Crime insurance court cases: direct loss and computer fraud

In short. Crime insurance case law has developed mainly in the United States and Canada. The decisions are split on whether a payment made by the policyholder's own employee after a fraudulent e-mail is a loss resulting "directly" from computer fraud. What is clear is that the existence of a separate social engineering clause, and its sub-limit, can decide the entire outcome. The descriptions below are based on public secondary sources.¹ Medidata, American Tooling Center, Apache, Principle Solutions, The Brick and G&G Oil are analysed in more depth on the crime insurance page of the Estonian site: see Crime-kindlustuse kaasused (in Estonian). Crime insurance under Estonian law is covered in Crime and fidelity claims in Estonia.

A. Direct loss and employee dishonesty

1. National Union v Cargill (United States, 2023)

Facts. A long-serving employee embezzled about USD 3 million and, through false information, caused unnecessary grain shipments with additional costs of about USD 29 million. The insurer initially agreed to cover only the USD 3 million that had been directly embezzled.

Decision. The US Court of Appeals for the Eighth Circuit affirmed the first-instance decision: the entire loss of about USD 32 million was covered. The employee's implied control over the grain was an unlawful taking, and the additional freight costs resulted "directly" from it, because the employee's false information induced the shipments and the causal chain was not broken.²

Lesson. The wording of "direct loss" is a matter for negotiation. Check whether the employee dishonesty cover also extends to additional costs resulting directly from the fraud.

2. Oriental Insurance v National Bulk Handling (India, 2020)

Facts. Employees of a warehousing company acting as collateral manager, together with borrowers, allowed goods held in the warehouses as security for bank loans to be removed without authorisation. The insurer disputed that the loss was caused by dishonest employees, arguing that the employees' involvement had not been proved.

Decision. The Supreme Court of India upheld the claim under the fidelity guarantee policy: the cover for dishonest conduct by employees protected the employer even though the employees had acted together with third parties.³

Lesson. Check whether the policy covers collusive fraud committed by an employee together with a third party, and whether it covers client property.

3. Vero v Heartland Bank, formerly Marac Finance (New Zealand, 2015)

Facts. Over several years an employee granted loans in breach of the internal rules and concealed problem loans.

Decision. The New Zealand Court of Appeal found that the employee had acted dishonestly but lacked the clear intention, required by the policy, to cause the employer a loss: he had tried to conceal unauthorised loans in order to avoid dismissal and to recover the debts. The insurer was not liable. The Supreme Court of New Zealand refused leave to appeal.⁴

Lesson. Crime insurance does not cover bad business decisions or credit risk. An intent requirement in the policy can make the cover very narrow, and it must be read before the contract is concluded.

B. Computer fraud and social engineering

4. Medidata Solutions v Federal Insurance (United States, 2018)

Facts. Employees transferred about USD 5 million after receiving e-mails that impersonated the company's president and an outside lawyer.

Decision. The US Court of Appeals for the Second Circuit affirmed the first-instance judgment in favour of the policyholder. The spoofing code entered and changed data in the e-mail system, so the computer fraud cover applied, and the fact that the employees made the transfers themselves did not break the causal link.⁵

5. American Tooling Center v Travelers (United States, 2018)

Facts. Fraudsters impersonated the e-mails of a Chinese supplier, and the company transferred about USD 834,000.

Decision. The US Court of Appeals for the Sixth Circuit reversed the first-instance decision and held that the loss was a direct loss directly caused by computer fraud. The definition of computer fraud was not limited to hacking.⁶

6. Apache Corp. v Great American (United States, 2016)

Facts. The company received an e-mail in the name of a supplier with new bank details, called the telephone number given in the attached letter to verify the change, and transferred USD 7 million. USD 2.4 million was not recovered.

Decision. The US Court of Appeals for the Fifth Circuit held that the computer fraud cover did not apply. The loss did not result directly from the use of a computer but from the decisions taken by the company's employees after the e-mail had been received.⁷

Lesson from cases 4 to 6. On comparable facts, US courts have reached opposite results. A company cannot rely on the computer fraud clause to cover social engineering: clear, separate cover is needed.

7. Principle Solutions Group v Ironshore (United States, 2019)

Facts. The company's controller transferred about USD 1.7 million on the basis of e-mails sent in the name of an executive and of a "transaction lawyer".

Decision. On 9 December 2019 the US Court of Appeals for the Eleventh Circuit held that the loss fell within the fraudulent instruction cover of the crime policy. The two e-mails together formed one fraudulent instruction, and the words "resulting directly from" require proximate causation, not immediacy. The employee's later actions did not break the chain of causation.⁸

8. Pestmaster Services v Travelers (United States, 2014)

Facts. The company authorised a payroll service provider to make direct debits from its account to pay payroll taxes. The service provider diverted more than USD 300,000 to its own use.

