U.S. Court of Appeals for the Eleventh Circuit Judges William Pryor and Gerald Tjoflat.

An insurer remains on the hook for more than $1.7 million stolen from a company in a sophisticated phishing scam that involved a scammer posing as a London attorney, a split federal appeals court panel ruled Monday.

But only Judge William Pryor of the U.S. Court of Appeals for the Eleventh Circuit and visiting jurist Ronald Gilman agreed with the lower court that the commercial crime policy issued to the policyholder, Atlanta IT staffing and consulting firm Principle Solutions Group, "unambiguously" covered the loss. 

Judge Gerald Tjoflat felt otherwise, writing that Principle's policy with Ironshore Indemnity stipulated that a covered loss must result "directly" from a fraudulent act.  

In Principle's case, several things happened between the time a company officer received a bogus email, including a query by the Wells Fargo fraud prevention unit questioning whether the transfer was legitimate, and the transfer of the money.

Because of that, the question of proximate cause should be a matter for a jury to decide, wrote Tjoflat.

"Given the suspicious nature of the entire transaction, the intervention of the Wells Fargo Fraud Prevention Department was arguably enough to stop Principle's loss," wrote Tjoflat.

Under the majority's analysis, an insurer would always be liable "no matter how much notice the insured had that a scheme could be fraudulent, so long as the insured's actions could, in some way, be traced to an initial fraudulent instruction," he said.

Principle is represented by Barnes & Thornburg partners Scott Godes and James Leonard.

In an email, Godes welcomed the ruling.

"We believe that the decision was correct and look forward to bringing this long-running litigation to a close for the insured," he said.

Ironshore's lawyers, Philip Savrin and William Beuchner Jr. of Freeman Mathis & Gary, did not respond to a request for comment.  

As detailed in the opinion and court filings, the fraud began with a 2015 email to Principle's controller, Loann Lien, purporting to be from one of the company's managing directors, Josh Nazarian.

The message said Principle was about to make a "key acquisition" and that she was to wire the money "as soon as possible."

The email instructed Lien to await instructions for the wire transfer from someone posing as attorney Mark Leach with the London firm Bird & Bird. Leach is an actual partner with Bird & Bird and co-heads the firm's technology transactions and international outsourcing practice groups, according to its website. 

Lien was instructed to treat the matter "with the utmost discretion," and give Leach her "full attention." Lien responded that she would do so. 

Five minutes later an email arrived from the fake Leach. Lien confirmed she could wire the money and the person posing as Leach provided the details to wire it to a Chinese bank. That person called shortly thereafter and "emphasized that they needed to complete the wire transaction that day and that he had Mr. Nazarian's full approval to execute the wire transfer."

Lien and another Principle employee put the transfer together. When Wells Fargo asked for confirmation, she contacted the phony Leach by phone, and was assured Nazarian had approved it. 

She relayed that information to Wells Fargo, which released its hold on the funds. More than $1.7 million was wired to a Chinese bank about two hours after the first email.

It was only the next day that Lien discovered the fraud, when Nazarian told her he had not been in the office the day before and knew nothing of the purported deal.

"Nazarian promptly called Wells Fargo to report the fraud, but neither Principle nor law enforcement could recover the funds," the opinion said. 

Principle asked Ironshore to make up the loss but the insurer denied coverage, stating that its policy covered losses "resulting directly from a fraudulent instruction directing a financial institution to debit [Principle's] transfer account and transfer, pay or deliver money or securities from that account." 

In Principle's case, the bogus email Lien received just instructed her to await instructions, Ironshore said. It also argued that the loss did not directly result from the fraudulent instructions as the scammers "conveyed necessary details to Lien after the initial email and Wells Fargo held the transaction, both of which were intervening events between the instruction and the loss."

Principle filed a complaint asserting claims for breach of contract and bad faith in Fulton Superior Court, which was removed to Georgia's Northern District Court. 

Principle filed for summary judgment, and in 2016 Judge Richard Story agreed with Ironshore that the language of the provision was ambiguous. But he said that Georgia case law provides that, if an insurance policy's language is ambiguous, it must be construed in favor of the policyholder, and that Principle was covered. 

But he also granted Ironshore's motion for summary judgment dismissing the bad-faith claim, writing that the "issue of liability was close in this case. It was not 'unreasonable' or 'unfounded' for defendant to deny coverage here and wait for this court to determine the coverage required by the contract."

That ruling was not part of the appeal.  

In upholding Story's ruling on coverage, Pryor's majority opinion said Ironshore's contention that the emails purporting to be from Leach and Nazarian did not meet the policy's definitions for a "fraudulent  instruction" were not persuasive. 

"Although the policy defines a fraudulent instruction as a singular 'electronic or written instruction,' Georgia adopts the longstanding rule of construction that the 'singular or plural number each includes the other, unless the other is expressly excluded,'" Pryor wrote. 

"Viewing the emails together, the sole purpose of Leach's email was to provide details to effectuate an explicit instruction to make a wire transfer," he said. "So the fraudulent instruction from the scammer purporting to be Nazarian unambiguously falls within the coverage provision."

Tjoflat's 15-page dissent lists 11 separate events that occurred between the receipt of the first email and Well Fargo's release of the funds. 

"I would hold that the intervention of Wells Fargo Fraud Prevention Department presents a jury question regarding whether the Nazarian email proximately caused Principle's loss," he said. "So long as reasonable minds could differ, it is no longer the 'plain and undisputed' case that a court can decide as a matter of law."