Thursday, November 13, 2014

FYI: Fed Dist Court Rejects Insurer's Argument That Cyber-Attack Reimbursements by Financial Institution to Its Customer Were Excluded from Coverage as "Voluntary Payments"

The U.S. District Court for the Western District of Pennsylvania recently denied an insurer’s motion to dismiss, rejecting the insurer’s argument that its insured-bank’s refund payment to one of its clients for losses resulting from an international cyber-hacking attack violated the pertinent provisions of the operative insurance policy. 


In sum, the district court held that an insured-bank’s refund issued pursuant to the express requirement of law was not subject to the liability policy’s “voluntary payments” coverage defense, even where the insured-bank did not obtain the consent of the insurer prior to issuing the refund. Instead, the court held the payment was not voluntarily given, because it was required by an applicable Pennsylvania statute.


A copy of the opinion is available at:  Link to Opinion


In this breach of contract action arising from an insurer’s denial of coverage, an insured-bank sought the recovery of damages resulting from its refunding a client’s losses as the result of an international cyber-hacking attack.


According to the insured-bank’s complaint, its insurer breached the terms of the operative policy by asserting that, having “voluntarily” refunded the lost monies without the insurer’s consent, the insured-bank relieved the insurer of its otherwise undisputed obligation to provide coverage under the terms of the policy.


Here, in 2012, one of the insured-bank’s customers became the victim of an international cyber-hacking attack. The hacker was somehow able to obtain the online log-in details for the customer’s bank account, and utilized this information to process three transfers from the account in the aggregate amount of approximately $3.5 million dollars.  Most of these funds ended up in Russia and could not ultimately be recovered.


Following the attack, the insured bank quickly reimbursed its customer for the full amount that the customer had lost. The reimbursement was made pursuant to the express provisions of 13 Pa. C.S.A. § 4A204(a), which provides, in pertinent part, that if a receiving bank receives a payment order that was not authorized by its client, the bank “shall refund any payment of the payment order … to the extent that the bank is not entitled to enforce payment … [.]”


Thereafter, about a month following the refund payment, the insured-bank placed the insurer on notice of the loss, and claimed recovery of the funds under the terms of its policy. However, the insurer denied coverage, stating that “by refunding the monies to their client without [the insurer’s] prior consent, that [the insured-bank] relieved [the insurer] of its obligation to provide coverage … [.]”


However, in its opinion denying the insurer’s motion to dismiss, the district court rejected the insurer’s argument that the refund payment was voluntary.


Citing to the definition of the term “voluntary” in Black’s Law Dictionary, the district court opined that a voluntary payment is one that is “[u]nconstrained by interference; not impelled by outside influence.” Following from this definition, it further held that the mandate of 13 Pa. C.S.A. § 4A204(a) was certainly a “outside influence.”  Accordingly, the court rejected the insurer’s position that by making the subject payment as required by applicable statute, that the insured-bank did not qualify for coverage under the terms of the policy.


Accordingly, the district court denied the insurer’s motion to dismiss.




Ralph T. Wutscher
McGinnis Wutscher Beiramee LLP
The Loop Center Building
105 W. Madison Street, 18th Floor
Chicago, Illinois 60602
(312) 551-9320
(312) 284-4751
(312) 493-0874


Admitted to practice law in Illinois



          McGinnis Wutscher Beiramee LLP





NOTICE: We do not send unsolicited emails. If you received this email in error, or if you wish to be removed from our update distribution list, please simply reply to this email and state your intention. Thank you.

Our updates are available on the internet, in searchable format, at: