Real estate software maker RealPage has denied a $ 6 million claim for computer crime insurance because the stolen funds were not in its possession but were instead held by a payment processing firm during the phishing scheme.
National Union Fire Insurance Co. and BeaPley Insurance Co., insurers of RealPage, in an opinion by Judge Jane J. Boyle of the U.S. District Court in Dallas, dismissed all claims against them.
RealPage provides services to property managers in the real estate industry. Its services include collecting payments from tenants and transferring the payments to its customers. RealPage, in turn, contracted to process third-party Stripe payments and related features.
Upon receipt of the RealPage notice, Stripe will order its bank, Wells Fargo, to process a transfer that will withdraw money from a tenant’s bank account and place the funds in the Stripe’s Wells Fargo bank account, where they will handle funds from other Stripe accounts. Thereafter, Stripe Wells will order Fargo to complete another transfer to pay these funds to RealPage in accordance with RealPage’s instructions.
RealPage has no access to the Stripe bank account, and according to their contracts Stripe serves as an independent contractor, except in one of the contracts is that Stripe is the agent of RealPage to hold funds that are ultimately owed to RealPage.
In May 2018, bad actors used a targeted phishing scheme to change the credentials of a RealPage employee. They then used the referents to change the instructions on paying out RealPage in Stripe. The criminals were able to trace more than $ 10,000,000 that had not yet been paid out to RealPage’s customers
After RealPage discovered the fraud, he ordered Stripe to reverse the payments and freeze any current transfer. RealPage eventually recovered a portion of the lost funds, but was unable to recover more than $ 6,000,000. RealPage reimbursed its customers for the lost funds.
RealPage had a National Union commercial crime policy, which was effective until March 31, 2019, providing $ 5,000,000 coverage for specified losses. RealPage also acquired an excessive fidelity and crime policy for the same Beazley policy period that provided a liability limit of $ 5,000,000. The parties agreed that RealPage is entitled to coverage under Beazley’s excess policy, depending on whether RealPage is entitled to coverage under National Union policy.
The policy of the National Union has an ownership provision according to which the property covered is limited to property owned or leased by RealPage or property owned by it for others, regardless of whether it is legally liable for the loss of such property.
The policy of the National Union also has two insurance agreements. One is a “Computer Fraud” insurance agreement, which stipulates that the insurer will pay for the loss of or damage to “money”, “securities” and “other property” arising directly from the use of any computer to fraudulently ‘ a transfer of that property from within the “premises” or “bank premises” to a person (other than a messenger) or place outside that premises.
The other relevant insurance agreement, entitled “Fund Transfer Fraud”, states that the insurer will pay for the loss of funds that results directly from a fraudulent instruction that a financial institution orders to transfer, pay or deliver money from the insured ‘s transfer account ‘.
Following the phishing scheme, RealPage submitted proof of loss to National Union and requested coverage under the policy for $ 6,022,021.
In response, National Union concluded that under the Computer Fraud Insurance Agreement, RealPage was entitled to cover for the portion of the loss of funds that represented the transaction fees owed to RealPage “since it owns those funds.”
However, in respect of derivative funds owed to RealPage customers, National Union has concluded that RealPage does not “own or possess” the funds and is therefore not entitled to cover.
The parties have agreed that RealPage will not own or lease the funds. Judge Boyle therefore investigated whether RealPage had a loss of property covered by the policy, by determining whether RealPage “owned” the client’s funds.
“There are numerous dictionary definitions of ‘holding’ with one unifying feature: possession,” the judge noted.
The court found that the clear meaning of the term ‘holding’, as used in the policy, includes possession and that the ability to direct property without further ado is insufficient.
The court agrees with RealPage’s argument that the policy intends ‘own’ and ‘hold’ to have different meanings, but rules that ‘own’ encompasses a situation in which the insured owns ‘lawful’ property, such as by ‘legal title’. ‘and that with ownership the property belongs to the insured. On the other hand, “holding” applies when the insured cannot claim that the property belongs to it – rather, the insured owns the property owned by another.
The court found that funds “held in a mixed account in the name of a third party, at a third party bank, which the insured may designate but do not have access to, are not funds held by the insured” be held ‘. “
The court acknowledged that RealPage may have intended to “hold” the client’s funds and further acknowledged that the bad actors used RealPage referents to obtain the funds. Nevertheless, the court concluded that RealPage did not own the funds on the basis of the ordinary language.
Since the funds did not own or possessed, RealPage did not suffer an immediate loss as required under the policy, the court concluded.
‘As RealPage does not own the funds, the loss arose as a result of the decision to reimburse its customers. Consequently, RealPage did not suffer an immediate loss as required under the policy, ‘Judge Boyle wrote.
‘RealPage could have contracted a broader definition of covered property. But it did not, “the judge added.
The case is RealPage Inc. teen National Union Fire Insurance Co.