The Cincinnati Insurance Company v. Norfolk Truck Center, Inc.

• Court: District Court, E.D. Virginia
• Decided: December 20, 2019
• Docket: 2:18-cv-00531
• Status: Unknown

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF VIRGINIA FI LE D Norfolk Division THE CINCINNATI INSURANCE ) COMEANSs CLERK, US. DISTRICT COUP Plaintiff, ) NORFOUKVA

v. Civil Action No. 2:18-ev-531 THE NORFOLK TRUCK CENTER, INC., ) ) Defendant. ) OPINION & ORDER After reviewing the briefing and hearing the arguments presented by the parties during the trial on this matter, and considering the stipulated facts before this Court, the Court enters the following findings of fact and conclusions of law pursuant to Federal Rules of Civil Procedure 52(a). Any item marked as a finding of fact or otherwise which may also be interpreted as a conclusion of law is hereby adopted as such. Any item marked as a conclusion of law or otherwise which may also be interpreted as a finding of fact is hereby adopted as such. I. INTRODUCTION This insurance contract case asks whether an insurance company (Plaintiff) must indemnify its insured (Defendant) for the insured’s failure to discover and falling victim to a fraudulent e- mail scheme related to legitimate invoice payments. The facts of this case are undisputed. A list of stipulated factual findings is enumerated infra at 5-15. On August 25, 2017, Defendant, a dealer of commercial trucks, received an order from the City of Norfolk for two (2) trucks. To meet that demand, Defendant ordered truck parts from Kimble Mixer Company (“Kimble Mixer”), an entity that manufactures truck parts. Defendant

received an e-mail from an unidentified imposter (hereinafter, “the Imposter”), who represented himself! to be an employee of Kimble Mixer. Imposter gave fraudulent money payment instructions via e-mail to satisfy the payments on the City of Norfolk Trucks. After completing appropriate paperwork with its bank, Defendant authorized its bank to issue a wire transfer of $333,724.00 in accordance with Imposter’s instructions. Subsequently, Kimble Mixer asked why it had not received payment for the truck parts. Upon discovering that it had fallen victim to a fraud scheme, Defendant filed an insurance claim, asserting that Plaintiff should indemnify Defendant for the fraudulent loss, under the “Computer Fraud” provision of the parties’ insurance contract. That insurance provision provides that Plaintiff will pay for “loss of ... money... resulting directly from the use of any computer to fraudulently cause a transfer of that property from inside the premises or banking premises . . . [t]o a person (other than a “‘messenger”) outside those premises.” Trial Ex. 1 at 24 of 39.? Plaintiff denied the claim and filed this lawsuit seeking declaratory judgment that it is not obligated to pay it. Il, JURISDICTION AND VENUE This Court has subject matter jurisdiction over this case pursuant to 28 U.S.C. § 1332. Plaintiff is incorporated in the State of Ohio and maintains its principal place of business in Ohio. Doc. 1 at 1, Doc. 4 at 1. Defendant is incorporated under the laws of the State of Delaware,’ with its principal place of business in Norfolk, Virginia. Doc. 1 at 2, Doc. 4 at 2. The amount in

' The Imposter is unidentified: accordingly, the parties and the Court have no way knowing his or her gender. The record only shows that the Imposter’s online alias is “Donkey.” For continuity, this Opinion and Order will use the masculine pronouns, “he,” “him,” “his,” or “himself” in reference to the Imposter. ? The page numbers used herein to mark the “pin citations” of the Insurance Contract, Trial Ex. 1, are the page numbers used in the CM/ECF heading, because the Insurance Contract, as a whole, contains multiple parts, with no unified pagination system. 3 In its Complaint, Plaintiff alleged that Defendant is a Virginia corporation. Doc. | at 2. Defendant denied that allegation and averred that it is actually a Delaware corporation. Doc. 4 at 1. Defendant’s allegation is more credible, and, in any event, neither location would destroy diversity of citizenship.

controversy of this case exceeds $75,000; accordingly, this Court has diversity of citizenship subject matter jurisdiction. This Court has personal jurisdiction over Defendant, because Defendant maintains its principal place of business in this District and Division, and by consent and/or waiver of Defendant. Doc. 4 at 2. This Court is the appropriate venue for this matter, because Defendant maintains its principal place of business in this District and Division, the fact a substantial part of the events giving rise to the instant claim occurred in this District and Division, and by consent and/or waiver of Defendant. 28 U.S.C. § 1391(b), Doc. 4 at 2. it, PROCEDURAL HISTORY This case was filed on October 17, 2018, when the Cincinnati Insurance Company (“Plaintiff”) filed a complaint for declaratory judgment against the Norfolk Trucking Company (“Defendant”). Doc. 1. Plaintiff asks this Court to declare that it is not obligated to indemnify Defendant under the parties’ insurance contract for losses stemming from the fraudulent scheme. Defendant answered the complaint on December 20, 2018, and demanded a jury trial. Doc. 4, No motions practice occurred until September 2019. On September 19, 2019, Plaintiff moved for summary judgment. Doc. 11. The parties jointly moved to continue the trial, originally scheduled to commence on October 22, 2019, on September 27, 2019.4 Doc. 13. On October 2, 2019, Defendant filed a “Cross Motion for

4 The parties filed their motions for summary judgment and opening briefs in support thereof on dates such that the Court could not reasonably resolve the motions before trial. Accordingly, the motions were untimely. See Loc. R. Civ, 56(A). At the October 9, 2019, final pretrial conference the Court and the parties agreed that, because the facts of the case are entirely undisputed (except to the extent Defendant alleges that the insurance contract covers this dispute), that the summary judgment record could be converted to a bench trial. The Court rescheduled arguments to take place after the motions practice had fully matured.

