Interactive Communications International, Inc. v. Great American Insurance Company

• Court: Court of Appeals for the Eleventh Circuit
• Decided: May 10, 2018
• Docket: 17-11712
• Status: Unpublished

Opinion

Case: 17-11712 Date Filed: 05/10/2018 Page: 1 of 15

[DO NOT PUBLISH]

IN THE UNITED STATES COURT OF APPEALS

FOR THE ELEVENTH CIRCUIT ________________________

No. 17-11712 ________________________

D.C. Docket No. 1:15-cv-02671-WSD

INTERACTIVE COMMUNICATIONS INTERNATIONAL, INC. et al.,

Plaintiff-Appellants,

versus

GREAT AMERICAN INSURANCE CO.,

Defendant-Appellee.

________________________

Appeal from the United States District Court for the Northern District of Georgia ________________________

(May 10, 2018)

Before MARCUS and NEWSOM, Circuit Judges, and BUCKLEW,* District Judge.

PER CURIAM:

____________________ *Honorable Susan C. Bucklew, United States District Judge for the Middle District of Florida, sitting by designation. Case: 17-11712 Date Filed: 05/10/2018 Page: 2 of 15

This insurance-coverage case arises out of a “Computer Fraud” policy issued

by Great American Insurance Company to Interactive Communications

International, Inc. and HI Technology Corp. (together, “InComm”). InComm sells

“chits”—each of which has a specific monetary value—to consumers, who can

then “redeem” them by loading their value onto a debit card. InComm lost a lot of

money—$11.4 million—when fraudsters manipulated a glitch in InComm’s

computerized interactive-telephone system that enabled them to redeem chits

multiple times, with each duplicative redemption of an already-redeemed chit

defrauding InComm of the chit’s value. We hold, though, that InComm’s

insurance policy does not cover its loss. Although the fraudsters did “use [a]

computer” within the meaning of the policy, we conclude that InComm’s loss did

not “result[] directly” from the computer fraud, as required by the policy’s plain

language.

I

InComm operates a network that allows consumers to put money onto

general-purpose reloadable debit cards issued by banks. In particular, InComm

sells “chits” to consumers, which they can then use to transfer funds to their cards.

After purchasing a chit at a retailer like CVS or Walgreens, a consumer can simply

call InComm to redeem the chit and have its value moved over to his card.

When a consumer dials InComm’s 1-800 number to redeem a chit, he is

2 Case: 17-11712 Date Filed: 05/10/2018 Page: 3 of 15

connected to InComm’s interactive voice response (“IVR”) computer system. The

IVR system uses eight computers that process voice requests or telephone touch-

tone codes. To redeem a chit through InComm’s IVR, a consumer enters his debit

card number and the PIN located on the back of the chit. The IVR then credits the

value of the chit to the card, and the funds become immediately available to the

cardholder.

After making the funds available for use, InComm is contractually obligated

to transfer money, equivalent to the value of the redeemed chit(s), to the bank that

issued the debit card. By contract, InComm is obligated to transfer the funds

within 15 days, although as a matter of standard practice, InComm typically does

so within 24 hours. The funds are maintained in the card-issuing bank, for the

cardholder’s benefit, until he uses the card to conduct a transaction. Because

InComm’s computer system immediately credits the value of a redeemed chit to a

debit card, a cardholder could make purchases using a debit card before or after

funds sufficient to cover the value of the redeemed chit are transferred from

InComm to the card-issuing bank.

Between November 2013 and May 2014, fraudsters exploited a vulnerability

in InComm’s IVR system that enabled multiple redemptions of a single chit.

Specifically, the fraudsters figured out that they could redeem a single chit multiple

times by making two or more concurrent calls to the IVR system and

3 Case: 17-11712 Date Filed: 05/10/2018 Page: 4 of 15

simultaneously requesting the redemption of a particular chit. One call would

transfer the funds from the chit to the debit card account, while the other would

return the chit to an “unredeemed” state, allowing it to be redeemed again. Over

seven months, InComm’s system processed 25,553 fraudulent redemptions

associated with 1,988 individual chits.

