Background
The Office of the Special Deputy Receiver (OSD), an Illinois non-profit that administers estates of insolvent insurance companies, purchased a Financial Institution Bond from Hartford Fire Insurance Company. The bond included two relevant riders: Rider 13 covered computer systems fraud, and Rider 17 covered Electronic Mail Initiated Transfer Fraud.
Fraudsters used spear phishing to compromise the CFO’s email account. Impersonating the CFO, they sent emails to OSD employees directing them to transfer funds to external accounts purportedly for new investments. OSD employees, believing the instructions came from their CFO, processed the transfers. Over several weeks, OSD lost nearly $7 million (later recovering approximately $3 million).
When Hartford refused to pay under the policy, citing exclusions, OSD filed suit seeking a declaratory judgment that the claim was covered and alleging breach of contract. Hartford moved to dismiss under Rule 12(b)(6), and the district court granted the motion. OSD appealed.
The Court’s Holding
The Seventh Circuit affirmed dismissal, holding that Rider 17’s exclusion unambiguously bars coverage for the disputed losses. The court interpreted Rider 17’s exclusion—which excludes losses from fraudulent instructions sent to OSD through email—to apply based on the recipient of the message, not the sender’s identity. Because the fraudulent emails were sent to OSD employees, they constituted “fraudulent instructions sent to” OSD within the plain language of the exclusion.
The court rejected OSD’s argument that the exclusion should be read narrowly to apply only to emails from outside senders. While Rider 17’s affirmative coverage provision explicitly restricted coverage to emails appearing to originate from customers or outside financial institutions, the exclusion contained no parallel restriction. The court held that it cannot add words to a contract that the parties did not include, even if one provision is narrower than another. Illinois law presumes contracting parties deliberately choose their words.
The court also rejected OSD’s argument that applying the exclusion created ambiguity with Rider 13’s computer fraud coverage. An exclusion creates ambiguity only when it swallows or nullifies affirmative coverage. Here, Rider 13 retains substantial force—it covers computer systems fraud that does not involve reliance on fraudulent email instructions sent to OSD. The exclusion therefore does not render the computer fraud coverage illusory.
Key Takeaways
- Email fraud exclusions are interpreted literally based on the recipient of the message, not necessarily its purported sender.
- Affirmative coverage provisions and exclusion provisions need not use identical limiting language; the absence of a sender restriction in an exclusion will not be read into the exclusion merely because such a restriction appears in the coverage grant.
- Under Illinois law, exclusions must be read narrowly, but an unambiguous exclusion will be enforced as written.
- An exclusion does not create ambiguity merely by narrowing affirmative coverage; it must nullify or swallow the coverage entirely to be deemed ambiguous.
Why It Matters
This decision is significant for organizations with cyber and fraud insurance policies. It demonstrates that courts interpret insurance contracts according to plain language, and that seemingly broad affirmative coverage can be substantially limited by carefully drafted exclusions. Insureds cannot rely on reading restrictions into exclusions based on context or parallel provisions unless the contract’s language makes such restrictions explicit. The decision underscores the importance of detailed policy review before relying on coverage.
For insurers and policyholders alike, the decision clarifies that email fraud exclusions focusing on the recipient of fraudulent instructions—rather than their origin—will be enforced as drafted. This is particularly relevant as email-based social engineering and business email compromise attacks become increasingly common, and organizations must understand precisely which losses fall within their coverage.