Summary Judgment and Motion in Opposition to [Plaintiff's] Motion for Summary Judgment.” Doc. 14. This Court convened for a Final Pretrial Conference on October 9, 2019. At the Final Pretrial Conference, the parties agreed that this matter could be resolved by a bench trial, because all of the facts in this matter are stipulated. Defendant withdrew its jury demand. A bench trial was scheduled for Wednesday, December 11, 2019. Although the matters were asserted on summary judgment motions, the United States Court of Appeals for the Fourth Circuit recognizes that district courts may, in a limited set of cases, treat a summary judgment record as a bench trial record. International Bancorp, LLC v. Societe des Bains de Mer et du Cercle des Estrangers a Monaco, 329 F.3d 359, 362 (4th Cir. 2003) (“It makes little sense to forbid the judge from drawing inferences from the evidence submitted on summary judgment when that same judge will act as the trier of fact, unless those inferences involve issues of witness credibility or disputed material facts. If a trial on the merits will not enhance the court’s ability to draw inferences and conclusions, then a district judge properly should draw his inferences without resort to the expense of trial.” (quoting Matter of Placid Oil Co., 932 F.2d 394, 398 (Sth Cir. 1991)). Accordingly, the Court addressed the parties’ stipulated factual record and motions for summary judgment at the December 11, 2019, bench trial. IV. LEGAL STANDARD Under Virginia law,” the insured bears the initial burden to establish a prima facie case that the insurance policy covers the dispute. SunTrust Mtg., Inc. v. AIG United Guar. Corp., 800 F. Supp. 2d 722, 731 (E.D. Va. 2011). If the insured is successful, the burden shifts to the insurer to establish an affirmative defense, such as an application of a policy exclusion. Id.

5 The parties agree that Virginia law applies. Doc. 12 at 14, Doc. 15 at 13.

An insurance contract should be construed in line with the intent of the parties, as evidenced by the terms of the contract. Id. (citing Nat’| Hous. Bldg. Corp. v. Acordia of Virginia Ins. Agency, 591 S.E. 2d 88, 90-91 (Va. 2004)). If the terms of a contract are “clear and unambiguous, their terms are to be taken in their plain, ordinary and popular sense.” Erie Ins. Exch. v. EPC MD 15, LLC, 822 S.E.2d 351, 355 (Va. 2019). Indeed, “[t]he plain meaning of a word depends not merely on semantics and syntax but also on the holistic context of the word within the instrument.” Id. If the plain meaning is undiscoverable, a court should apply the doctrine of contra proferentem and construe the contract against the drafter. Id. (citing TravCo Ins. v. Ward, 736 S.E.2d 321 (2012)). Such an ambiguity only arises when conflicting interpretations are reasonable. Dress v. Capital One Bank United States, N.A., Civ. No.: 1:19-cv-343, 2019 WL 3451304, 2019 U.S. Dist. LEXIS 126980 at *11 (E.D. Va. July 20, 2019) (citing Erie Ins. Exh., 822 $.E.2d at 355)). V. FINDINGS OF FACT In the parties’ summary judgment briefing, they agreed that the following detailed list of facts are undisputed. Accordingly, the Court hereby adopts the parties’ stipulated facts and FINDS the following: A. THE PARTIES l. Plaintiff issued a contract of commercial insurance to Defendant, bearing Policy No. ENP0243066, effective from March 1, 2017, through March 1, 2020 (the “Insurance Contract”). Doc. 495. That contract was attached as exhibit 1 to the complaint and received as Trial Exhibit 1.° 2. Defendant is a dealership for commercial medium- and heavy-duty trucks

tn addition to jointly stipulating the facts of this case, the parties jointly moved for the admission of eleven (1 1) trial exhibits, a demonstrative aid, and expert witness designations.

manufactured by Crane Carrier Company (“Crane Carrier”), among other manufacturers. Doc. 1496. 3. Kimble Mixer Company (“Kimble Mixer”) is a dealer in commercial truck parts. Doc. 1 ¥ 7. 4, Kimble Mixer and Crane Carrier are both under the umbrellas of the Hines Specialty Vehicle Group, which uses Kimble Mixer to invoice Crane Carrier trucks. D. Harlow Examination Under Oath (“EUO”), Doc. 12-2, at 36:23-37:8. B. THE HAMPTON ORDERS 5. In or about 2016, Norfolk Truck received an order for two trucks from the City of Hampton (the “City of Hampton Trucks”). Doc. 1 § 9. 6. Norfolk Truck ordered the chassis for the City of Hampton Trucks from Crane Carrier through Kimble Mixer. Doc. | 4 10. 7. On or about December 22, 2016, at 10:25 am., Lorraine Farrow, Accountant for Kimble Mixer, sent an e-mail to David Harlow, President and CEO of Norfolk Truck, to which e-mail was attached two invoices for the City of Hampton Trucks, Invoice Number H1674462 and Invoice Number H1674463 (together, the “City of Hampton Truck Invoices”). Trial Ex. 2, Doc. 1 J 11. Doc. 4 14. 8. Lorraine Farrow’s e-mail address on her December 22, 2016, 10:25

a.m. electronic mail was “Ifarrow@kimblemixer.com”. Trial Ex. 2, Doc. 1 § 12 (emphasis added) (referred to herein as the “Legitimate E-mail Address’’). 9. In her December 22, 2016, e-mail, Lorraine Farrow stated that Norfolk Truck should wire the payment for the City of Hampton Truck Invoices as follows: MERCANTILE BANK OF 7 Except where otherwise stated, a cited allegation in the complaint is admitted by Defendant.