The fraudulent redemptions cost InComm $11.4 million. The vast majority

of that loss—$10.7 million—was redeemed on debit cards issued by Bancorp bank.

It is that $10.7 million sum that is at issue in this case. Pursuant to InComm’s

contract with Bancorp, InComm sold chits to consumers and provided the IVR

computer system that allowed the users to transfer the chit’s value to their

Bancorp-issued debit cards. Once InComm’s IVR system was used to redeem a

chit, the chit’s value was made available for use on the Bancorp card. Bancorp

was obligated to transfer funds to merchants to cover purchases made using their

debit cards, and InComm, in turn, was obligated to transfer funds equivalent to the

value of the redeemed chit(s) to a Bancorp account through which Bancorp pays

for those purchases.

The fraudsters’ simultaneous calls to InComm’s IVR system resulted in

duplicate funds being made immediately available on Bancorp customers’ debit

cards. Because InComm believed the transactions to be legitimate, it wired funds

to Bancorp to cover the purchasing power made available on the cards.

4 Case: 17-11712 Date Filed: 05/10/2018 Page: 5 of 15

II

The insurance policy at issue protects InComm against “Computer Fraud.”

In particular—and the language is important—the policy provides coverage for

“loss of, and loss from damage to, money, securities and other property resulting

directly from the use of any computer to fraudulently cause a transfer of that

property from inside the premises or banking premises: (a) to a person (other than

a messenger) outside those premises; or (b) to a place outside those premises.”

InComm seeks coverage for the $10.7 million lost to Bancorp debit card

holders who fraudulently manipulated InComm’s IVR system to effectuate

duplicate redemptions of InComm chits.

The district court granted Great American’s motion for summary judgment.

It held that the computer-fraud policy did not cover InComm’s claimed loss for

two reasons. First, the court concluded that the fraud was not accomplished

through “the use of a[] computer” within the meaning of InComm’s policy; and

second, it held that, in any event, InComm’s loss did not “result[] directly” from

the use (computer or otherwise) of the IVR system. Although we disagree with the

district court’s determination that the fraudsters’ simultaneous phone calls to the

IVR system did not constitute “use of a[] computer,” we agree with the court’s

conclusion that InComm’s loss did not “result[] directly” from the computer fraud.

Accordingly, we affirm the district court’s judgment that InComm’s loss is not

5 Case: 17-11712 Date Filed: 05/10/2018 Page: 6 of 15

covered.

III

Great American contends, and the district court concluded, that the policy

does not cover InComm’s claimed loss because the scam was not perpetrated

through “the use of a[] computer.” We disagree.

All parties agree that the IVR system comprises eight computers that process

transaction requests from cardholders. Thus, the dispute over the “use of a[]

computer” provision reduces to the question whether phone calls made to a

computer system constitute “use” of that computer system.

The district court started with the dictionary definitions of the terms

“computer” and “telephone.” Based on those definitions, it concluded that “[a]

‘telephone’ is not a ‘computer’” but, rather, “a completely different device.” Thus,

the court held, the phones with which fraudsters had dialed the IVR system were

not computers within the meaning of InComm’s policy.

But because the fraud here involved both telephones and computers, we

cannot stop there. The question is whether the fraudsters “use[d]” both phones

and computers to perpetrate their scheme—namely, using the phones to

manipulate—and thereby use—the IVR computers. In rejecting InComm’s

argument, the district court seems to have imposed additional conditions not

required by the policy’s plain language—for instance, that the computer “use” be

6 Case: 17-11712 Date Filed: 05/10/2018 Page: 7 of 15

knowing. See, e.g., Dist. Ct. Op. at 26 (“There is no record evidence that

cardholders even realized their telephone calls resulted in interaction with a

computer.”).

