State Bank of Bellingham v. Bancinsure, Inc.
| Decision Date | 29 September 2014 |
| Docket Number | Case No. 13-cv-0900 (SRN/JJG) |
| Parties | State Bank of Bellingham, Plaintiff and Counterclaim Defendant, v. BancInsure, Inc., Defendant and Counterclaim Plaintiff. |
| Court | U.S. District Court — District of Minnesota |
Jonathan M. Bye and Bryan R. Freeman, Lindquist & Vennum, PLLP, 4200 IDS Center, 80 South Eighth Street, Minneapolis, MN 55402, for Plaintiff.
Joseph A. Nilan, Mark J. Johnson, T. James Power, and Joshua A. Dorothy, Gregerson, Rosow, Johnson & Nilan, Ltd., 650 Third Avenue South, Suite 1600, Minneapolis, MN 55402, for Defendant.
This matter is before the Court on Plaintiff State Bank of Bellingham's Motion for Partial Summary Judgment, for Attorney's Fees and for Punitive Damages [Doc. No. 15], as well as the parties' cross-motions for summary judgment [Doc. Nos. 76, 88]. For the reasons stated below, the Court grants in part and denies in part Plaintiff's Motion for Partial Summary Judgment [Doc. No. 15], grants Plaintiff's Motion for Summary Judgment [Doc. No. 76], and denies Defendant BancInsure Inc.'s Motion for Summary Judgment [Doc. No. 88].
Plaintiff is a "Minnesota state bank with five employees and one location in Bellingham, Minnesota." (Carman Decl. [Doc. No. 80], ¶ 2.) Defendant is an insurance company that is incorporated in Oklahoma. (Compl. [Doc. No. 1], ¶ 5; Amended Answer and Counterclaim [Doc. No. 36], ¶ 5.) In October 2010, Defendant issued Financial Institution Bond No. FIB0011607 (the "Bond") to Bellingham Corporation, with coverage effective from October 17, 2010, to October 17, 2013. 1.) Plaintiff is a named insured on the Bond. (Id. at 168.) Under the Bond, Defendant agrees to indemnify Plaintiff in various circumstances, collectively referred to as "Insuring Agreements," including—relevant to this case—in the case of "computer systems fraud." (Id. at 166.) Under that provision, referred to as "Insuring Agreement (H)":
In this Insuring Agreement (H), fraudulent entry or change shall include such entry or change made by an employee of the Insured acting in good faith
(1) on an instruction from a software contractor who has a written agreement with the Insured to design, implement or service programs for a Computer System covered by this Insuring Agreement (H), or
(2) on an instruction transmitted by Tested telex or similar means of Tested communication identified in the application for this Bond purportedly sent by a customer, financial institution, or automated clearing house.
(Id. at 173.) Coverage under Insuring Agreement (H) provides a single loss limit of liability of $500,000, with a $5,000 deductible. (Id. at 166.)
The Bond also includes numerous exclusions. Relevant to the present motions, Section 2 of the Bond states that it "does not cover":
. . . .
(Id. at 186, 188.) Section 5 of the Bond requires the following in the event of a loss:
(a) At the earliest practicable moment, not to exceed sixty (60) days, after discovery of loss, the Insured shall give the Company notice of the loss.
(b) Within 6 months after such discovery, the Insured shall furnish to the Company proof of loss, duly sworn to, with full particulars.
. . . .
(Id. at 190.) Finally, Section 7 states:
(Id. at 191.)
The loss at issue stems from a fraudulent wire transfer. At the time the loss occurred, Plaintiff made its wire transfers through the Federal Reserve's FedLine Advantage Plus system ("FedLine"). (Carman Decl. ¶ 4.) Plaintiff used a desktop computer that was connected to a Virtual Private Network device ("VPN") provided by the Federal Reserve. (Id.) The VPN was both a modem and an encryptor. (Id.) It encrypted the information entered on the computer and transmitted it over the internet to the Federal Reserve, where the information was then decrypted. (Id.) In order to complete a wire transfer on FedLine, a user had to enter an authorized user name and three passwords. (Id. ¶ 5.) One of the passwords was provided by a security token issued by FedLine that had to be inserted into a USB port on the computer. (Id.) The other two passwords were typed in by the user. (Id.) And, although it was not required by FedLine, wire instructions had to be verified by entry of a second user name and set of passwords. (Id.)
On October 27, 2011, one of Plaintiff's employees, Sharon Kirchberg, accessed FedLine in order to complete a wire transfer. (Nilan Aff. [Doc. No. 90], Ex. 4 (Kirchberg Dep. 49:2-6).) Ms. Kirchberg's token, password, and pass phrase, as well as the token, password, and pass phrase of another employee, were used to complete the transfer. (See id., Ex. 4 (Kirchberg Dep. 49:13-53:15).) When Ms. Kirchberg left the Bank for the day, she left both tokens in the computer and left the computer running. (Id., Ex. 4 (Kirchberg Dep. 53:18-54:13).)
On October 28, Ms. Kirchberg arrived at work and accessed Fedline's Account Information Management application, which shows Plaintiff's account balance with the Federal Reserve. (Second Bye Decl., Ex. H (Proof of Loss), at 444.) At approximately 8:12 a.m. CST, she noticed that $940,000 had been transferred out of the bank using Fedwire Funds, which is part of FedLine. (Id.) She began investigating the entry and discovered that someone had attempted to initiate two wire transfers from a Demand Deposit Account at the bank to two different banks in Poland. (Id. at 444-45.) The first transfer, to a Citibank account in Warsaw, was in the amount of $485,000 and was initiated at 7:12 a.m. CST (Id. at 444.) That transfer was completed at 7:25 a.m. CST using the user name and passwords of Ms. Kirchberg and one other employee. (Id. at 444-45.) However, neither of those employees authorized or verified the transfer or had access to FedLine at the time of the transfer. (Id. at 445.) The second transfer, to an ING Bank account in Katowice, was in the amount of $455,000 and was initiated at 7:21 a.m. CST and completed at 7:25 a.m.CST. (Id.) The same user names and passwords were used, but, again, neither employee even had access to FedLine at the time of the transfer. (Id.) Both transferee accounts were in the name of Markus Vorreas. (Id.)
Ms. Kirchberg immediately attempted to reverse the wire transfers using FedLine. (Id.) However, shortly after 8:00 a.m., Plaintiff's internet service provider experienced a distributed denial-of-service attack ("DDoS"), which disabled internet service near Plaintiff. (Id.) Accordingly, Ms. Kirchberg was unable to electronically request reversal of the transfers. (Id.) She then called the Federal Reserve and requested the reversals, but her request was denied. (Id.)
On October 31, the Federal Reserve notified the two intermediary institutions for the transfers that the transfers were fraudulent. (Id. at 446.) While the intermediary institution for the second transfer was able to revert the transferred funds to Plaintiff, the $485,000 that was transferred to the Citibank account in Warsaw has never been credited or reverted. (Id.)
Plaintiff notified Defendant of the loss on October 28—the day it occurred—by faxing a copy of the transaction details of the two transfers. (See Nilan Aff., Ex. 21 (Fax Transmittal).) On November 3, BancInsure acknowledged receipt of Plaintiff's notice and advised Plaintiff that the claim had been assigned to Karbal Cohen Economou Silk Dunne ("KCESD") for investigation. (Dorothy Aff. [Doc. No. 22], Ex. 5 (Letter), at 272.) In a letter dated ...
To continue reading
Request your trial