MI ABA: 072413829 ACCT NO: 100145812 Trial Ex. 2, Doc. 1 15. 10. By e-mail dated December 29, 2016, at 09:11 a.m., David Harlow forwarded the City of Hampton Truck Invoices to Betty Reynolds, Secretary/Treasurer of Norfolk Truck. Trial Ex. 2, Doc. 1 9 13. 11. The address for Kimble Mixer on the Hampton Truck Invoices was as follows: Kimble Mixer Company (dba) HSVG 1951 Reiser Ave. SE New Philadelphia, OH 44663 330-306-6700 (PH) 330-339-4892 (FX) Trial Ex. 2, Doc. 1 4 16. 12. Betty Reynolds forwarded the City of Hampton Truck Invoices for payment under Norfolk Truck’s floor plan arrangement with Norfolk Truck’s lender, Southern Bank. Doc. 1 917. 13. The City of Hampton Invoices were paid by means of a wire transaction from Southern Bank to Kimble Mixer on or about December 29, 2016, according to the original and accurate wiring instructions sent by Lorraine Farrow at Kimble Mixer. Id. ¥ 18. 14. On December 29, 2016, at 8:42 p.m., David Harlow received an e-mail, allegedly from Lorraine Farrow at Kimble Mixer, but actually came from the Imposter who was not Lorraine Farrow. Trial Ex. 2, Doc. 1 4 19. 15. On the December 29, 2016, 8:42 p.m., e-mail, the Imposter used electronic mail address “farrow@kimblesmixer.com” (referred to herein as the “Fraudulent E-mail Address”), which removed the “1!” character from the front of the address, and added the “s”

character between “kimble” and “mixer.”® See Trial Ex. 2, Doc. 1 920. 16. In the December 29, 2016, 8:42 p.m., e-mail, the Imposter stated that: Hello David, You might have to hold off wire as I just got a directive to stop all pending transactions on our current bank account. I will prepare the updated banking info on our letterhead and send to you shortly. I sincerely apologize for this embarrassing situation. Thank you. Lorraine Farrow Trial Ex. 2, Doc. 1 ¥ 21. 17. On December 29, 2016, at 9:41 p.m., David Harlow received another e-mail from the Imposter, which stated as follows: Hello David, Find the attached wiring instructions. Let me know when wire is sent. Thank you. Lorraine Farrow Trial Ex. 2, Doc. 1 4 22. 18. The wiring instructions attached to the December 29, 2016, 9:41 p.m., e-mail stated as follows: Kimble Mixer Company (dba) HSVG 1951 Reiser Ave. SE New Philadelphia, OH 44663 330-306-6700 (PH) 330-339-4892 (FX) ® Thus, the Imposter modified the Legitimate E-mail Address as follows: #farrow@kimblesmixer.com See Trail Ex. 2.

WIRING INSTRUCTIONS Account Name/Beneficiary: THEWO INVESTMENT LLC 1951 Reiser Ave. SE New Philadephia, OH 44663 Beneficiary Bank: © BANK OF AMERICA 1 Perimeter Center EAST Atlanta, GA 30346 Routing #: 026009593 Account #: 3340048077077 Trial Ex. 2, Doc. 1 4 23. 19. □ David Harlow understood that Norfolk Truck already had sent the payment for the City of Hampton Truck Invoices to Kimble Mixer pursuant to the original wiring instructions. Doc. 1 ¥ 24. 20. David Harlow did not forward the Imposter’s wiring instructions to Betty Reynolds or any other person at Norfolk Truck. Doc. 1 § 26. 21. David Harlow did not recognize that the email address on the Imposter’s e-mails was not authentic following the December 29, 2016, e-mail from the Imposter. Doc. 1 § 27. C. THE NORFOLK ORDER 22. On August 25, 2017, Norfolk Truck received an order for two trucks from the City of Norfolk (the “City of Norfolk Trucks”). Doc. 1 4 28. 23. On August 25, 2017, at 10:49 am., Norfolk Truck received an e-mail purportedly from Lorraine Farrow at Kimble Mixer, but which came from the Imposter at the Fraudulent E-mail Address. Doc. 4 | 30. That e-mail states: Hello David, Attached are the two invoices for the two City of Norfolk, VA

trucks J1674690 & J1674691. and our wiring info: Lorraine Farrow Accountant Kimble Mixer Company Phone 330- 308-6755 Fax 330-339-4892 Hines Specialty Vehicle | Group Crane Carrier Company | Kimble Manufacturing Company Trial Ex. 3. 24. wiring instructions attached to the Imposter’s August 25, 2017 e-mail stated as follows: Remit To: Kimble Mixer Company (dba) HSVG 1951 Reiser Ave. SE New Philadelphia, OH 44663 330-306-6700 (PH) 330-339-4892 (FX) WIRING INSTRUCTIONS: Bank Name: JP MORGAN CHASE 2566 Shallowford Rd, Atlanta, GA 30345 Routine#: 061092387 Account Name: T. INTERSTATE TRUCKING LLC P.O Box 9050 Coppell, TX 75019- 9050 Account #: 152937378 Trial Ex. 3, Doc. 4 § 32. 25. By e-mail dated August 25, 2017, at 11:14 a.m., David Harlow forwarded the Imposter’s e-mail and attachments to Shelayne Boswell, Senior Vice President and

Commercial Loan Officer for Southern Bank, and copied Betty Reynolds, stating as follows:

Shelayne, Please see the attached invoices concerning the two new Crane Carrier chassis sold to the City of Norfolk. Also attached are the wiring instructions Please fund these two chassis on our floor plan line. Thank you, David Harlow

Trial Ex. 3, Doc. 1 § 33. 26. By e-mail dated August 25, 2017, 11:32 a.m., Shelayne Boswell responded to David Harlow and stated: “Great! We will get the documents ready for your signature. Is Tuesday OK?” Trial Ex. 3, Doc. 1 34. 27. By e-mail dated August 25, 2017, 2:20 p.m., David Harlow responded to Shelayne Boswell, stating: “Yes, Tuesday will be good. Thank you, have a great weekend!” Trial Ex. 3, Doc. 1 4 35. 28. Southern Bank prepared the appropriate floor plan documents for the August 25, 2017, transaction for the City of Norfolk Truck Invoices, including but not limited to, a Disbursement Request and Authorization form; a Errors and Omissions Agreement; a statement of Funds Due At Closing; a Corporate Resolution to Borrow/Grant Collateral; a Trust Certificate; a Promissory Note; a Commercial Security Agreement; copies of the City of Norfolk Truck Invoices; a copy of the Imposter’s wiring instructions; an Agreement to Provide Insurance; a Notice of Insurance Requirements; and a certificate in Evidence of Property Insurance (the “Floor Plan Documents”). D. Harlow EUO 25:12-14, 26:7-12, 67:18-68:1, 68:6-17, Doc. 12-9, 12-10; B. Harlow EUO 15:17-24, 20:14-21, 21:15-21, 23:22-25:5. 11

29, Norfolk Truck, by David Harlow and Bruce Harlow, executed the Floor Plan Documents on or about August 29, 2017. See Trial Ex. 4, Doc. 4 4 37. 30. After receipt of the executed Floor Plan Documents, on or about August 31, 2017, Shelayne Boswell wired payment in the amount of the City of Norfolk Truck Invoices, three hundred thirty-three thousand, seven hundred twenty-four dollars ($333,724.00) according to the Imposter’s wiring instructions. See Trial Ex. 5, Doc. 1 $38. 31. | Norfolk Truck did not contact Lorraine Farrow or anyone else at Crane Carrier or Kimble Mixer by telephone or otherwise to verify the wiring instructions received in the Imposter’s August 25, 2017, 10:40 a.m. e-mail. Doc. 4 4 43. 32. Norfolk Truck has received invoices from Crane Carrier by e-mail for a number of years. D. Harlow EUO 17:5-16. 33. As early as 2016, payments to Crane Carrier have been sent by Norfolk Truck to the Mercantile Bank of Michigan. D. Harlow EUO 35:5-24. 34. On October 5, 2017, Crane Carrier and Kimble Mixer notified Norfolk Truck that Crane Carrier and Kimble Mixer had never received the $333,724.00 payment for the Norfolk Trucks. Doc. 1 § 45.

35. On October 6, 2017, Defendant, by and through its President and CEO David Harlow, executed a Wire Transfer Affidavit (the “Wire Transfer Affidavit’) to Southern Bank to report the Imposter’s actions. Trial Ex. 6, Doc. 1 § 46. 36. The Wire Transfer Affidavit states that Norfolk Truck “authorized one or more wire debit entries to JP Morgan Chase for T. Interstate Trucking ... in the amount of $333,724.00 from my account(s) at the Bank but have since found that I am a victim of fraud.” Trial Ex. 6, Doc. 4 47. 12

37. On October 6, 2017, Norfolk Truck submitted an insurance claim to Plaintiff (the “Claim’’) relating to the Imposter’s actions, seeking to recover the $333,724 wire payment made to the Imposter. Doc. 1 4 49-50. 38. Forensic analysis of Norfolk Truck’s computer system found no active malware or malicious program or document involved in the initiation, authorization, or execution of the August 31, 2017, wire transfer. In addition, no credential stealing malware that would allow for confidential information to be obtained was involved in the August 31, 2017, wire transfer. Doc. 12-11. D. THE INSURANCE POLICY 39. relevant part, the Insurance Contract includes a Crime and Fidelity Coverage Part (“CFC Coverage Part’). Doc. 1 4 52. 40. | The CFC Coverage Part includes certain provisions related to computer fraud. Doc. 1 § 53. 41. | The CFC Coverage Part states as follows, in relevant part, with respect to the Claim: COMMERCIAL CRIME COVERAGE FORM (DISCOVERY FORM) Various provisions in this policy restrict coverage. Read the entire policy carefully to determine rights, duties and what is or is not covered. Throughout this policy the words “you” and “your” refer to the Named Insured shown in the Declarations. The words “we”, “us” and “our” refer to the Company providing this insurance. Other words and phrases that appear in quotation marks have special meaning. Refer to Section F. Definitions. A. Insuring Agreements

Coverage is provided under the following Insuring Agreements for which a Limit of Insurance is shown in the Declarations and applies to loss that you sustain resulting directly from an “occurrence” taking place at any time which is “discovered” by you during the Policy Period shown in the Declarations or during the period of time provided in the Extended Period to Discover Loss Condition E.1.g.:

