The Eleventh Circuit agreed that a sophisticated phishing scheme that persuaded an employee to wire money to a foreign bank account was a direct physical loss covered under a commercial crime policy. Principle Solutions Group, LLC v. Ironshore Indemn., Inc.,2019 U.S. App. LEXIS 36350 (11th Cir. Dec, 9, 2019).

    At 9:10 a.m., Principle's controller, Loann Lien, received an email purporting to be from Josh Nazarian, a managing director of Principle. The email informed Lien that Principle had been secretly working on a key acquisition and asked her to wire money as agreed to as soon as possible. Lien was instructed to give her full attention to attorney Mark Leach, who would provide further information.

    Lien received an email five minutes later from some one purporting to be Leach, an attorney at a London firm. Leach sent Lien remittance details for a bank in China. Leach reiterated to Lien over the phone that Nazarian approved the wire transfer.   

    Lien inform Wesleyans Fargo, a fraud prevention service, who asked for verification that the wire transfer was legitimate. Lien confirmed with Leach that Nazarian had approved the transaction. Lien relayed this information to Wells Fargo, which released the hold. At 11:21 a.m., about two hours after Lien received the first email, Principle wired more than $1.7 million to the scammers.

    Lien discovered that the request was fraudulent a day later when she spoke with Nazarian, who told her that he was not in the office that day. Nazarian promptly called Wells Fargo to report the fraud, but neither Principle nor law enforcement could recover the funds.

    Principle sought coverage for the loss under its policy with Ironshore. The policy covered "loss resulting directly from a fraudulent instruction directing a financial institution to debit [Principle's] transfer account and transfer money from that account." Ironshore denied coverage, asserting that Nazarian's purported email did not "direct a financial institution to debit [Principle's] transfer account" because it only told Lien to await instructions from Leach. Ironshore further argued that the asserted loss did not "result directly from" a fraudulent instruction because Leach conveyed necessary details to Lien after the initial email and Wells Fargo held the transaction, both of which were intervening events between the instruction and the loss. 

    Principle sued and cross motions for summary judgment were filed. The district court found the policy provision was ambiguous and granted summary judgment to Principle.

    The Eleventh Circuit affirmed. The email purporting to be from Nazarian, which informed Lien of the need to wire money and told her to await further instructions from Leach, qualified as a fraudulent instruction. Ironshore argued the email did not "direct" Principle to pay money out of its accounts, as the policy required. But the court found the email directed "a financial institution to debit [Principle's] transfer account and transfer money from that account." 

    Ironshore argued that the email was not a "fraudulent instruction" under the policy because someone purporting to be an outside attorney, not a principle employee, sent it. Again, the court disagreed. Nothing in the policy language warranted the assumption that the two emails could not be part of the same fraudulent instruction. Reading the two emails together left no doubt that they were part of the same fraudulent instruction.

    Ironshore next contended that Principle's losses did not "result directly from" a fraudulent instruction as the policy required. Because the loss depended on Lien's conversations with Leach and Wells Fargo, which occurred after Nazarian's purported email to Lien to wire money, Ironshore concluded that no immediate link existed between the instruction and the loss. The court noted that reading the phrase "resulting directly from" as a whole required the court to define "directly" within the context of causation. And in that context, "directly" meant proximately. The ordinary meaning of "resulting directly from" required the court to determine whether the fraudulent instruction proximately caused Principle's loss.

    Ironshore contended that Lien's communications with Leach and Wells Fargo involvement severed the causal chain. But these events that intervened between Nazarian's purported email and Principle's loss were foreseeable consequences of the email. Therefore, the loss "resulted directly from" the purported email and the policy covered the loss.