Decision. In 2014 a federal court in California held that the funds transfer fraud cover does not extend to authorised transfers, and that the computer fraud cover requires the use of a computer to cause the transfer fraudulently, not every fraud in which a computer plays an incidental role. On 29 July 2016 the Court of Appeals for the Ninth Circuit affirmed the conclusion on authorised transfers but remanded the coverage question for two allegedly unauthorised transfers totalling USD 11,991.89.⁹

Lesson. Crime insurance is not insurance against a poorly chosen service provider or an inadequately controlled authority to make payments. In this case the policy did not cover transfers expressly authorised to the service provider, followed by its misappropriation of the funds; cover for a service provider's fraud therefore requires analysis of the particular insuring clause and the scope of the payment authority.

9. Future Electronics v Chubb (Canada, 2020)

Facts. A distributor of electronic components lost several million dollars in a multi-stage social engineering scheme. The policy contained computer fraud and funds transfer fraud cover with a limit of 25 million dollars and a social engineering endorsement with a sub-limit of 50,000 dollars.

Decision. The Superior Court of Québec held that the loss fell only under the social engineering endorsement. The covers were mutually exclusive, and the voluntary parting exclusion would also have excluded cover under the other insuring clauses.¹⁰

Lesson. Where the policy contains a specific clause, the loss is assessed under that clause. The sub-limit must match the actual risk.

10. Canada's first social engineering decision (Alberta, 2017)

Facts. Fraudsters impersonated a business partner, and the company transferred money to their account.

Decision. In 2017 a court in Alberta held that the social engineering fraud was not a loss covered by the funds transfer fraud cover of the crime policy, because the transfer had been initiated by the deceived employee himself.¹¹

C. Ransomware and crime insurance

11. G&G Oil v Continental Western (United States, 2021)

The Indiana Supreme Court held that a loss caused by a ransomware attack can result directly from the use of a computer, and that the ransom paid under duress (four bitcoins, about USD 35,000) did not break the causal link.¹² See also the cyber insurance cases.

D. Client property

12. First Defiance Financial v Progressive Casualty (United States, 2012)

Facts. A bank employee transferred customers' money to accounts under his control. The bank compensated the customers and claimed the loss from its insurer.

Decision. On 1 August 2012 the US Court of Appeals for the Sixth Circuit held that the customers' property was covered because it was owned and held by others while the policyholder was responsible for it by reason of the fiduciary relationship. The court left open whether the policyholder itself "held" the property.¹³

Lesson. Where a company holds or manages clients' money (a payment institution, a property management company, a law firm), the policy must cover client property expressly, not by way of interpretation.

E. The Estonian law perspective

An Estonian court would assess the same questions within a different framework.

• In case of doubt, the wording of the insured event or of an exclusion in standard terms is interpreted against the party that supplied it, usually the insurer (Law of Obligations Act (võlaõigusseadus, VÕS) § 39 lg 1).¹⁴
• If a term (for example a call-back requirement) links cover to the policyholder's conduct, it is in substance an obligation of the policyholder (hoolsuskohustus), and the insurer may rely on it only within the limits of VÕS § 452 lg 2 and proportionately.¹⁵
• Under Estonian law the "voluntary parting" exclusion is an exclusion whose validity as a standard term can be reviewed under VÕS § 42 (unreasonably prejudicial term).¹⁴ This is an argument, not a guarantee; the reliable solution is clear social engineering cover.

F. Negotiation checklist based on the cases

The cases give rise to concrete questions to ask when a crime policy is concluded:

1. Direct loss. Does "direct loss" include additional costs resulting directly from the fraud (Cargill), or only the money taken?
2. Computer fraud. Does the definition of computer fraud cover manipulated e-mails and spoofed domains (Medidata, American Tooling Center), and is the loss directly caused by the use of a computer where the payment was in the end authorised by the company's own employees after several steps, such as a telephone verification (Apache, where the e-mail was held to be merely incidental to the transfer)? The answer turns on causation and on the effect of the employees' authorisation, not on a universal requirement that the system must have been hacked.
3. Social engineering. Is there a separate clause, and what is its sub-limit (Future Electronics)?
4. Voluntary parting. Does the policy contain a voluntary parting exclusion, and does the social engineering clause make an exception to it?
5. Call-back. Is the call-back a prerequisite of cover or an obligation of the policyholder?
6. Client property. Is property that the policyholder holds or manages for others covered (First Defiance)?
7. Collusion. Is fraud committed jointly by employees and third parties covered (National Bulk Handling)?
8. Intent. Does the employee dishonesty cover require an intention to harm the employer, and is that requirement realistic (Marac)?
9. Authorised service provider. Is fraud by a service provider that has been given authority to make payments covered (Pestmaster)?
10. Ransomware. Does ransomware fall under the crime policy or the cyber policy, and do the two policies avoid excluding it by referring to each other (G&G Oil)?

Related pages

• Crime and fidelity claims in Estonia
• Crime insurance schemes and claims examples
• Typical coverage disputes in cyber, crime and D&O insurance
• Cyber, crime and D&O insurance: interplay and boundaries

References