6. Computer Fraud We will pay for loss of or damage to “money”, “securities” and “other property” resulting directly from the use of any computer to fraudulently cause a transfer of that property from inside the “premises” or “banking premises”: a. To a person (other than a ““messenger’’) outside those “‘premises”; or b. To a place outside those “premises”. Trial Ex. 1 at 24 of 39 (emphasis added), Doc. 1 ¥ 54. 42. The Insurance Contract defines the term “messenger” to mean “you, or a relative of yours, or any of your partners or ‘members’, or any ‘employee’ while having care and custody of property outside the ‘premises’.” Trial Ex. 1, Doc. 1-1 at 34 of 39 P 12, Doc. 4 455. 43. The Insurance Contract defines the term “premises” to mean “the interior of that portion of any building you occupy in conducting your business.” Trial Ex. 1, Doc. 1-1, at 34 of 39, P 16, Doc. 4 ¥ 56. 44. The Insurance Contract provides that Plaintiff will pay for loss of or damage to “money,” “securities” and “other property” resulting directly from the use of any computer to fraudulently cause a transfer of that property from inside the “premises” or “banking premises:”

a. To a person (other than a “messenger”) outside those “premises”; or b. To a place outside those “premises”. Trial Ex. 1 at 24 of 39, Doc. 4 957. VI. ADDITIONAL FACTUAL FINDINGS A few additional facts are necessary to the Court’s resolution of this matter. Because no reasonable juror could find otherwise, and the parties do not dispute, the Court FINDS the following additional facts: 1, The applicable insurance policy has a policy limit of two hundred fifty thousand dollars ($250,000) and a deductible of one thousand dollars ($1,000). Trial Ex. 1. Doc. 1-1 at 22 of 39.

2. The Imposter, using the alias “donkey,” registered numerous Internet domain names, some of which were used to perpetrate the fraud in this case. See Trial Ex. 9. VU. CONCLUSIONS OF LAW All parties agree that the only issue required to resolve this dispute is the meaning and the manner of applicability of the word “directly.” That is to say, the parties only dispute whether the instant loss results “directly” from the use of a computer to fraudulently cause a transfer of money. Having reviewed the record and fully considered the arguments of both parties, the Court FINDS that the loss arose directly from the use of a computer. A. PLAINTIFF’S ARGUMENT AND AUTHORITIES i. Authorities Plaintiff argues that it should prevail as a matter of law because the damages suffered by Defendant did not result “directly” from computer fraud. Doc. 12 at 16. Plaintiff argues that “because [Defendant] failed to investigate the wiring instructions provided to it[;] because the 15

genuine invoices[,] not the emails[,] from the Imposter were the reason for the wire transfer[;] and because the wire transfer initiated by [Defendant] was authorized by Norfolk Truck, the loss associated with the wire transfer did not ‘result directly’ from the use of a computer.” Id. at 16. Plaintiff primarily relies on: Apache Corp. v. Great American Ins. Co., 662 F. App’x 252 (5th Cir. 2016) (per curiam); Interactive Communs. Int’, Inc. v. Great Am. Ins. Co., 731 F. App’x 929 (11th Cir. 2018) (per curiam); Medidata Solutions, Inc. v. Federal Ins. Co., 729 F. App’x 117, 118 (2d Cir. 2018) (in an e-mail “spoofing”? scheme, where imposter used a computer code to accomplish fraud, loss was directly caused by fraudulent e-mails); Pestmaster Serv. Inc □□ Travelers Cas. & Surety Co., 656 F. App’x 332, 332 (9th Cir. 2016) (to avoid converting a computer fraud policy into a general fraud policy, an unauthorized transfer of money is required to trigger coverage). In Apache, the Fifth Circuit found that a fraudulent scheme was not covered by a similar computer fraud insurance provision. There, the victim-company received a phone call from the imposter, in which the imposter purported to be a representative of a vendor and asked the victim- company to change the bank account information for its payments to the vendor. 662 F. App’x 252, 253. The victim-company instructed that it needed confirmation of the request on the vendor’s letterhead. Id. A week later, the victim-company received an e-mail from an e-mail address that was similar to — although not exactly the same as — its vendor’s e-mail domain. Id. The victim-company never noticed the subtle distinction. See id. Attached to the e-mail was a letter, on what purported to be the vendor’s letterhead, which gave old and new banking

“Spoofing” is a technique by which a fraudster sends an e-mail and uses a code to change the e-mail address in the “From:” line to reflect an e-mail address other than the one belonging to the fraudster. Accordingly, a fraudster can send an e-mail, but the recipient would be left believing that the e-mail originated from another source. 16

information and instructed the victim-company to use the new information. Id. After a month, the vendor contacted the victim-company to investigate why it had not been paid. Id. The Fifth Circuit held that the use of a computer — the e-mail message — was part of a scheme to defraud, but “the email was merely incidental to the occurrence of the authorized transfer of money. To interpret the computer-fraud provision as reaching any fraudulent scheme in which an email communication was part of the process would... convert the computer-fraud provision to one for general fraud.” Id. at 258. Finally, the court stated that the money transfer was made so victim-company could pay legitimate invoices, just to the wrong bank account; therefore, “the invoices, not the email, were the reason for the funds transfers.” Id. at 259. Thus, the losses, in the Fifth Circuit’s opinion, were not covered by the computer fraud provision. Id. In Interactive Communications, the Eleventh Circuit addressed a case involving fraud involved a scheme by which fraudsters enabled multiple redemptions of a single “chit” on a reloadable consumer debit card. 731 F. App’x 929, 931 (11th Cir. 2018). The “chit” system was a process by which a consumer purchased the “chit” at retailer, such as Walgreens, call an automated phone number, and redeem the value of the chit on the reloadable debit card. Id. at 930. The fraudsters devised a method to simultaneously call the automated phone number and make multiple redemptions of a single chit. Id. at931. The victim-company processed 23,553 fraudulent redemptions of 1,988 chits and filed an insurance claim for computer fraud. Id. After finding that the fraud was committed by use of a computer — L.e., the automated phone system — the Eleventh Circuit defined “directly” as meaning, “one thing results ‘directly’ from another if it follows straightaway, immediately, and without any intervention or interruption.” Id. at 933 (collecting dictionary definitions). The court then broke down the temporal order of the fraudulent scheme:

