Phishing Attack-Turned-Wire Fraud Case Sees a Win for the Policyholder



Military Personnel Vulnerable to FraudIn an unusual turn of events, a recent court decision sided with the policyholder, despite specific policy language that probably should have favored the insurer.

The case of Ernst & Haas Mgt. Co. v. Hiscox, Inc isn’t entirely unique. The simple version of the case is an employee at Ernst & Haas gets a BEC phishing email impersonating a superior and the employee wires $200K to a cybercriminal-controlled bank account. Ernst & Haas submit a claim against their cyberinsurance with insurer Hiscox that is denied. And so we find the two in court.

What makes this an interesting case is cyberinsurers are *very* specific about policy verbiage to define what is and isn’t covered. In this case, the two coverage parts in question were:

(1) the Computer Fraud coverage, which covers losses “resulting directly from the use of any computer to fraudulently cause a transfer of that property”; and (2) Funds Transfer Fraud coverage, which covers loss “resulting directly from a [Fraudulent Instruction] to transfer, pay or deliver money” from the policyholder’s bank. Fraudulent Instruction was defined as an “instruction initially received by [the policyholder] which purports to have been transmitted by an Employee but which was in fact fraudulently transmitted by someone else without ... the Employee’s knowledge or consent.”

The court sided with Ernst & Haas, despite the specifics of the attack not meeting either clause: The attack wasn’t Computer Fraud (as defined above), as it was a social engineering attack with the employee using the company computer. And it doesn’t appear to be Funds Transfer Fraud (again, as defined above), as the fraudulent instruction wasn’t initially sent to the policyholder.

The takeaway from this case is that insurers don’t always win. However, organizations shouldn’t count on this; it’s one of the reasons such specificity is used when defining the circumstances in which a policy claim will be paid. It’s a far better position to simply put procedures in place that require validating wire transfer requests using a separate medium, as well as have employees with access to perform transfers enroll in Security Awareness Training to maintain a sense of vigilance when interacting daily with such requests.


Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

https://www.knowbe4.com/phishing-security-test-offer

Topics: Phishing



Subscribe to Our Blog


Comprehensive Anti-Phishing Guide




Get the latest about social engineering

Subscribe to CyberheistNews