BUSINESSES THAT are hit by wire transfer scams are increasingly finding it difficult to get their claims paidunless they have either a crime or cyber insurance policy that covers “computer fraud.”
Wire transfer fraud occurs when an employee is duped into wiring funds into the fraudster’s account. Courts around the country have held that this type of fraud is covered under the computer fraud portion of policies, typically crime or cyber insurance coverage.
If you have neither, you may be out of luck if your firm has funds stolen in this manner.
How wire transfer fraud works
1. Criminals identify the individual in the company who can authorize a wire transfer, such as a senior manager or owner.They may also identify a person in one of the company’s trusted clients.
2. Once they know who can authorize a transfer, they will work to compromise their e-mail account through malware or other means so they can hijack it and send e-mails from it. Alternatively, they may set up an e-mail account with an address that closely resembles that of the authorized individual.
3. The scammers then use the e-mail account to send messages to employees and instruct them to wire funds to a designated account, and – poof – the money’s gone after the employee complies.
What the courts are saying
Courts have mostly found that computer fraud provisions under cyber and crime insurance policies cover this type of fraud.
COVERAGE DECISIONS
In 2018 and 2019, the Second, Sixth and 11th district courts foundin three separate cases that an insurer’s computer fraud coverage must pay for the losses.
In 2022, the Ninth U.S. District Court found that a $200,000 wire transfer loss was covered under two parts of the company’s insurance policy: the computer fraud and funds transfer fraud provisions.
In 2022, the U.S. District Court in Alaska found that the city of Unalaska’s crime insurance policy’s computer crime and “impersonation fraud” provisions would both cover a $638,000 loss.
What you can do
We can review your insurance policies to see if they would cover this type of attack.
Most likely you’ll need crime or cyber coverage. A policy may specifically cover wire transfer fraud under separate social engineering or impersonation fraud coverage, which often will have lower liability limits than the computer fraud portion of the policy.