Step 1: The fraudsters manipulate [victim-company]’s IVR system to enable a duplicate chit redemption. For each fraudulently redeemed chit, a fraudster’s debit card is immediately credited with purchasing power, but [victim-company]’s funds are neither transferred, nor disturbed, nor altered in any way. Step 2: Shortly after processing a redemption call through the IVR system, [victim- company] transfers money (equal to the amount of the redeemed chits) to an account at Bancorp for the purpose of paying debts incurred by debit card holders. [debit card company maintains the account “for the benefit of’ [victim-company] as “holder[ ] of the Cardholder Balances for the benefit of [Debit] Cardholders.” Although [victim-company] is contractually obligated to transfer funds to the Bancorp account within 15 days of making the corresponding purchasing power available on debit cards, as a matter of regular business practice it transfers the money to [debit card company] within 24 hours. The funds remain in the [debit card company]Jaccount until needed to cover purchases made on a consumer’s debit card. Step 3: A debit card user makes a purchase from a merchant, incurring debt to be paid from the [victim-company]-earmarked [debit card company] account. Step 4: [debit card company] transfers money from the account to the merchant to cover the purchase made by the cardholder. Id. at 934-35. The Eleventh Circuit held that the computer fraud occurred at step 1 and victim- company’s harm did not occur until step 4, and that the intervening steps 2 and 3 broke the chain of events. Id. at 935. Thus, the court held that the loss was not directly result from the computer fraud. Id. In Medidata, the fraudster used a computer code to “spoof” emails, directing employees to initiate fraudulent transfers. 729 F. App’x at 119. The Second Circuit emphasized that the fraudulent e-mails and the use of computer code initiated the chain of events that lead to the fraud, and even though victims’ own actions were necessary to cause the loss of money, those actions were not enough to sever the “causal link” between the fraud and loss. Id. The Pestmaster court held that “fraudulently cause a transfer” requires an “unauthorized” transfer to avoid making the computer fraud claim into a general fraud claim. 656 F. App’x at 332 (9th Cir. 2016).

ii, Argument Here, Plaintiff urges this Court to follow these opinions and find that Defendant’s losses here were not “directly” caused by the use of a computer. Plaintiff argues that the term “directly” is unambiguous and means straightaway or immediate without intervention. Plaintiff argues that the use of a computer in this case did “nothing” to cause the transfer of money, because Plaintiff was attempting to pay legitimate invoices that it already owed. Plaintiff also argues that Defendant failed to discover the fraud and thwart it. Plaintiff argues that the fact that Defendant failed to detect the fraud — what Plaintiff calls, “what was in plain sight” — shows how removed the e-mail was from the transfer of money. Doc. 19 at 5. Accordingly, Plaintiff argues that the Court should find that the instant loss of money is not covered by the insurance agreement. At the December 11, 2019, hearing, Plaintiff argued that the fact that Defendant failed to discover the fraud suggested that the fraud and loss are not “directly” related. Plaintiff also argued that the temporal separation, approximately six (6) days including a weekend, between the fraudulent e-mail and mistaken payment further supported a finding that the instant loss did not “directly” result from the use of a computer. While counsel skillfully presented his argument, the Court is unpersuaded. B. DEFENDANT’S ARGUMENT AND AUTHORITIES Defendant counters by arguing that Plaintiff has failed to cite an insurance policy exclusion that excludes coverage where Defendant fails to discover the fraud. Doc. 15 at 23. Defendant also argues that Plaintiff's cases are unpublished and unpersuasive. Id. Defendant further urges this Court to follow Am. Tooling Ctr., Inc. v. Travelers Cas. & Sur. Co. of Am., 895 F.3d 455 (6th Cir. 2018) and Erie Ins. Exch. v. EPC MD 15, LLC, 822 S.E.2d 351 (Va. 2019). Doc. 15 at 23.

i. Authorities Defendant primarily cites four (4) cases, which it describes as adopting different “tests” and submits that Defendant prevails under each test. Defendant describes American Tooling as adopting an “immediate loss” test. Doc. 15 at 16. In American Tooling, the victim wrote an e-mail to his legitimate vendor, asking his vender to provide all outstanding invoices, but “through means unknown,” a fraudster intercepted the e-mail. 895 F.3d 455, 458 (6th Cir. 2018). The fraudster wrote back, posing as victim’s vendor, and indicated that due to an audit and new bank rules, all invoices should be paid to a new bank account, which happened to belong to the fraudster. Id. Victim paid fraudster three times before the fraud was uncovered. Id. Victim filed an insurance claim under the computer fraud provision. Id. The Sixth Circuit held that the losses suffered by the victim were directly caused by the computer fraud. Id. at 463. Following the Eleventh Circuit’s Interactive Communications decision, the court found that the fraud occurred at “step 1,” when victim received the fraudulent e-mails, the employees then conducted “a series of internal actions, all induced by the fraudulent e-mail” which lead to the money transfer at step 2. Id. Therefore, the court found that the computer fraud “directly caused” the loss. Id. Plaintiff identified American Tooling in its opening summary judgment brief, but argued that it should not govern because “the review, approval, and funding of the subject wire transfers were all done in a very short space of time and were all done in-house.” Doc. 12 at 23. However, in this case, action was initiated within twenty-five (25) minutes of the receipt of the fraudulent e- mail and there was only a matter of six (6) days between the fraudulent e-mail and the ultimate transfer of money.

