In the recent decision of RealPage Inc. v. National Union Fire Insurance Company of Pittsburgh, Pa,, the U.S. District Court for the Northern District of Texas held that funds lost by a third party payments processor as a result of a phishing scheme perpetrated on an insured did not meet the commercial crime policy’s ownership condition. The Court found that the “hold” requirement of the condition requires possession of funds, as opposed to the ability to direct the movement of funds. The Court also held that RealPage’s after-the-fact reimbursements to its clients did not constitute a “direct loss” under the policy.
RealPage provided services for property owners and property managers in the real estate industry, including collecting rental payments from tenants and transferring payments to RealPage’s property manager clients. To facilitate those transfers, the clients entered contracts with RealPage authorizing it to “manage and collect monies debited from the Client’s customers[’]…accounts, and to credit [the] Client’s identified bank account less any transaction fees[.]” RealPage’s clients also authorized RealPage “to complete the merchant account application process with a third party bank with which [RealPage] has a relationship on [the] Client’s behalf.”
RealPage contracted with Stripe, a third party payments processor, for Stripe to provide software services that enabled payment processing. Under this arrangement, funds flowed as follows:
- A tenant would log in to an interface called “Resident Passport” to make a payment to one of RealPage’s clients. Resident Passport was a RealPage website that was designed to look like a client website.
- Upon initiation of a payment by a tenant, RealPage would send Application Programming Interface (API) calls to Stripe’s server. The API calls sent from RealPage to Stripe provided information about the tenant’s account, the client’s destination account and the amount due to the client.
- Upon receipt of an API call, for an automated clearing house (ACH) transaction, Stripe would direct its own bank, Wells Fargo, to process an ACH transfer that would pull money from the tenant’s account and place these funds into Stripe’s Wells Fargo account.
- Thereafter, Stripe would direct Wells Fargo to complete another ACH transfer to pay these funds to RealPage’s clients in accordance with RealPage’s instructions. Stripe would make a separate ACH transfer from the Wells Fargo account to transfer RealPage’s fees for its services into RealPage’s account.
- Stripe followed RealPage’s instructions as to where funds should be directed.
Stripe’s Wells Fargo account contained funds related to transactions of various merchants utilizing Stripe, including RealPage. Under the terms of the relevant Stripe-RealPage contract, RealPage had no rights to Stripe’s account, nor to any funds held in the account, nor was RealPage was entitled to draw funds from the account.
In May 2018, a fraudster obtained and altered the account credentials of a RealPage employee. The fraudster used the credentials to access the Stripe Dashboard and alter RealPage’s funds disbursement instructions to Stripe. The fraudster was able to divert over $10,000,000 that had not yet been disbursed to RealPage’s clients. RealPage subsequently reimbursed its clients.
The Ownership Condition
RealPage maintained a primary policy of commercial crime insurance with National Union and a follow-form excess policy with Beazley. The National Union policy’s ownership condition provided:
The property covered under this policy is limited to property:
(1) That you own or lease; or
(2) That you hold for others whether or not you are legally liable for the loss of such property.
National Union concluded that RealPage did not own or hold the funds in Stripe’s Wells Fargo account and thus could not demonstrate coverage.
RealPage commenced a coverage action. National Union and Beazley both moved for summary judgment. The District Court granted the motions, holding that RealPage had failed to demonstrate that the funds met the ownership condition. RealPage argued that it “held” the funds, insofar as it could “direct” where the funds were supposed to go pursuant to its contract with Stripe. The Court disagreed, finding that the term “hold” necessarily and unambiguously implies possession, and that “[i]n sum, the definition of “hold,” as used in the Policy, cannot be reduced to an ability to direct — it requires some sort of possession of property.” The Court observed that other cases, such as the Fifth Circuit’s Cooper Industries decision (see our November 30, 2017 post) had rejected attempts to broaden the scope of the ownership condition by reference to concepts such as “equitable ownership”.
The Court concluded:
In sum, funds that are maintained in a commingled account in a third party’s name, at a third-party bank, which the insured can direct but not access, are not funds “held” by the insured. The Court recognizes that RealPage might have intended to “hold” the client’s funds. Further, the Court acknowledges that the bad actors utilized RealPage credentials to obtain the funds. Nevertheless, the Court’s task is to interpret the Policy’s language. And here, based on the plain meaning of “hold,” RealPage did not hold the funds.
Did RealPage sustain a Direct Loss?
Although the District Court’s ruling on the ownership condition was sufficient to grant summary judgment in favour of the insurers, the Court went further and considered the issue of whether RealPage suffered a direct loss, as required by the policy’s “resulting directly from” language. Citing its own 1996 decision in Lynch, the Court held that:
This language indicates an intent to limit coverage to losses sustained by RealPage, not third parties. Here, since RealPage did not hold the funds, its loss resulted from its decision to reimburse its clients. Accordingly, RealPage did not suffer a direct loss as required under the Policy. See [Lynch] at 964 (“Bartlett’s embezzlement did not cause direct out of pocket loss for Lynch; rather, Lynch’s loss arose from its later decision to replace the lost funds.”); see also Tex. Ass’n of Sch. Bds., 2016 WL 4257748 … (concluding that the insured did not sustain a direct loss where it did not hold the stolen funds, despite the insured’s appointment as an agent to process check payments from the account).
This holding is significant for fidelity claims professionals in that it provides another example of a court finding that an insured’s reimbursement of a third party loss does not meet the direct loss requirement of a commercial crime policy.
Like Cooper Industries, RealPage represents another instance of a court resisting an insured’s efforts to broaden the ownership condition in a third party loss scenario. In RealPage, the Court found that the term “hold” connotes possession of funds, not merely the ability to direct the movement of funds. This finding is instructive for fidelity claims professionals, insofar as it may help to address creative arguments concerning the scope of the ownership condition. Another example of a court reining in efforts to broaden the condition is provided by Posco Daewoo, a “reverse social engineering” decision of the U.S. District Court for the District of New Jersey (see our November 26, 2018 post).
The Court’s finding on direct loss is also significant. The Court held that the funds which RealPage subsequently paid to its clients did not meet the direct loss requirement. This is consistent with a large body of case law which holds that crime policies do not respond to third-party loss, notwithstanding that the loss may result in contractual and/or tort liability on the part of the insured.
RealPage Inc. v. National Union Fire Insurance Company of Pittsburgh, Pa, 2021 WL 718366 (N.D. Tex.)