CPCU Hacker Empty Firm’s Bank Account – Who Pays ?

Hackers emptied a construction firm’s bank account to the tune of $558,000. Another firm lost $125,000 when the office manager, in violation of the firm’s written policies, had logged into a social networking site, triggering what computer security consultants call a “corporate account take-over.” If misery loves company, these firms should be very happy; information technology experts estimate that 1 in 10 firms have had their accounts hacked with the total losses exceeding $2 billion a year.1

When they called their banks expecting that the bank would cover the loss, they got some really bad news—the bank was not responsible for the loss. That may seem counter-intuitive; if someone intercepts a check payable to me, forges my name and cashes the check at a bank, the bank that accepts the check is responsible for the loss, not me. That’s not the case with theft from on-line business accounts with most banks.

Fortunately there is insurance available to protect insureds from losses like this: computer and funds transfer fraud. It’s widely available as an endorsement to employee dishonesty and employee theft forms, but it’s also widely overlooked. ISO splits the coverage into two parts: Computer Fraud and Funds Transfer Fraud, which are insuring agreements 6 and 7 in the ISO Commercial Crime Coverage Form:

6. Computer Fraud We will pay for loss of or damage to “money”, “securities” and “other property” resulting directly from the use of any computer to fraudulently cause a transfer of that property from inside the “premises” or “banking premises”:

a. To a person (other than a “messenger”) outside those “premises”; or

b. To a place outside those “premises”.

7. Funds Transfer Fraud We will pay for loss of “funds” resulting directly from a “fraudulent instruction” directing a financial institution to transfer, pay or deliver “funds” from your “transfer account”.2

Fraudulent instructions include electronic, telegraphic, cable, teletype, telefacsimile or telephone instruction, so there’s coverage for more than just Internet fraud, but Internet fraud is the big one. (Many insurers combine computer and fund transfer fraud coverage, which makes it easier to decipher.)

Insurance is just one piece of the solution; loss control is the other. Insurance won’t compensate for the time spent in coping with the problem and all insurance coverages have limits and exclusions. The New York Times article reporting this story includes a number of steps businesses can take to avoid becoming victims. I’ve combined their suggestions with some of my own, as follows:

1. Credit card companies monitor transactions to spot out-of-the ordinary charges; some banks have similar systems for on-line banking. The article points out that the larger banks have more robust automated systems than do smaller banks. Find out what protection your bank provides. Consider changing banks to get better protection.

2. See if a bank will accept responsibility for fraudulent transactions. If your account is attractive enough to the bank, they’ll sometimes agree.

3. Follow best practices in computer operations, including up-to-date firewalls, installing security patches, limiting the number of employees with access to bank accounts, enforcing strict rules for use of business computers, and forbidding social media.

4. Monitor account balances daily. There is often a brief window to cancel fraudulent transactions. Travelers has a brochure posted online about computer and funds transfer fraud. It recounts how a payroll supervisor noticed three suspicious wire trans fers from the firm’s account totaling $704,632. She notified the firm’s bank, which shut down the account and was able to recover $465,851 of the stolen funds.3

5. Consider dedicating one computer solely to financial transactions. Use that computer solely for funds transfer transactions.

This is an opportunity for producers to add value to their services to their clients:

• Quote computer and funds transfer fraud coverage to every insured with employee dishonesty/theft policy that doesn’t include it.

• Notify all other clients of the employee dishonesty and computer/funds

transfer fraud gaps in their coverage. • Recommend that they contact their banks.

• Discuss it when quoting a new account. A copy of the New York Times article mentioned above is a great point-of-sale piece.

And don’t forget to look at your firm’s insurance and to see what you can get from your bank.

It’s an article of faith among insurance claim professionals that the appraisal provision in property insurance policies is a valuable tool for insureds to use when faced with a valuation dispute in connection with an insured loss. (For those of you who don’t spend your spare time reading insurance policies, a recap may be in order. The appraisal provision gives both the insured and the insurer the right to demand binding appraisal if they disagree on the value of the property or the amount of the loss. Each side selects its appraiser and the appraisers pick an umpire. If they can’t agree on an umpire, either may request a court to appoint one. The appraisers each state the value of the property and amount of loss. If the don’t agree, they submit their differences to the umpire. A decision agreed to by any two is binding. Each side pays its own appraiser and half of the expenses of the appraisal and the umpire.)

There are often no lawyers involved and there’s no requirement to follow any particular rules of procedure. New York State Insurance Law provides that an appraisal, if ordered, “shall proceed pursuant to the terms of the applicable appraisal clause of the insurance policy and not as an arbitration.” 4

Appraisal is regarded as so valuable an option for insureds that consumer advocates pushed the legislature in 1990 to override New York case law that permitted insurers to decline to participate in appraisal. When a court decision in 2002 did not compel the insurer to participate in appraisal, the legislature passed additional legislation in 2010 clarifying that either party can require the other to participate in appraisal.

Appraisal is almost always a much less expensive and faster way of resolving a claim dispute than a lawsuit. Notice that I said “almost always.” Here’s one that didn’t turn out that way5:

Amerex distributes outerwear as an intermediary between wholesale customers in the United States and overseas clothing manufacturers. It stores the merchandise awaiting shipment to customers in a warehouse in Avenel, New Jersey on a large complex rack system that facilitates the shipping process.