Defendant describes the test embraced by the Apache court as a “substantial factor” test under which the Court looks to whether the fraudulent use of a compute was a substantial factor in the loss. Doc. 15 at 17. The Apache court focused its attention on the role of the computer in the fraudulent scheme. Because the use of a computer was “incidental” and the victim’s decision to authorize a payment was to pay a legitimate invoice, the computer was not sufficiently significant to “directly” cause the loss. The fraud in Apache began with a telephone call, and computers did not become involved until the victim requested written letter. The letter was delivered via e-mail. The Fifth Circuit noted that the victim-company arguably invited the use of a computer by asking for an e-mail, and that was the extent of computer involvement in the Apache fraud. Defendant describes Erie Ins. Exch. v. EPC MD 15, LLC, 822 S.E.2d 351 (Va. 2019) as adopting a “framework test.” Doc. 15 at 18-20. In that case, the Supreme Court of Virginia rejected a proposed term construction, because that particular construction would frustrate the framework of the insurance policy. Defendant argues that to blame it for failing to discover the fraud would frustrate the framework of this policy, because to do so would read an implied exclusion into the agreement. Defendant also identifies Interactive Communications as adopting a “two step test,” because that court resolved its decision on the number of “steps” between the fraud and the loss. Defendant argues that in this case, it lost money immediately, at step 2, of the scheme. Doc. 15 at 20-22. C. ANALYSIS The insurance provision provides: [Plaintiff] will pay for loss of or damage to “money”, “securities” and “other property” resulting directly from the use of any computer to fraudulently cause a

transfer of that property from inside the “premises” or “banking premises”: To a person (other than a “messenger”) outside those “premises”; or To a place outside those “premises”. Trial Ex. 1 at 24 of 39. The parties dispute the correct construction and application of the term “directly” as it is used in this policy. i, Construction of the Term, “Directly” The parties propose competing constructions of the term “directly” as used in the insurance contract. Plaintiff argues that “directly” is unambiguous and requires its plain and customary meaning, that is “straightaway, immediately, and without any intervention or interruption.” Doc. 19 at 4 (quoting Interactive Communications, 731 F. App’x at 934). Defendant, however, argues that “directly” is not amenable to a precise definition. Doc. 20 at 4. Defendant would have the Court construe “directly” as meaning “without the use of a computer the fraud could not have been perpetrated in the manner in which it was.” Id. The parties have not called this Court’s attention to a case in which a Virginia court has construed the term, “directly” in a contract case, and the Court’s research has not uncovered such a contract construction. Accordingly, the Court will apply appropriate Virginia contract law to construe the term. “The plain meaning of a word depends not merely on semantics and syntax but also on the holistic context of the word within the instrument.” Erie Ins. Exch., 822 $.E.2d at 355. Ambiguity only arises when conflicting interpretations are reasonable. Dress, 2019 U.S. Dist. LEXIS 126980 at *11 (E.D. Va. July 20, 2019) (citing Erie Ins. Exh., 822 S.E.2d at 355)). The fact that the parties disagree about the meaning of a word does not mean that the term is ambiguous; aterm should only be found to be ambiguous when it “may reasonably be understood in more than one way or when such language refers to two or more things at the same time.” Carolina Cas. Ins.

Co. v. Draper & Goldberg PLLC, 138 Fed. App’x 542, 548 (4th Cir. 2005) (applying Virginia law, citing Salzi v. Virginia Farm Bureau Mut. Ins. Co., 263 Va. 52, 556 S.E.2d 758, 760 (Va. 2002)). The Court FINDS that “directly” is UNAMBIGUOUS and has its plain and ordinary meaning. The word “direct[ly]” has a well-settled meaning among courts. E.g., Am. Tooling, 895 F.3d at 460 (collecting authorities explaining that direct means: “‘immediate’ or ‘proximate’ cause, as distinct from remote or incidental causes” (under Michigan law), or “proceeding from one point to another in time or space without deviation or interruption[;] ... characterized by or giving evidence of a close especially logical, causal, or consequential relationship” (Merriam-Webster Unabridged 2018), or “(Of a thing) straight; undeviating ... immediate” (Black’s Law Dictionary)). The Court finds well-accepted dictionary definitions even more persuasive. Webster’s Third New International Dictionary of the English Language has a helpful definition for “direct loss by fire”:'° “loss traceable to fire as the proximate cause : loss that is caused by smoke. . . .” Loss by fire, WEBSTER’S THIRD NEW INTERNATIONAL DICTIONARY OF THE ENGLISH LANGUAGE — UNABRIDGED (1986). The word “directly,” itself, has numerous definitions: “without any intervening space or time : next in order;” “in a straight line : without deviation of course : the shortest way;” “purposefully or decidedly and straight to the mark : in a straightforward manner without hesitation, circumlocution, or equivocation : plainly and not by implication;” “without divergence from the source or original;” simultaneously and exactly or equally;” in close relational proximity;” “without any intervening agency or instrumentality or determining influence;” “in independent action without any sharing of authority or responsibility;” without a moment’s delay : at once : immediately : after a little : in a little while : shortly : presently;” or “immediately after

