• First Reference
  • About us
  • Contact us
  • Blog Signup 📨

First Reference Talks

Discussions on Human Resources, Employment Law, Payroll and Internal Controls

  • Home
  • About
  • Archives
  • Resources
  • Buy Policies
You are here: Home / Information Technology / Cybersecurity and insurance

By Apolone Gentles, JD, CPA,CGA, FCCA, Bsc (Hons) | 4 Minutes Read August 4, 2021

Cybersecurity and insurance

Cybersecurity and insurance

Cybersecurity and insurance are increasingly intersecting as the number, frequency, and severity of cyber incidents rise. More businesses and individuals are transferring cyber risks to insurers. Insurers are improving special-purpose coverage options while limiting or excluding coverage under general liability policies. Consumers should assess needs and policies carefully to understand coverage limits and adequacy.

In terms of understanding available coverage, a recent post on First Reference Talks, entitled Vendor master file blunders caused a $2.7M loss, briefly touched on one company’s coverage conundrum. As the post explained, the insurer, Chubb, refused to cover over US$2.7M, which phishers had scammed from Future.

The court assessed three of Future’s policy coverages, namely, a:

  1. Computer Fraud by a Third Party Coverage (the “Computer Fraud Policy”)
  2. Funds Transfer Fraud by a Third Party Coverage (the “Funds Transfer Policy”); and
  3. Social Engineering Fraud Endorsement.

The computer fraud policy did not cover the losses

Future claimed that its Computer Fraud Policy should cover its losses. The court disagreed.

The Computer Fraud Policy allowed coverage for a direct loss resulting from a computer fraud by a third party.

The court explained that computer fraud meant the unlawful taking of money through the use of a computer system. Future believed that because the fraudsters used computers to email the fraudulent instructions, and the bank used computers to process the electronic funds transfer, the Computer Fraud Policy should provide coverage. On a simple read, Future may appear to be right.

But the court explained that coverage required a direct act of stealing using a computer. For instance, the fraudsters would have had to hack into the computer system to exercise control over and take the money. However, the fraudsters did not use a computer system, except in a minor and incidental way, to email the fraudulent instructions. In reality, what they did was induce or dupe Future’s employee or fraudulently caused the employee to transfer funds.

The funds transfer policy did not cover the losses

Future claimed that the Funds Transfer Policy should cover its losses. The court disagreed.

The Funds Transfer Policy provided coverage for a direct loss resulting from funds transfer fraud by a third party. The policy defined a funds transfer fraud as fraudulent written, electronic, telephonic, and other instructions to a financial institution to pay money without Future’s knowledge or consent.

In this case, Future knew and consented to the funds transfers; in fact, it initiated and authorized the transfers. The fact that the phishers duped the employees into making the transfers and the fact that Future did not know the transfers were fraudulent was irrelevant because: (i) a third party did not issue instructions that tricked the back into releasing funds (ii) based on instructions the bank believed to be Future’s (iii) and to which Future did not consent or have knowledge of.

The exclusion clause

The court also concluded that a specific policy exclusion for an insured who knowingly gives or surrenders money to a third party, not in collusion with an employee, would also bar any recovery under the Computer Fraud Policy or Funds Transfer Policy.

Only the social engineering coverage survives

The court agreed that the Social Engineering Fraud Endorsement, not the other two policies, unambiguously covered Future’s losses—albeit for a mere US$50,000.00. The Social Engineering Fraud Endorsement provided coverage for the transferring or paying of money as a result of social engineering fraud by someone purporting to be a client, vendor, or employee, whom the insured authorized to instruct other employees to transfer money.

The policy also defined social engineering fraud as the intentional misleading of an employee through misrepresentation of a material fact which that employee relies on, believing it to be genuine. This was precisely the type of loss that Future suffered, and this was the coverage to which it was entitled.

Coverage options for individuals

In terms of the options available for individuals, a July 7, 2021 article from the print issue of the Wall Street Journal, entitled Help Against Online Bullies, focused on cyberbullying insurance available to adults, teens, and tweens. As the article makes clear, there are non-insurance solutions to cyberbullying, and other general coverage under health plans, for example, may cover mental healthcare and other costs which cyberbullying policies also cover.

Nonetheless, cyberbullying coverage is an option for individuals, and businesses looking to offer more robust benefit packages to employees.

Cyberbullying coverage is available for specific damages from cyberbullying, including wrongful job termination and false arrest for adults, unfair disciplining by a school, or the inability to attend work or school because of psychological reasons.

Cyberbullying coverage is not very widespread. According to one study that the article cites, only 10% of the sample had coverage. Chubb, Arbella (New England-based), and AIG underwrite such policies, according to the article. The article quotes costs varying from US$5.00 per month for up to $10,000.00 in coverage to US$20.00 per month for up to $100,000.00 in coverage. In Canada, visit Chubb’s website at www.chubb.com/ca-en/individuals-families/products/cyber/cyber-insurance.html. 

Meeting your duty of care

There are two critical takeaways for risk management, and specifically, risk transference as a risk management strategy. Assess coverage needs with a broker or other professionals to determine what coverage is enough and not redundant. Understand exclusion clauses and the limits of policy coverage. It may be disastrous to think that multi-million dollar computer fraud or funds transfer policies apply, only to discover that a $50,000.00 endorsement or add-on is the only recourse. 

Policies and procedures are essential, but the work required to create and maintain them can seem daunting. Finance and Accounting PolicyPro, Not-for-Profit PolicyPro, and Information Technology PolicyPro, co-marketed by First Reference and Chartered Professional Accountants Canada (CPA Canada), contain sample policies, procedures, checklists and other tools, plus authoritative commentary to save you time and effort in establishing and updating your internal controls and policies. Not a subscriber? Request free 30–day trials of Finance and Accounting PolicyPro, Not-for-Profit PolicyPro, and Information Technology PolicyPro, here.

  • About
  • Latest Posts
Apolone Gentles, JD, CPA,CGA, FCCA, Bsc (Hons)
Apolone Gentles is a CPA, CGA and Ontario lawyer and editor with over 20 years of business experience. Apolone is leveraging 20 years of business and accounting experience to build a commercial litigation practice with an emphasis on construction law. She has held senior leadership roles in non-profit organizations, leading finance, human resources, information technology and facilities teams. She has also held senior roles in audit and assurance services at a “Big Four” audit firm. Apolone has also lectured in Auditing, Economics and Business at post-secondary schools.
Latest posts by Apolone Gentles, JD, CPA,CGA, FCCA, Bsc (Hons) (see all)
  • Petty cash controls - January 4, 2023
  • Implement effective backup procedures - December 7, 2022
  • Cyber systems maturity and actualization - November 2, 2022

Article by Apolone Gentles, JD, CPA,CGA, FCCA, Bsc (Hons) / Business, Information Technology / computer fraud, cyber insurance, cyber risk, cyberbullying, cybersecurity, cybersecurity and insurance, Managing cyber bullying, policies, risk, risk management, risk transference, social engineering fraud

Share with a friend or colleague

Get the Latest Posts in your Inbox for Free!

Electronic monitoring

About Apolone Gentles, JD, CPA,CGA, FCCA, Bsc (Hons)

Apolone Gentles is a CPA, CGA and Ontario lawyer and editor with over 20 years of business experience. Apolone is leveraging 20 years of business and accounting experience to build a commercial litigation practice with an emphasis on construction law. She has held senior leadership roles in non-profit organizations, leading finance, human resources, information technology and facilities teams. She has also held senior roles in audit and assurance services at a “Big Four” audit firm. Apolone has also lectured in Auditing, Economics and Business at post-secondary schools.

Footer

About us

Established in 1995, First Reference is the leading publisher of up to date, practical and authoritative HR compliance and policy databases that are essential to ensure organizations meet their due diligence and duty of care requirements.

First Reference Talks

  • Home
  • About
  • Archives
  • Resources
  • Buy Policies

Main Menu

  • About First Reference
  • Resources
  • Contact us
  • 1 800 750 8175

Stay Connected

  • Facebook
  • LinkedIn
  • Twitter
  • YouTube

We welcome your comments on our blog articles. However, we do not respond to specific legal questions in this space.
We do not provide any form of legal advice or legal opinion. Please consult a lawyer in your jurisdiction or try one of our products.


Copyright © 2009 - 2023 · First Reference Inc. · All Rights Reserved
Legal and Copyright Notices · Publisher's Disclaimer · Privacy Policy · Accessibility Policy