The US District Court for the Northern District of Texas, Dallas Division has ruled that the insurers for a property management software company are not obligated to compensate the company for money lost in a phishing scheme after the company failed to technically hold that the funds were stolen. The case is RealPage Inc. v. National Union Fire Insurance Co. of Pittsburgh, PA and Beazley Insurance Co., Inc. 2021 U.S. Dist. LEXIS 341116.
RealPage is a company that provides services for property owners and managers such as collecting rent and other payments from residents and transferring those payments to its clients. The payments are made through a third-party payment processor, Stripe Inc., and held in Stripe's bank account before being passed on to the clients.
RealPage had a commercial crime policy through AIG's National Union Fire INsurance. The policy provided $5 million in coverage subject to a $50,000 deductible and covered property owned or held by the policyholder. RealPage also had an excess fidelity and crime policy through Beazley that had a $5 million liability limit.
In May, 2018, in a phishing scheme, hackers were able to obtain RealPage's credentials and used them to access funds held by Stripe. The hackers diverted more than $10 million that had not yet been dispersed to RealPage's clients. RealPage recovered $4 million of the funds but was unable to recover the other $6 million.
AIG denied coverage for the phishing loss on the basis that at the time of the theft RealPage did not own or hold the funds. RealPage filed suit against AIG and Beasley, agreeing that if the losses were not covered by AIG they would be covered by the Beasley policy.
The court found in favor of AIG, noting that while RealPage had the authority to direct the fund transfer, that did not amount to holding the funds, and the funds were in an account under Stripe's name, not RealPage's so RealPage had no rights to the funds and did not possess the funds in any way so RealPage did hot "hold" the funds.
The court granted the insurers summary judgment and dismissed the case.
Editor's Note: With increased numbers of employees working from home, companies are finding themselves more susceptible to phishing schemes. Here, one may wonder how the case even got to the level it did. According to the FC&S Experts, it seems obvious from a cursory review that the funds were not in RealPage's possession.