‘© Obviously, the instant loss is not one by fire. However, the instant loss is a loss by fraudulent use of a computer. 23

as soon as.” Directly, WEBSTER’S THIRD NEW INTERNATIONAL DICTIONARY OF THE ENGLISH LANGUAGE — UNABRIDGED (1986). Black’s Law Dictionary defines “directly” as “in a straightforward manner,” “in a straight line or course,” and “immediately.” Directly, BLACK’S LAW DICTIONARY (11th ed. 2019). Black’s Law Dictionary goes on to define “direct loss” as “a loss that results immediately and proximately from an event.” Loss, BLACK’S LAW DICTIONARY (11th ed. 2019). These plain and popular dictionary definitions are also the most natural reading of “directly” in the context of the insurance clause:

... loss of or damage to money, securities and other property resulting directly from the use of any computer.... Trial Ex. 1 at 24 of 39 (emphasis added, internal quotes removed). The use of “directly” is an adverb which limits the scope of the loss covered by the contract. Thus, the insurance provision requires a straightforward or proximate relationship between the use of any computer and the resulting loss. Arguably, some intervening cause could sever the chain of events between the loss and use of a computer, if that intervening cause was sufficiently significant to destroy the straightforward or proximate relationship between the use of a computer and the loss. Accordingly, looking at the word as used in the insuring agreement, the Court FINDS that “directly” as used in this provision is UNAMBIGUOUS and carries its plain and ordinary meaning: something that is done in a “straightforward” or “proximate” manner and “without deviation” or “without intervening agency” from its cause. li, Application of “Directly” to the Instant Case The Court FINDS that the instant loss was “directly” caused by the use of a computer. Here, Defendant fell victim to fraud induced by the use of a computer. Much like the American Tooling fraudster, the Imposter here somehow learned of the Norfolk Truck invoices, created a

false Internet domain to mimic Defendant’s vendor, impersonated Defendant’s vendor, learned about Defendant’s balance due, and sent e-mail messages to Defendant with false payment information. Upon receiving that fraudulent e-mail, Defendant immediately communicated with its bank through a series of e-mails to initiate a transfer by computer as requested. Since the wire transfer involved a loan requiring documentation, it continued in a straightforward and proximate manner, uninterrupted, until the money was wired to the Imposter. The Imposter fraudulently caused Defendant to pay a legitimate invoice to the wrong payee. Computers were used in every step of the was including receipt of the fraudulent instructions and the insured’s compliance with such instructions by directing its bank to wire the funds to the fake payee. Accordingly, the Court FINDS that Defendant, as the insured, has carried its initial burden to prove that the instant loss is within the policy. In response, Plaintiff argues that the fraudulent e-mail did nothing to bring about the wire transfer, because, inter alia, Defendant was attempting to pay a legitimate invoice, rather than a fraudulent invoice. The Court FINDS that this argument is unpersuasive. The instant insurance provision does not require a fraudulent payment by computer; rather it requires a computer’s use to fraudulently cause a transfer of money.'' That is the case here. Plaintiff also argues that the fact that multiple actors both inside and outside of Defendant were “involved” over the course six days shows that the loss cannot be “direct.” The Court FINDS that those arguments are unpersuasive. The fact that multiple actors are involved in preparing the financial documents does not change the fact the preparation and payment was initiated and

The provision covers loss “resulting directly from the use of any computer to fraudulently cause a transfer of [money.]” Trial Ex. 1 at 24 of 39 (emphasis added). Thus, the cause of the transfer must be fraudulent; however, the payment itself need not be fraudulent. 25

completed by the fraudulent transfer of money by the use of a computer. Each actor’s presence and actions were necessary links in the chain that led to the loss. Furthermore, Plaintiffs argument that the length of time between the fraudulent e-mail and loss of money severs the direct chain of events is likewise unpersuasive. Plaintiff counts six (6) days from the date of the e-mail to the date of the payment. These six (6) days includes a weekend. Thus, it took four (4) business days for the payment to issue after the e-mail. Notably, twenty-five (25) minutes after receiving the fraudulent e-mail, Defendant initiated the wire transfer by forwarding the wire instructions to its bank. However, to fully accomplish the wire transfer, a loan must be obtained and documented. Therefore, the Court is not persuaded that the length of time “breaks the chain” of events that lead to the instant loss. Additionally, the Court is not persuaded that the fact that Defendant failed to uncover the fraud counsels against coverage. The American Tooling victims failed to discover the e-mail fraud, much like Defendant here. To ban Defendant’s claim for failing to discover the fraud, absent some fraudulent intent on the part of the Defendant, impermissibly reads an implied exclusion into the insurance contract. As Defendant argues such a reading is inconsistent with the “framework” of the insurance contract. See Erie Ins. Exch., 822 S.E.2d at 357 (“While there may be other contexts in which [another contract interpretation] would be sound, we do not think it works in the framework of this particular insurance policy.”). Plaintiff has not called this Court’s attention to any case that stands for the proposition that contributory negligence is a defense to a computer fraud claim. Thus, there is no basis to find that Defendant’s failure to uncover the fraud intervenes and breaks the chain of events. Under the insurance contract, Plaintiff agreed to cover any loss of money that directly resulted from the use of a computer that fraudulently caused the transfer of money. That is what

occurred here. Accordingly, the Court DENIES DECLARATORY JUDGMENT to Plaintiff and GRANTS JUDGMENT TO THE DEFENDANT upon its counterclaim in the sum of TWO HUNDRED FIFTY THOUSAND DOLLARS ($250,000) with interest accruing at the judgment rate from October 17, 2018, plus taxable costs. An appropriate JUDGMENT SHALL ISSUE. els It is SO ORDERED. Henry Coke Morean, Jr. Senior United States District Judge, mrs LIM AA Norfolk, Virginia ig HENRY COKE Moraaw, Jr. □□□□ eat garda 1A * As SENIOR UNITED STATES DISTRICT Juoce [LLOW Vv 2019