Apache Corporation: Fifth Circuit Holds That Commercial Crime Policy's Computer Fraud Coverage Does Not Extend To Social Engineering Fraud Loss

On October 18, 2016, the U.S. Court of Appeals for the Fifth Circuit released its opinion in Apache Corporation v. Great American Insurance Company. This is one of the first appellate decisions to consider coverage for a social engineering fraud loss under "traditional" commercial crime policy wording since the widespread introduction of social engineering fraud endorsements. In holding that the loss did not trigger indemnity under the Computer Fraud coverage, the Fifth Circuit adopted the interpretive approach to Computer Fraud coverage taken by the Ninth Circuit in Pestmaster Services v. Travelers (which we discussed in our August 4, 2016 post) and applied it in the context of social engineering fraud.

The Facts

Apache is an oil production company which is headquartered in Texas and which operates internationally. In March 2013, an Apache employee in Scotland received a call from a person claiming to be a representative of Petrofac, a legitimate vendor of Apache. The caller instructed the employee to change the bank account information which Apache had on record for Petrofac. The Apache employee advised that such a change request would not be processed without a formal request on Petrofac letterhead.

A week later, Apache's accounts payable department received an email from a @petrofacltd.com email address. Petrofac's legitimate email domain name is @petrofac.com. The email advised that Petrofac's bank account details had changed, and included as an attachment a signed letter on Petrofac letterhead setting out the old and new account numbers and requesting that Apache "use the new account with immediate effect."

An Apache employee called the telephone number on the letterhead and confirmed the authenticity of the change request. Next, a different Apache employee approved and implemented the change. A week later, Apache was transferring funds for payment of Petrofac's invoices to the new bank account.

Within a month, Petrofac advised Apache that it had not received payment of approximately $7 million which Apache had transferred to the new account. Apache recovered some of the funds, but still incurred a net loss of approximately $2.4 million.

The Computer Fraud Coverage

Apache maintained a Crime Protection Policy with Great American, but it does not appear that the policy included social engineering fraud coverage. Apache asserted a claim under its Computer Fraud coverage, which provided that:

We will pay for loss of, and loss from damage...