5th Circuit Rules in Multimillion-dollar Phishing Case

The 5th U.S. Circuit Court of Appeals in New Orleans has affirmed a lower court’s decision in finding that a commercial crime insurer in an insured’s suit for coverage of a multimillion-dollar loss in a phishing incident was proper because the insured never “held” the funds intended for its clients, nor did it control the funds designated for them. The case is RealPage, Inc. v. Nat’l Union Fire Ins. Co., No. 21-10299, 2021 U.S. App. LEXIS 37962 (5th Cir. Dec. 22, 2021).

This case resulted from a successful phishing expedition. In 2018, a RealPage, Inc. employee accidentally clicked on a fake link in a seemingly innocuous email, and provided login information for RealPage’s account with a third-party processing site called Stripe, Inc. Phishers stole the login credentials. The phishers then used the credentials to divert millions of dollars in rent payments from tenants intended for RealPage’s property manager clients.