Between the Lines

Electronic Transfer Scam Losses May Be Covered Under Business Owner’s Policy: A Step Toward Coverage For Crypto Currency?

The Vermont Supreme Court recently held that a business owner’s policy that provided coverage for “loss” resulting from forgery and theft, but excluded “physical loss or physical damage” resulting from a voluntary parting with property induced by any “fraudulent scheme” or “false pretenses,” could reasonably be interpreted to provide coverage for losses resulting from an email scammer’s successful effort to trick an employee into making a wire transfer by “spoofing” a manager’s email.

In Rainforest Chocolate, LLC v. Sentinel Ins. Co., 2018 VT 140, an employee electronically transferred funds to an outside bank account as instructed by an email he believed to be from his manager. The email was from a scammer who had gained control of the manager’s email account. The business reported the loss to its insurer, seeking coverage under the policy’s additional coverages for “forgery,” loss of “money or securities” resulting from theft, and “computer fraud.” The insurer denied coverage based on the false pretense exclusion, which excluded “physical loss or physical damage” caused by a fraudulent scheme.

The trial court, observing that the policy was “almost impossible to follow,” nevertheless concluded that while confusing, it was not ambiguous. Specifically, the trial court determined that the policy’s definition of “money” as “currency, coins and banknotes whether or not in current use” established that “money” meant physical bills, coins and notes which could only be subject to physical loss. The trial court therefore rejected the insured’s argument that the false pretense exclusion did not apply because the electronic transfer of funds was not “physical loss or physical damage.”

The Vermont Supreme Court disagreed, holding that because the policy used both “loss” and “physical loss” in reference to money in different provisions, and appeared to distinguish between the two, a reasonable insured could interpret the policy so that an electronic transfer of funds from a bank account constituted a “loss” of money but not a “physical loss” and therefore did not fall within the “false pretense” exclusion. In reaching this holding the Court relied on a recent District of Montana case, Ad Advertising Design, Inc. v. Sentinel Ins. Co., District of Montana No 1:17-cv-00140-TJC (Order of September 26, 2018), involving nearly identical facts. The Vermont Court remanded for a determination whether the loss might be covered under the policy’s additional coverages for “forgery” or “money and securities” (in the Montana case, the District Court concluded that both of those additional coverages applied but remanded for a determination as to the number of limits applicable to the four transfers in that case).

Under the Vermont and Montana cases, a fraudulently induced electronic bank transfer could potentially be a covered loss of “money.” In the policies at issue in those case, “money” is defined as “currency,” and “currency” is not defined. It would only be a small step for a court to conclude that a reasonable insured could interpret “currency” to include cryptocurrency, which unlike conventional currency does not exist as physical “cash.”

Businesses that invest in cryptocurrency, as well as those that accept cryptocurrency as payment, could benefit from this potential new avenue for coverage. Since the creation of cryptocurrencies like Bitcoin, massive losses have resulted from hacking, fraud, and user errors. In one well-publicized case, investors lost $190 million when the founder of a cryptocurrency exchange died—without telling anyone his password.

Cryptocurrencies are not held by traditionally regulated banks, do not benefit from deposit insurance schemes, and are traded on unregulated exchanges. While some insurers are writing policies specifically for cryptocurrency, such coverage is not generally available yet.

However, in order to qualify for coverage under a policy like that in the Vermont and Montana cases, the cause of the loss would still have to fit within the narrow requirements of the additional coverage provisions. For example, the coverage for “money and securities” in that policy requires the loss to happen while the money or securities are “at a bank or savings institution, within your living quarters … at the ‘scheduled premises,’ or in transit between any of these places.” The Montana District Court apparently had no difficulty concluding that the insured’s virtual dollars were “at” or “in transit from” its bank, but this language might present an obstacle to coverage for cryptocurrency, which is not held by traditional banks and does not exist in a physical location.

The policy at issue in the Vermont and Montana cases also included “computer fraud” coverage but, interestingly, that coverage was limited to “physical loss of or physical damage to ‘money’ … resulting directly from computer fraud,” and would not apply to an electronic transfer of money or cryptocurrency.