But the plain meaning of the word “use”—indeed, as evidenced in the very

definitions cited by the district court—comfortably supports an understanding that

encompasses the callers’ access and manipulation of InComm’s IVR system. The

district court, for instance, cited both the Oxford Dictionaries’ online definition of

the term “use” to mean “take, hold, or deploy (something) as a means of

accomplishing or achieving something; employ,” and Webster’s Encyclopedic

Unabridged Dictionary’s definition to mean “to employ for some purpose; put into

service; make use of.” Oxford Dictionaries,

https://en.oxforddictionaries.com/definition/use; Webster’s Encyclopedic

Unabridged Dictionary of the English Language 2097 (2001). Those definitions, it

seems to us, fit like a glove. Here, the callers clearly “deploy[ed]”—or

“employ[ed]”—the IVR computer system “as a means of accomplishing or

achieving” fraudulent duplicate redemptions of InComm chits. See Oxford

Dictionaries, https://en.oxforddictionaries.com/definition/use. So too, under the

district court’s Webster’s-based definition, the callers “used” the IVR system,

“employ[ing]” it “for some purpose; put[ting it] into service; mak[ing] use of” it.

See Webster’s Encyclopedic Unabridged Dictionary of the English Language

7 Case: 17-11712 Date Filed: 05/10/2018 Page: 8 of 15

(2001).

Other dictionaries confirm what the district court’s own indicate. Webster’s

Second New International Dictionary, for instance, defines “use” as “to convert to

one’s service; to avail oneself of; to employ.” Webster’s New International

Dictionary at 2806 (2d ed. 1939). There simply can be no doubt that the fraudsters

“convert[ed]” InComm’s IVR computer system to their service and “avail[ed]”

themselves of it by submitting fraudulent reload requests to the computer system in

a way that yielded duplicate chit redemptions. To be clear, it is not the case, as the

district court suggested, that the IVR system was just “somehow involved” in the

fraudsters’ scheme, or that the system was merely “engaged at any point in the

causal chain.” Rather, the fraudsters interfaced directly with the IVR computer

system to effectuate their duplicate redemptions. Thus, we conclude that the fraud

against InComm was perpetrated through the “use of a[] computer” within the

terms of its insurance policy.

IV

But that is not the end. The question remains whether the “loss of …

money” that InComm suffered here “result[ed] directly” from the use of the IVR.

Like the district court, we conclude that it did not.1 In explaining why, we must

1 We assume for the purposes of this opinion—without deciding—that the use of the IVR “fraudulently cause[d] a transfer of … property from inside the … banking premises … to a person [or] place outside those premises” within the meaning of InComm’s policy.

8 Case: 17-11712 Date Filed: 05/10/2018 Page: 9 of 15

explore two sub-issues. First, as a matter of law, what exactly does the phrase

“result[] directly” mean? And second, as a matter of fact, when did InComm’s loss

occur?

A

Not surprisingly, the parties have different views about what it means for a

loss to “result[] directly” from a computer fraud. For its part, InComm contends—

not without some support—that the policy’s “resulting directly” language entails

only a showing of proximate cause. See, e.g., Scirex Corp. v. Fed. Ins. Co., 313

F.3d 841, 850 (3d Cir. 2002) (applying Pennsylvania law that equates “direct

cause” with “proximate cause”); see also Retail Ventures, Inc. v. Nat’l Union Fire

Ins. Co. of Pittsburgh, Pa., 691 F.3d 821, 831-32 (6th Cir. 2012) (holding that

under Ohio law, a “proximate cause” standard should be used “to determine

whether plaintiffs sustained loss ‘resulting directly from’ the ‘theft of Insured

property by Computer Fraud’”). With its own cases in tow, Great American urges

us instead to adopt a reading of “resulting directly” that requires immediacy

between conduct and result. See, e.g., Apache Corp. v. Great Am. Ins. Co., 662 F.

App’x 252, 258 (5th Cir. 2016) (declining to extend coverage where a loss caused

by a fraudulent transfer was “the result of other events and not directly [caused] by

9 Case: 17-11712 Date Filed: 05/10/2018 Page: 10 of 15

the computer use”).2

Rather than following the thread of close-but-not-quite-on-point cases from

other jurisdictions, however, we look to the plain language of InComm’s policy. It

is a fundamental principle of Georgia law—and law more generally—that words in

contracts “generally bear their usual and common signification[.]” Ga. Code Ann.

