ‘‘directly’’ from computer use. have become an increasingly common means for hack- As discussed more fully below, when the factual record ers to fraudulently obtain funds from unsuspecting establishes that one or more intervening steps have companies. In many such schemes, the target company occurred between the initial computer contact and receives an email from an entity purporting to be from the subsequent loss of funds, courts are likely to deny a legitimate source, such as a trusted customer or long- coverage based on the absence of direct causation. Con- standing vendor. The email, which in actuality is sent versely, where the connection between the original from a fraudulent hacker, typically informs the target phishing email (or other cyber intrusion) and the con- company that banking or routing information has sequent transfer of funds is deemed direct and unin- changed and provides new instructions for upcoming terrupted, the causation requirement inherent in most payments. In some scenarios, the email appears to be Computer Fraud provisions is deemed satisfied. from a company executive, and directs an employee to follow forthcoming payment instructions relating Computer Fraud Provisions to a purported company transaction. Hackers have While specific Computer Fraud provisions vary by pol- become increasingly sophisticated, such that imposters’ icy, most provisions include language requiring direct 1 1 Vol. 25, #6 March 19, 2020 MEALEY’S Emerging Insurance Disputes causation between the use of a computer and the mone- The Computer Fraud provision provided coverage for tary loss. One common iteration provides coverage ‘‘direct loss of Money, Securities or Property ...result- for the ‘‘loss of ... money ... resulting directly from ing from Computer Fraud.’’ Computer Fraud, in turn, the use of any computer to fraudulently cause a transfer was defined as the ‘‘unlawful taking or the fraudulently of that property from inside the premises or banking induced transfer of Money, Securities or Property result- premises ...[t]o a person ...outside those premises.’’ ing from a Computer Violation.’’ According to the pol- Other Computer Fraud provisions cover ‘‘loss resulting icy, Computer Violation means ‘‘the fraudulent: (a) entry directly from a fraudulent instruction directing a finan- of Data ...[and] (b) change to Data elements ....’’ As cial institution to ...transfer, pay or deliver money or a preliminary matter, the Second Circuit ruled that securities.’’ In some policies, the relevant clause requires there was a Computer Violation because the attack a ‘‘direct loss of, or direct loss from damage to, Money, constituted both a ‘‘fraudulent entry of data into Med- Securities and Other Property directly caused by Com- idata’s computer system,’’ as well as a ‘‘change to data’’ puter Fraud,’’ with ‘‘Computer Fraud’’ defined as ‘‘[t]he based on the spoofing code that altered the appearance 2 use of any computer to fraudulently cause a transfer’’ of of the email domains. Turning to the causation issue, money or other property to a third party. Minor varia- the Second Circuit ruled Medidata sustained a ‘‘direct tions aside, the common thread in these and other loss’’ as a result of the spoofing incident, rejecting the Computer Fraud provisions is the requisite ‘‘direct’’ insurer’s assertion that the intervening actions by the link between computer use and financial loss. As dis- Medidata employee in effectuating the wire transfer cussed below, courts’ interpretations of the term were sufficient to ‘‘sever the causal relationship between ‘‘direct’’ under varied circumstances have led to differing the spoofing attack and the losses incurred.’’ conclusions as to the availability of coverage for email The same month that the Second Circuit decided phishing schemes. Medidata, the Sixth Circuit similarly ruled that claims arising out of wire transfers instigated by fraudulent Cases Finding Coverage emails were covered by a Computer Fraud provision. In Medidata Solutions Inc. v. Federal Ins. Co.,729F. In American Tooling Center, Inc. v. Travelers Casualty App’x 117 (2d Cir. 2018), an often-cited decision in and Surety Co. of America, 895 F.3d 455 (6th Cir. this context, the Second Circuit ruled that claims aris- 2018), the scheme was initiated by an email purport- ing out of a fraudulent wire transfer were covered by edly sent by a one of American Tooling’s vendors. In a Computer Fraud provision in the relevant policy. A actuality, the email was sent by an imposter using an Medidata employee received an email purportedly email address with a similar domain. The email sent from the company’s president advising her to instructed American Tooling to send invoice payments follow instructions from an attorney regarding a poten- to a new bank account. In response, American Tooling tial corporate acquisition. That same day, a man who wired approximately $800,000 to the account without identified himself as an attorney called the employee verifying the new instructions with the vendor. When and requested a wire transfer. The employee sought the fraud came to light, American Tooling sought cov- confirmation to make the transfer from Medidata’s erage under the Computer Fraud provision, which cov- executives. Thereafter, a group email was sent purport- ered ‘‘direct loss of, or direct loss from damage to, edly from Medidata’s president confirming that the Money, Securities and Other Property directly caused wire transfer should be made. After the wire transfer by Computer Fraud.’’ Computer Fraud was defined as was made, it was discovered that the emails were ‘‘[t]he use of any computer to fraudulently cause a sent by imposters. Medidata sought coverage under transfer’’ of money or other property to a third party. a Computer Fraud provision, among others. A New York district court ruled that coverage was available A Michigan federal district court ruled that the insurer under the Computer Fraud and Funds Transfer owed no coverage because American Tooling’s loss was Fraud provisions. Medidata Sols., Inc. v. Fed. Ins. Co., not directly caused by the use of a computer. The court 268 F. Supp. 3d 471 (S.D.N.Y. 2017). In a summary cited the intervening steps that occurred internally at order, the Second Circuit affirmed, ruling that the American Tooling between receipt of the fraudulent underlying claims were encompassed by the Computer email and the eventual transfer of funds. See Am. Tool- Fraud provision. ing Ctr., Inc. v. Travelers Cas. & Sur. Co. of Am., 2017 2 1 MEALEY’S Emerging Insurance Disputes Vol. 25, #6 March 19, 2020 U.S. Dist. LEXIS 120473, 2017 WL 3263356 (E.D. between the initial email and payment. The court Mich. Aug. 1, 2017). The Sixth Circuit reversed, ruling also dismissed the argument that coverage was unavail- that American Tooling suffered a ‘‘direct loss’’ of funds able because Norfolk was attempting to pay a legit- when it transferred the money to the imposter. The imate invoice, rather than a fraudulent bill. The court court explained that the loss was directly caused by stated: ‘‘the insurance provision does not require a frau- computer fraud because the fraudulent email induced dulent payment by computer; rather it requires a com- a series of internal actions that directly caused the trans- puter’s use to fraudulently cause a transfer of money.’’ fer of money. In addition, the Sixth Circuit ruled that the imposter’s conduct constituted ‘‘computer fraud’’ Employing similar reasoning, the Eleventh Circuit because the fraudulent emails and resulting wire trans- reached the same conclusion in Principle Solutions fer were implemented through the use of a computer.

Load more

  12

Copy Link