Exclusion Bars Coverage for Fraudulent Instruction Loss when Employee with Authority to Initiate Wire Transfer Enters Fraudulent Account Information

The U.S. Court of Appeals for the Ninth Circuit has held that an exclusion for loss “resulting directly or indirectly from the input of Electronic Data by a natural person having the authority to enter the Insured’s Computer System” barred coverage under a Computer Fraud insuring clause for a business email compromise/fraudulent instruction scheme.  Aqua Star (USA) Corp. v. Travelers Cas. & Sur. Co. of Am., No. 16-35614 (9th Cir. Apr. 17, 2018).

The insured, a seafood importer, purchased seafood from a vendor.  The vendor’s email system was hacked, and the hacker apparently monitored email exchanges between the vendor and insured before beginning to intercept those emails to send fraudulent emails using spoofed email domains.  The hacker later directed the insured’s employee to change the bank account information for payments to the vendor; the insured made the changes as directed and ultimately made $713,890 in fraudulent payments.  The insured sought coverage under a computer fraud provision in its commercial crime policy, but the insurer declined coverage.

On appeal, the Ninth Circuit held that an exclusion for loss “resulting directly or indirectly from the input of Electronic Data by a natural person having the authority to enter the Insured’s Computer System” barred coverage.  The court noted that the insured’s employees clearly had authority to enter the insured’s computer system to enter Electronic Data to change the wire instructions and initiate transfers, which the court ruled fit “squarely within the [e]xclusion.”  The court also rejected the insured’s argument that Washington’s rule of efficient proximate cause applied to preserve coverage, observing that the insured could not “avoid a contractual exclusion merely by affixing an additional label or separate characterization of the act or event causing the loss.”