Social Engineering Fraud and Cyber Insurance

We’ve covered this before but here’s another article on exclusionary clauses. The loophole: "No unauthorized use of the victims Computer System".

Excellent reminder by Drinker Biddle & Reath, with a heads-up that social engineering in the form of CEO Fraud (aka Business Email Compromise) is likely not covered by your cyber insurance policy:

"Spoofing and phishing are part of what is known as social engineering fraud. Social engineering fraud is typically a type of computer fraud where an employee is misled into believing he or she is communicating with a vendor and is tricked into sending money due that vendor to the fraudster. Many organizations take proactive measures to protect themselves through enhanced IT measures, employee training and the purchase of computer fraud and other types of cyber insurance.

A recent district court action in Washington illustrates how social engineering works and highlights the importance of understanding the limitations of the types of insurance coverages companies may have. The case is currently on appeal before the 9th U.S. Circuit Court of Appeals.

Aqua Star, a seafood importer, purchased frozen shrimp from Longwei and pays for that product using wire transfers. In 2013, Longwei’s computer system was hacked. The hacker appears to have monitored email exchanges between Aqua Star and a Longwei employee.

The hacker began to intercept the email exchanges and sent fraudulent emails using “spoofed” email domains that appeared to Aqua Star to be actual emails. For example, the hacker substituted the “1” for a lower case “l” so it looked legitimate. In one of the emails, the hacker directed the Aqua Star employee to change the bank account information for Longwei for future wire transfers. Aqua Star employees made the changes as directed and transferred $713,890 in payments to the new account.

Aqua Star submitted a claim for the misdirected wires under its Wrap and Crime Policy, which specifically covers computer fraud. Its claim was denied on the basis of an exclusion to the policy, which precluded coverage for loss resulting directly or indirectly from the input of electronic data by a natural person having the authority to enter the insured’s computer system. Because there was no unauthorized use of Aqua Star’s Computer System, coverage was deemed not to apply. The district court’s ruling is consistent with similar precedents.

As social engineering fraud becomes more prevalent and insurance products in the cyber space more diverse, it is important for companies to ensure that their insurance meets their specific needs. We will continue to follow this case.

Cross-posted with grafeful acknowledgement. ©2018 Drinker Biddle & Reath LLP. All Rights Reserved. Article at NatLawReview: https://www.natlawreview.com/article/social-engineering-fraud-and-cyber-insurance-are-you-covered

CEO Fraud Prevention Manual Download

CEO fraud has ruined the careers of many executives and loyal employees. Don’t be next victim. This brand-new manual provides a thorough overview of how executives are compromised, how to prevent such an attack and what to do if you become a victim.