Ninth Circuit's Fraudulent Payments Coverage Ruling Has Implications For Cyber Insurance Purchasers

In a decision with significant implications for policyholders seeking coverage for social engineering scams and cybercrime losses, the US Court of Appeals for the Ninth Circuit held in Ernst and Haas Management Company, Inc. v. Hiscox, Inc. that an insurance policy covering losses resulting directly from computer fraud included coverage for payments made based on a fraudulent invoice. The Ninth Circuit held that the loss was "directly" caused by the fraud, disagreeing with the insurer's argument that the unwitting employee who received the fraudulent invoice and sent the payment to the fraudster was an intervening actor.

Ernst and Haas Management Company was a victim of a common social engineering scam: A fraudster emailed an Ernst employee a fraudulent invoice, posing as that employee's superior. Believing the email to be legitimate, the employee directed Ernst's bank to wire $200,000 to a third-party account reflected in the fraudulent invoice. Afterward, the