Phishing Victim Can’t Claim $5 Million Loss on Crime Policy for Money It Never ‘Held’

A federal appeals court ruled that RealPage's commercial-crime insurance policy did not cover a $5 million phishing loss because the property-management service provider never "held" any of the stolen funds.

Source: Reuters | Published on December 27, 2021

Roku cyber breach

The 5th U.S. Circuit Court of Appeals upheld a victory for AIG's National Union Fire Insurance Company of Pittsburgh, which insured RealPage against theft of property owned, leased, or "held for others."

The appeals court ruled that RealPage's loss did not qualify because it had only provided information and instructions to Stripe, an online payment processor that transferred rent money from tenants to the property management firms that RealPage represented.

"In other words, when money changed hands, RealPage's fingers never touched it," wrote Circuit Judge Cory Wilson, who was joined by Chief Circuit Judge Priscilla Owen and Circuit Judge Edith Jones in the decision.

The company and law firm names displayed above are generated automatically based on the article's text. As we continue to test and develop in beta, we are improving this feature. We appreciate feedback, which you can provide by clicking on the feedback tab on the right side of the page.

According to a complaint filed by RealPage in federal court in Dallas, "bad actors" obtained its log-in credentials in April 2018 by sending an email that appeared to be from Stripe and included a bogus link.

The scammers diverted approximately $10 million in payments using the log-in credentials. RealPage, on the other hand, quickly detected the fraud and notified Stripe, which was able to stop payment or recover nearly $4 million.

RealPage reimbursed its client property managers for the remainder and filed a claim with National Union and its excess carrier, Beazley Insurance, for more than $6 million.

National Union determined that RealPage "owned" approximately $1 million in service fees that it would have received had the transactions been legal, but denied coverage for the remaining $5.1 million because RealPage never "held" that money because it never possessed it.

In March, the district court ruled in favor of both insurers.

RealPage argued on appeal that possession was unnecessary because it "held" the funds by controlling the payment instructions. The Fifth Circuit, however, disagreed.

"While Stripe handled the funds as directed by RealPage, Stripe, not RealPage, ultimately controlled the funds in Stripe's custody — as evidenced by the fact that RealPage could do nothing to recover the stolen funds without Stripe's assistance," the court ruled.

Darin Brooks of Gray Reed & McGraw, National Union's lead lawyer, declined to comment on Wednesday. RealPage's lawyers at Pillsbury Winthrop Shaw Pittman did not respond to requests for comment right away.