Your CFO or accounts payable clerk receives a legitimate-looking email supposedly from the company’s president authorizing a wire transfer to a vendor or business partner. In reliance on that email, the company’s bank is directed to wire funds to that account. It is later revealed that the president was impersonated by an email scammer and the company’s money was wired to the scammer’s offshore bank account.
This practice, known as “spoofing", is widespread and is growing. According to data security firm Proofpoint, it is estimated that 3.1 billion domain spoofing emails are sent per day and that email spoofing and phishing have had a worldwide impact costing an estimated $ 26 billion since 2016.
In a growing number of cases, companies that have been victimized by these kinds of scams have obtained recovery for their losses under their crime insurance policies. While in the past these policies have insured against losses resulting from theft in the ordinary brick and mortar world, many modern crime policies provide coverage for losses resulting from computer fraud and fraudulent funds transfer.
As policyholder claims in this area have morphed into litigation, recent court decisions have given these policies a broad interpretation that is favorable to companies that have been victimized by these kinds of scams. For example, while certain insurance companies have argued that coverage isn’t triggered unless the scammer has actually infiltrated or hacked into a company’s computer system, several recent court decisions have affirmed coverage for losses where a company employee has been tricked by an external email into wiring money.
As in any case involving insurance, the exact policy language is key. And in this regard, corporate policyholders should examine their crime policies ahead of time to make sure that if they are victimized by this scam they will be covered. This is especially important given that the courts are plainly moving in the direction of upholding coverage for these kinds of losses.
