Independent Banker - July 2019 - 23

This enabled the criminals to illegally withdraw
customer money, post fake deposits and
remove nefarious transactions from the targeted
accounts, according to the bank. However, the
bank says that no customer plastic card or debit
card information was stolen.
But after the National Bank of Blacksburg filed
a claim, the insurer denied it under the computer
and electronic (C&E) crime rider of the bank's
financial institution (FI) bond. Everest National
Insurance Co. said that the rider excludes coverage
for " loss resulting directly or indirectly from
the use, or purported use, of credit, debit, charge,
access, convenience or other cards ... in obtaining
credit or funds " or " loss involving automated
mechanical devices. " Instead, the insurer claims
that the losses fall under the bank's FI bond debit
card rider, which has a much lower $50,000
single-loss limit than the C&E crime rider's $8
million single-loss limit.
Action points for community banks
The court had not determined if the insurer's
interpretation was correct, and the case reached
a settlement and was dismissed earlier this year.
According to a November 2018 report by New
York City-based Marsh brokers Thomas Orrico,
the financial institutions Center of Excellence
practice leader within Marsh's FINPRO practice;
and Ben Zviti, a senior vice president and financial
institutions cyber/crime leader, " Financial institutions
with plastic card and ATM exposure should
consider seeking to amend the plastic card and
ATM exclusions in those policies during upcoming
renewals. " " The simplest remedy to the FI bond
may be to add carve-backs to both exclusions for
losses covered under the computer system fraud
insuring agreement, " the report continued.
Community banks should consult with their
brokers, who will have expertise about the suite
of coverages pertaining to cyberattacks, to ensure
they have appropriate coverage to mitigate those
risks, Zviti said in an interview. " It is worthwhile
to take a deep dive into policies with insurance
professionals to make sure what is covered and
what is not, in order to identify gaps, " he adds.
Before and during such meetings with their brokers,
Zviti advises community bankers to think
about the different scenarios " that keep them up
at night " and then map those things out to match
the particular risks with particular policies.
Before every annual renewal, the Marsh brokers
typically conduct strategy meetings with
clients, informing them about the latest fraud
trends, how insurers are responding and then
how clients could be exposed to each risk, Zviti
says. That forms a strategy for renewal, identi " Both
cyber and
crime policies play
a role in robust risk
management programs
for community banks. "
-Emily Lowe, Willis Towers Watson
fying new coverages that could apply to specific
client needs.
Zviti says it's a " thoughtful, deliberate process "
that requires a meeting with key individuals from
risk management at the client's organization, and
sometimes from finance and IT. " It's a worthwhile
process to talk about the different risks, and then
find the best solutions for the client, " he says.
Quick stat
$2.5M
Losses the
National Bank
of Blacksbury
suffered after
fraudsters
obtained
customer data
Minding the social engineering gap
Another challenge for banks is recovering a loss
of funds from social engineering fraud, as currently
there are gaps in coverage for such claims.
Social engineering is a type of fraud in which
the criminal impersonates a customer and then
either emails or calls a bank employee requesting
that funds be transferred to another account.
Because the bank employee was duped and voluntarily
complied with the request, some insurers
sometimes deny the claim for resulting loss of
funds under their crime policy because there was
a " voluntary transfer. "
If properly endorsed with a social engineering
endorsement, however, crime policies can cover
the stolen funds, says John Farley, the managing
director of cyber liability practice at Arthur
J. Gallagher in New York City. But without that
endorsement on the crime policy, there would
likely not be coverage for the lost funds. " But now
independentbanker.org Q 23
http://www.independentbanker.org
Independent Banker - July 2019

Table of Contents for the Digital Edition of Independent Banker - July 2019
