Hacked!

The scene is becoming more common. A deal is done, the papers signed and the money is sent. Then comes the terrifying call: The person expecting the money never got it.

With increasing frequency, the explanation is that a thief tunneled into the conversation and secretly persuaded an unwitting player to divert the funds to an account controlled by the bad guys. All too often, the money is gone forever.

The losses can be great: High six figures or low seven figures are common, according to Washington attorney Scott N. Godes, who tracks cases involving phony wiring instructions and the insurance coverage questions that follow. “And there are some that blow these figures out of the water,” he added.

Lawyers tricked by hackers can hardly be blamed for thinking no one has their back when disaster happens.

One legal malpractice insurance carrier sued this month to avoid covering a West Virginia lawyer who was taken in by fake wiring instructions. A Virginia federal judge in March turned aside a lawyer’s effort to pin blame on another party whose email security may have been breached.

But not all the news is bad. Many courts are finding coverage for lawyers, in both general malpractice policies and in coverage for cyber security or computer fraud.

West Virginia case

Most wiring instruction fraud cases involve real estate or similar property transactions, but one in West Virginia involved money to settle a civil lawsuit.

Sean Murphy of Fairmont, West Virginia, represented Betty Parmer in a collection dispute with United Bank Inc. The parties settled the case at mediation on April 4, according to pleadings in the case. The settlement amount was not disclosed in court papers.

On April 11, Murphy asked the plaintiff bank’s lawyer for instructions to wire Parmer’s settlement payment. The bank’s lawyer said he would send instructions as soon as he received them from the bank.

Later that day, a hacker pretending to be the bank’s lawyer sent wiring instructions to Murphy, who forwarded them to his client’s bank. In accordance with the phony instructions, on April 15, the money was sent to a bank account in Texas.

It was not until May 3 that the plaintiff bank’s counsel advised Murphy that the bank had never received the settlement payment. The money was gone.

ALPS objects

Murphy notified his insurance carrier, the ALPS Property & Casualty Insurance Co., of the potential claim on May 6. The bank’s lawyer wrote a letter May 23 alleging Parmer’s bank and Murphy had a duty to “verify that instructions are accurate” before acting on them.

ALPS filed suit July 1 in the Northern District of West Virginia asking a judge to declare it owed no coverage for Murphy under its professional liability policy. The insurer said the policy excludes, among other things, wrongful disbursement of funds “held or controlled” by the insured.

“Murphy exercised direct or indirect control over the Settlement Payment when he conveyed wire transfer and payment instructions” to his client’s bank, ALPS contended.

ALPS is represented by Tiffany R. Durst of Morgantown, West Virginia. Murphy was not available for comment and no response had been filed to the ALPS action as of July 25. Online court records showed no evidence of service.

No duty to protect others

A Virginia lawyer who was sued after passing along bogus wiring instructions in 2016 lost out on a bid to pass the blame to another party involved in the transaction.

In a March 29 opinion, U.S. District Judge M. Hannah Lauck found an escrow service had no duty to protect third parties from its own data breach.

The case involved a Fredericksburg land deal. Attorney Craig Buck handled the closing transaction and was supposed to wire payment of $158,671.80 to plaintiff Deutsche Bank National Trust Co., according to the complaint in Richmond federal court.

The bank had hired Altisource Portfolio Solutions as a title and escrow service, the complaint said. Altisource was to hold the closing funds in escrow. Altisource reportedly sent wiring instructions to Buck.

Before the funds were sent, however, hackers posing as Altisource sent fraudulent closing instructions to Buck. Buck allegedly followed the second, fraudulent notice of instructions and sent the money to the bad guys.

In court papers, Buck said it became clear that a hacker gained access to Altisource’s email accounts, posed as Altisource, inserted himself in the middle of the transaction without any interference from Altisource, and then sent fraudulent instructions to the law office.

Buck filed a third-party complaint against Altisource for contribution and equitable indemnity. Altisource knew or should have known about the hacker’s dirty work, the claim said.

Hauck said the contention that Altisource had a duty to safeguard private information of another individual invoked a developing area of law: “whether or how to impose liability on a party whose potentially negligent conduct flows from a data breach.”

The judge added, “Case law directly on point is sparse.”

Lauck dismissed Buck’s claims against Altisource, saying he failed to establish a legal duty Altisource owned to Deutsche under Virginia law. Lauck allowed Buck to amend his complaint. To date, he has not done so.

Lauck’s 15-page opinion is Deutsche Bank Nat’l Trust Co. v. Buck (VLW 019-3-146).

In a July 19 joint status report, Buck and the bank reported they are hopeful about settlement. Lauck referred them to U.S. Magistrate Judge Roderick C. Young for a settlement conference.

Unseen losses

Not all cases of bogus wiring instructions hit the public court dockets, but losses are becoming more frequent, government statistics show.

The FBI says 662 Virginia victims were hit with scams involving business email compromise in 2018, with $18,992,122 in reported losses in this state.

The scam “continues to grow and evolve, targeting small, medium and large business and personal transactions,” the FBI said in a news release a year ago titled, “Business e-mail compromise: The 12 billion dollar scam.” Between December 2016 and May 2018, there was a 136% increase in identified global actual and attempted losses, the agency said. The real estate sector was heavily targeted in recent years.

An often unseen aspect of a scam is the use of “money mules” in this country. When funds are diverted to a U.S. bank, often an unwitting person has been recruited through “confidence/romance scams” to receive and redirect the money, the FBI said.

The FBI says the best defense is to verify all requests for a change in payment type or direction. But the crooks are sharp, said Godes, the lawyer who follows the fate of wire transfer fraud cases. Busy real estate lawyers, for instance, can hardly be blamed when fake instructions come in an email that is largely indistinguishable from a colleague’s legitimate email. Some of the fake instructions actually come from the colleague’s email box, he said.

“These schemes are successful because the criminals have gotten progressively more clever,” Godes said. “There is not necessarily a silver bullet to avoiding this scam.”

“Putting the blame on people for not having caught on to the scheme is a pretty difficult position to take, from my perspective,” Godes said. “It’s pretty easy to play Monday morning quarterback to say what should have been done.”

Coverage available

And lawyers often find they are covered, he said. Recent decisions around the country hold that insurance policies do provide coverage for lawyers who unwittingly direct payments in accordance with bogus instructions, Godes said.

Insurers who resist providing protection through basic policies are rolling out computer fraud coverage in separate endorsements, Godes said.

Many policies offer cyber liability coverage as part of malpractice coverage, said Danny M. Howell of Falls Church, who handles professional liability actions. Even if not expressly covered, cybercrime loss is often not excluded, he said.

“Coverage for cyber liability is becoming increasingly available,” Howell said.