Spoofed Executive Email: Which Crime Insuring Agreement Fits
Northline Metals' controller received an email that appeared to come from the company's president, who was traveling. The email instructed her to wire $185,000 to a new steel supplier to capture a discount; it included a PDF invoice with the supplier's letterhead. The controller called the number in the email signature and spoke to a person who confirmed the banking instructions. She wired the funds from Northline's operating account. Two days later the real supplier called about an unpaid invoice. Northline's commercial crime policy has Employee Theft $500,000; Computer Fraud $100,000; Funds Transfer Fraud $100,000; and a Social Engineering Fraud endorsement with a $50,000 limit and a $10,000 retention. The policy defines Computer Fraud as loss from unauthorized entry into a computer system, and Funds Transfer Fraud as loss from a fraudulent instruction purporting to originate from a financial institution. No hacker accessed Northline's systems.
1. Which insuring agreement is triggered, and what should Northline expect to recover?
Read the worked answer
The loss fits Social Engineering Fraud, not Computer Fraud or Funds Transfer Fraud.
- Computer Fraud is defined by unauthorized entry into a computer system. Spoofing an email address is deception, not access; no one entered Northline's system.
- Funds Transfer Fraud requires an instruction purporting to come from a financial institution. This instruction purported to come from the president and a supplier.
- Employee Theft fails because the controller did not intend to steal.
The social engineering endorsement is the specific fit: an employee was deceived into transferring funds by someone impersonating an executive and a vendor.
Recovery: $50,000 limit less $10,000 retention = $40,000, if the endorsement's conditions are met. Most such endorsements require verification through a pre-arranged telephone number or callback procedure. Calling the number in the fraudulent email is not independent verification; it confirmed the fraud. If verification is a condition precedent, the insurer may deny entirely, or a court may require a showing of prejudice. Present the $40,000 demand with the verification problem disclosed.
2. Can Northline reach the $100,000 Computer Fraud limit by arguing the spoofed email was 'use of a computer'?
Read the worked answer
That argument is weak under this form. The policy expressly requires unauthorized entry into a computer system. No one accessed Northline's system; the controller authorized the wire using her own credentials. A spoofed email is a communication, not an intrusion.
There is also an interpretive problem: reading Computer Fraud to cover impersonation would make the specific social engineering endorsement and its lower sublimit meaningless. Specific coverage controls over general coverage, and sublimits are not stacked. Northline cannot recover the same loss twice.
Forgery is also unavailable. Forgery coverage is typically confined to checks, drafts, promissory notes, and similar instruments; a PDF invoice and email instruction are not negotiable instruments. The 'direct loss' requirement is satisfied, but the voluntary nature of the transfer may be used to argue the loss is indirect.
Pursue the social engineering limit. Preserve the computer fraud argument only if the actual form lacks the unauthorized-entry definition.
3. What recovery and risk-control steps should Northline take in the first 72 hours?
Read the worked answer
- Call the sending and receiving banks immediately and request a recall or funds trace; wire recalls succeed only if the receiving account still holds funds.
- Report to the FBI's Internet Crime Complaint Center and consider notifying OFAC if the recipient is foreign; sanctions issues can affect recovery and insurer response.
- Preserve the original email with full headers, the PDF, call logs, and the controller's notes; do not forward or alter the original.
- Contact the real supplier through an independently sourced number to confirm no invoice exists.
- Give written notice to the crime insurer and open a claim under both the social engineering endorsement and, protectively, computer fraud.
- Review bank security procedures under UCC Article 4A; a bank that follows a commercially reasonable security procedure on an authorized payment order is generally not liable.
- Immediately require dual authorization and independent callback verification for all wires, and retrain staff that caller ID and email signatures are not verification.