Phishing And Fraudulent Instructions Under A Commercial Crime Policy

Warnings are plentiful about phishing schemes where a bad actor pretends to be an officer of a company and directs an employee to wire transfer funds to a foreign bank. Despite these warnings, employees regularly fall for these phishing schemes and wire funds to off-shore accounts never to be seen again. Companies that fall victim to these phishing attacks often turn to their insurance policies for a recovery. Among the insurance policies that might provide coverage is the commercial crime policy, which provides coverage for losses directly related to fraudulent instructions. In a recent case, the 11th Circuit was asked to determine whether coverage existed as a matter of law.

In Principle Solutions Group, LLC. v. Ironshore Indemnity, Inc., No. 17-11703 (11th Cir. Dec. 9, 2019), the policyholder fell victim to a phishing scheme where the bad guys sent the policyholder's controller an email purportedly from the managing director instructing the controller to wire money as instructed by an “attorney” allegedly working on a secret key acquisition for the policyholder. The controller followed the directions and ultimately wired significant sums to a Chinese bank. Before the policyholder's bank issued the wire, the bank's fraud unit intervened and held the wire. The controller contacted the “attorney” who confirmed that the managing director had approved the transaction. Upon receiving that information, the bank released the wire. Of course, it was all a fraud and the managing director knew nothing about it.

The policyholder sought coverage under its commercial crime policy, which covered[l]oss resulting directly from a fraudulent instruction directing a financial institution to debit [the policyholder's] transfer account and transfer, pay or deliver money or securities from that account. The insurance company denied coverage because the managing director's purported email did not direct a financial institution to wire the funds, but only told the controller to await the attorney's instructions. The insurance company also stated that the loss did not result directly from a fraudulent instruction because of intervening communications after the initial email, including the bank's hold on the wire and phone calls from...