Dual Email and Telephone Fraud Diverted $870,000 in Payments
Insurance lawsuit over 2023 fraud concerned Texas steel erector's loss bigger than its policy limit
A steel erector that performs work similar to that shown in the photo sought twice the insurance payout that its insurer was willing to pay.
A Texas steel erector unwittingly submitted $870,000 in two payments intended for a fabricator to a bank account that was instead controlled by cyber thieves, who faked not only emails but also impersonated the fabricator's chief financial officer on a phone call, a recent lawsuit revealed.
None of the funds were recovered.
Information about the 2023 crime was contained in Rockdale, Texas-based Perry & Perry Builders' breach-of-contract lawsuit in federal court in Waco, Texas, against Cowbell Cyber Inc., which had provided a cyber risk insurance policy. The erector sought an additional $250,000 insurance claim payout above the $250,000 paid by the insurer.
A federal judge ruled in favor of Cowbell March 9 and dismissed the steel erector's motion, potentially ending the lawsuit.
Perry & Perry had claimed in its lawsuit that the payments, made only minutes apart, constituted two separate occurrences under the policy with each one qualifying for a $250,000 limit. Cowbell contended that the payments were a single occurrence and that $250,000 was the maximum total owed for any type of loss under the policy.
Both companies sought summary judgment on the issues from Judge Leon Schydlower, who ruled in Cowbell's favor and stated that the policy language clearly established a sublimit of $250,000 for all instances within the policy term "for such a 'social engineering' type of fund diversion."
The policy "caps at $250,000 what defendants must pay for all of Perry's cyber losses during the policy period, regardless of the number and value of each such loss," Schydlower wrote in denying Perry's motion.
Looking for quick answers on construction and engineering topics?
Try Ask ENR, our new smart AI search tool.
Ask ENR →
Cybercriminals have found a lot to like about construction’s busy offices and payment practices. The fraud schemes are sometimes classified as business email compromise and sometime as social engineering.
The average loss from such email-based fund diversion frauds in all industries in 2024 is less than $175,000, research by NetDiligence showed. But many are considerably above both the average cost and claim payout limits set by insurers trying to limit their own risks.
In many such policies, the crucial sublimits—an amount smaller than the total policy limit tied to a specific peril or type of loss—are sometimes lower than the loss.
In the Perry & Perry Builders' case, the issue involved whether there were separate payments and whether a cap on the total payout applied to both.
The ruling, made in response to summary judgment motions by each side in the lawsuit as a way of bringing the matter to a conclusion without a long, drawn-out trial, appears to bring the litigation to an end.
The details of the fraud scheme are contained in Perry & Perry Builders' motion.
On December 19, 2023, a person who claimed to be the chief financial officer of fabricator Alamo Structural Steel emailed Perry & Perry's office manager. In the email, the Waco-based fabricator's purported CFO informed the Perry & Perry office manager that his company no longer would accept printed checks, asked for electronic payments and provided banking information.
The office manager did not automatically convey the funds. She called a phone number provided by the fraudulent emails to verify the information and spoke to one of the scammers, who played the role of Alamo steel's chief financial officer, according to Perry & Perry Builders.
