Court dismisses cyber coverage suit over fraudulent wire transfer

A law firm is not covered for a fraudulent wire transfer under its social engineering insurance coverage because the imposter who deceived the firm was not impersonating an existing client or business partner, a federal court ruled.

In Gore, Kilpatrick & Dambrino PLLC v. Spinnaker Insurance Company et al., the U.S. District Court for the Northern District of Mississippi dismissed the firm’s claims Tuesday.

The Grenada, Mississippi-based law firm alleged it was targeted by someone posing as a potential client seeking to recover a supposed debt. After corresponding by email and signing a fee agreement, the imposter arranged for the firm to receive what appeared to be an official check for about $158,850, supposedly from the debtor.

After the check was deposited, the imposter instructed the firm by phone and email to deduct its fees and wire the remaining funds to a designated account. The firm wired more than $158,000, but the check was later returned unpaid, revealing the transaction to be fraudulent.

The firm sought coverage under a social engineering endorsement in its cyber policy. The insurer denied the claim, stating the provision applies only where a fraudulent instruction purports to come from an existing client or business relationship, and no such relationship existed in the transaction.

“Though Gore characterizes the Imposter as its client because the Imposter signed and returned the fee agreement, the Social Engineering Incident provision cannot be reasonably interpreted to cover the fraudulent transaction alleged in the complaint because the instruction to transfer money cannot have been sent by an imposter purporting to be a client if the individual giving the instruction is the client,” the court said.

Because there was no covered social engineering incident, the firm failed to state a claim for breach of contract, the court said.

Gore Kilpatrick did not immediately respond to a request for comment.