No hack no payment: court backs refusal to pay for email scam
A court has ruled in favour of insurer, Travelers, after it refused to pay a claim to a company that was stung by a spoof email scam. American Tooling Center was lured into transferring $800,000 to the scammers' bank account in the belief it was paying legitimate bills to a vendor. The company sued Travelers after the insurer baulked on the grounds that ATC didn't suffer a “direct loss” that was “directly caused by the use of a computer”, and couldn't be treated as the victim of computer fraud. The court agreed, saying ATC had not been hacked.
A tool and die manufacturer that lost $800,000 when it fell victim to “spoofing” emails cannot recover under the computer fraud provision of its insurance policy because it was not a “direct” loss “directly caused” by the use of any computer, says a federal court ruling.

On March 18, 2015, the vice president of Grass Lake Michigan-based American Tooling Center Inc. sent an email to one of the company’s vendors requesting copies of all outstanding invoices, according to Tuesday’s ruling by the U.S. District Court in Ann Arbor, Michigan, in American Tooling Center Inc. v. Travelers Casualty and Surety Company of America.

The vice president received emails purportedly from the vendor instructing ATC to send payment for several legitimate outstanding invoices to a new bank account, according to the ruling.

Without verifying the new banking instructions, ATC wire-transferred about $800,000 to a bank account that was not, in fact, controlled by the vendor.

But by the time the fraud was detected, the funds had been transferred, and the wire transfers could not be retracted. ATC eventually paid the vendor about $400,000, according to the ruling.

ATC filed a claim with its insurer, Hartford-based Travelers, which denied coverage on the basis the loss was not a “direct loss” that was “directly caused by the use of a computer” as required by the policy.

ATC filed suit seeking coverage. The District Court agreed with the insurer. Intervening events “between ATC’s receipt of the fraudulent emails and the transfer of funds (ATC verified production milestones, authorized its transfers and initiated the transfers without verifying bank account information) preclude a finding of ‘direct’ loss ‘directly caused’ by the use of any computer,” said the ruling.

“There was no infiltration or ‘hacking’ of ATC’s computer system,” said the ruling, also. “The emails themselves did not directly cause the transfer of funds; rather, ATC authorized the transfer based upon the information received in the emails,” said the ruling, in granting Travelers summary judgment dismissing the case.