§ 13-2-2(2); accord, e.g., A. Scalia & B. Garner, Reading Law: The Interpretation

of Legal Texts at 69 (2012) (“The ordinary meaning rule is the most fundamental

semantic rule of interpretation. It governs constitutions, statutes, rules, and private

instruments.”). Accordingly, if the phrase “resulting directly” has a “common

signification”—i.e., an ordinary meaning—then we have to find and enforce it.

The dispute here, of course, is not about the term “resulting,” but rather the

word “directly”: What does it mean for a result to follow a cause “directly”?

Common-language and legal dictionaries provide a clear (and essentially the same)

answer. Webster’s Second, for instance, defines “direct” to mean “(1) straight;

proceeding from one point to another in time or space without deviation or

2 The delta between the parties’ competing readings may be smaller than it appears. As Justice Cardozo taught us years ago, proximate cause serves to limit liability, not expand it. See Palsgraf v. Long Island R. Co., 162 N.E. 99, 101 (N.Y. 1928). To that end, Black’s defines “Proximate Cause,” in relevant part, as “[a] cause that directly produces an event and without which the event would not have occurred.—Also termed (in both senses) direct cause; direct and proximate cause ….” Black’s Law Dictionary at 265 (10th ed. 2014) (emphasis added). Webster’s Second provides a similar definition: “[A] cause which directly or with no mediate agency produces an effect; specifically in law, that which in ordinary natural sequence produces a specific result, no independent disturbing agencies intervening.” Webster’s New International Dictionary at 1995 (2d ed. 1939).

10 Case: 17-11712 Date Filed: 05/10/2018 Page: 11 of 15

interruption; not crooked or oblique …; (2) Straightforward; going straight to the

point …; (3) Immediate; marked by the absence of an intervening agency or

influence; making contact or effected without an intermediary[.]” Webster’s New

International Dictionary at 738 (2d ed. 1939). In the same way, Black’s defines

“direct” to mean “(1) straight, undeviating; (2) straightforward; (3) free from

extraneous influence, immediate; (4) of, relating to, or involving passing in a

straight line of descent, as distinguished from a collateral line.” Black’s Law

Dictionary at 265 (10th ed. 2014).

The theme is unmistakable. In accordance with the term’s ordinary

meaning, we hold that, for purposes of InComm’s policy, one thing results

“directly” from another if it follows straightaway, immediately, and without any

intervention or interruption.

B

Which leads to the factual question: When, exactly, did InComm’s loss

occur? And based on the answer to that question, did InComm’s loss “result[]

directly” (as we have interpreted that phrase) from the fraudsters’ misuse of

InComm’s IVR computer system?

We conclude that although the fraudsters’ manipulation of InComm’s

computers set into motion the chain of events that ultimately led to InComm’s loss,

their use of the computers did not “directly”—which is to say immediately and

11 Case: 17-11712 Date Filed: 05/10/2018 Page: 12 of 15

without intervention or interruption—cause that loss. To the contrary, several

steps typically intervened between the fraudulent manipulation of the IVR system

to enable duplicate chit redemptions, on the front end, and InComm’s ultimate loss,

on the back. Here is a timeline of sorts:

• Step 1: The fraudsters manipulate InComm’s IVR system to enable a duplicate chit redemption. For each fraudulently redeemed chit, a fraudster’s debit card is immediately credited with purchasing power, but InComm’s funds are neither transferred, nor disturbed, nor altered in any way.

• Step 2: Shortly after processing a redemption call through the IVR system, InComm transfers money (equal to the amount of the redeemed chits) to an account at Bancorp for the purpose of paying debts incurred by debit card holders. Bancorp maintains the account “for the benefit of” InComm as “holder[] of the Cardholder Balances for the benefit of [Debit] Cardholders.” Although InComm is contractually obligated to transfer funds to the Bancorp account within 15 days of making the corresponding purchasing power available on debit cards, as a matter of regular business practice it transfers the money to Bancorp within 24 hours. The funds remain in the Bancorp account until needed to cover purchases made on a consumer’s debit card.