On August 3rd, 2001, a storage rack collapsed rupturing the sprinkler system pipes, which flooded the premises. Amerex’s merchandise was extensively damaged and its computer system was inoperable for up to three weeks. In addition to the damage to physical property, it claimed a large business income loss. The direct property loss was settled, but the business income loss proved more difficult. The insured’s business income claim exceeded $8.5 million. The coverage was written in two layers. Fireman’s Fund covered the first $2.5 million. Lexington and Westchester Surplus Lines shared equally in the next $10 million of coverage. Fireman’s Fund paid its $2.5 million limit, but the insured and the insurers could not agree on the amount of the excess loss. The excess insurers felt that they owed only a small amount; the insured felt it was entitled to over $6 million.

When attempts to settle the loss between the parties stalled, the claim was submitted to non-binding mediation. That too, was unavailing, Four years after the loss, the insured started suit.

The insurers responded by demanding appraisal. The insured fought the appraisal on the grounds that the insurers had waited too long to assert their right. When that argument failed, the appraisal process began. The appraisal process took almost 2 ó years. Finally, two of the appraisers agreed that Amerex’s total loss was $1.3 million—less than half of the primary policy limit—so that the excess carriers did not owe the insured anything. As might be expected, the insured returned to court. It lost in district court and appealed the decision. On May 10, 2012 the appeals court ruled in favor of the insurance companies. So more than ten and a half years after the loss, the matter concluded leaving the insured with a pile of legal and appraisal bills, but no further payment.

WHO IS THE OWNER AND WHAT’S ITS INSURABLE INTEREST?

Jeffrey Gilbert bought a building as a tenant-in-common with his business partner, Alice Gardner, but he purchased insurance in his name only. The premises were destroyed by fire on October 2, 2009. The insurance company paid Gilbert 50% of the loss since he had a 50% interest in the property. Gilbert argued that he had an insurable interest equal to full value of the property since he was legally entitled to the “full use and enjoyment of the premises.” The court ruled otherwise. Since his partner was not named as insured, Gilbert was insured for only his 50% interest in the property.6

Learning Point: Getting the right name of the owner of the property seems so basic, but it’s easy to get wrong. Many people use the word “I” very broadly. They say, “I’m buying a building, send me a binder for the closing.” What they mean is, “The partnership, co-tenancy, LLC, corporation, etc. that I’m part of is buying a building.” After you ask the location of the property, your next question should be, “In whose name is property titled?”

Debris continues to fall from the crane collapse that killed seven people in midtown Manhattan on March 15, 2008. The New York Court of Appeals just ruled that the coverage carried by Joy Contractors, Inc., the crane operator, was void from inception if the crane operator made material misrepresentations and that the additional insureds on the policy would then also have no coverage.7

The insurers claimed its underwriters were told that the crane operator specialized in drywall installation, did not do exterior work and performed no work at a level more than two stories above grade other than drywall interior work. According to the insurer, Joy was actually the structural concrete contractor, performing work on the building’s entire exterior with the tower crane. The insurer stated that had it known the true facts, it would have declined the insurance or offered it subject to different terms, conditions or premium. That’s the standard for determining if a misrepresentation is material. Only a material misrepresentation voids coverage. For example, if I tell my insurer that my house is painted white when in fact it’s yellow, that’s a misrepresentation, but it’s not material so it doesn’t void my coverage.

Two Learning Points: (1) A material misrepresentation can void coverage. Be careful how you describe a client’s operations to underwriters and be sure that all questions are answered correctly to the best of your knowledge. (2) Advise insureds not to rely on insurance provided by others. I’m sure the general contractors and owners in this case had their own coverage in addition to being named as additional insureds on Joy’s policy, However, property owners often specify that netlease tenants and others purchase insurance covering property and/or liability exposures and name the property owner as an insured. Many of these property owners then do not purchase their own insurance. Bad idea. If the tenant’s representations or acts lead the insurer to void the coverage, the property owner loses its coverage also.

1 Pamela Rickman “Owners May Not Be Covered When Hackers Wipe Out A Business Bank Account” New York Times, Thursday, June 13, 2012

http://www.nytimes.com/2012/06/14/business/smallbusiness/protecting-business-accounts-fromhackers. html?pagewanted=all 2 Commercial Crime Coverage Form (Loss Sustained Form) CR 00 21 05 06 copyright ISO Properties, Inc., 2005

3 “Travelers Wrap: Funds Transfer Fraud and Computer Fraud” https://www.travelers.com/business-insurance/management-professionalliability/ documents/59545.pdf

4 N.Y. Ins. Law § 3408(c).

5 Amerex Group, Inc. v. Lexington Ins. Co. et al. US Court of Appeals, 2nd Circuit 10-4163-cv (May 10, 2012)

6 Jeffrey Gilbert, appellant, v Allstate Insurance Company, respondent. ) Appellate Division 2^nd Department NY Index No. 4323/10 (May 15, 2012)

7 Admiral Insurance Company, Respondent-Appellant, v. Joy Contractors, Inc., et al., New York Court of Appeals Slip Op 4670 (N.Y. June 12, 2012),