• Step 3: A debit card user makes a purchase from a merchant, incurring debt to be paid from the InComm-earmarked Bancorp account.

• Step 4: Bancorp transfers money from the account to the merchant to cover the purchase made by the cardholder.3

3 In the ordinary course, the fraud and transfer of funds would proceed as sequenced here. It is at least possible, however, that the expenditure of the fraudulently obtained funds could occur almost immediately after the commission of the fraud. Therefore, even though InComm

12 Case: 17-11712 Date Filed: 05/10/2018 Page: 13 of 15

InComm insists that its loss occurred at Step 2—and is thus “directly” the

result of the Step-1 fraud. In particular, InComm says that upon transfer of funds

to the account held by Bancorp, it lost both ownership and control of those funds.

But the facts of the case demonstrate otherwise—that, in fact, InComm retained at

least some control over the funds held by Bancorp even after the Step-2 transfer,

and could prevent their loss by intervening to halt the disbursement of money from

the Bancorp account to merchants at Step 4. On one particular occasion, after

identifying fraud associated with $1.9 million in duplicate redemptions by some

debit card holders, InComm stepped in to prevent the cards from engaging in

further transactions. InComm did so unilaterally, and indeed did not even inform

Bancorp that it had done so for nearly a month. That $1.9 million was not “los[t]”;

rather, it remains to this day in the InComm-earmarked account held by Bancorp.

Accordingly, InComm’s loss did not occur with the Step-2 transfer of funds

to the account held by Bancorp. Rather, the loss did not occur until—at Step 4—

transfers funds to Bancorp within 24 hours of a chit redemption, it is possible that a cardholder might spend fraudulently obtained funds before InComm makes the corresponding transfer to Bancorp. Despite this potential variation in the sequencing of steps leading to InComm’s loss, InComm has always maintained that its loss occurred at the moment it transferred funds to Bancorp, not at the moment that fraudulently obtained purchasing power was used by cardholders. See, e.g., Br. of Appellant 21 (“InComm’s loss … occurred when the money was transferred to Bancorp.”). Thus, the potential for variation in the timing of cardholder purchases in the fraud-loss sequence does not change the outcome of this case. We are not obliged to consider arguments not raised by the parties. See United States v. Campa, 529 F.3d 980, 989 (11th Cir. 2008) (arguments not made in a party’s initial brief are abandoned).

13 Case: 17-11712 Date Filed: 05/10/2018 Page: 14 of 15

Bancorp actually disbursed money from the InComm-earmarked account to pay

merchants for purchases made by cardholders. That was the point at which

InComm could not recover its money. That was the point of no return.

That being the case, it seems clear to us that InComm’s loss did not “result[]

directly” from the initial computer fraud. Far from being immediate, the loss was

temporally remote: days or weeks—even months or years—could pass between the

fraudulent chit redemption and the ultimate disbursement of the fraud-tainted funds

from InComm’s Bancorp account. And it is not just that the loss was remote in

time; the chain of causation involved intervening acts and actors between the Step-

1 fraud and the Step-4 loss. Even after a chit was fraudulently redeemed, each of

the following had to occur: (1) InComm had to transfer money to the Bancorp

account; (2) the cardholder had to make a purchase using fraudulently obtained

funds; and (3) Bancorp had to disburse money from InComm’s account to cover

the purchase and pay the merchant. It was only at that point that InComm’s loss

truly materialized. The lack of immediacy—and the presence of intermediate

steps, acts, and actors—makes clear that the loss did not “result[] directly” from

the initial fraud.

V

Because InComm’s loss did not “result[] directly” from the fraudulent use of

its IVR computer system, the loss is not covered by its insurance policy. We

14 Case: 17-11712 Date Filed: 05/10/2018 Page: 15 of 15

therefore affirm the district court’s grant of summary judgment in favor of Great

American.

AFFIRMED.