Principle Solutions Group, LLC v. Ironshore Indemnity, Inc.

Case: 17-11703 Date Filed: 12/09/2019 Page: 1 of 30
[PUBLISH]
IN THE UNITED STATES COURT OF APPEALS
FOR THE ELEVENTH CIRCUIT
________________________
No. 17-11703
________________________
D.C. Docket No. 1:15-cv-04130-RWS
PRINCIPLE SOLUTIONS GROUP, LLC,
Plaintiff – Appellee,
versus
IRONSHORE INDEMNITY, INC.,
Defendant – Appellant.
________________________
Appeal from the United States District Court
for the Northern District of Georgia
________________________
(December 9, 2019)
Before WILLIAM PRYOR, TJOFLAT, and GILMAN, * Circuit Judges.
WILLIAM PRYOR, Circuit Judge:
*
Honorable Ronald Lee Gilman, United States Court of Appeals for the Sixth Circuit,
sitting by designation.
Case: 17-11703 Date Filed: 12/09/2019 Page: 2 of 30
This appeal requires us to decide whether a loss of more than $1.7 million to
scammers was covered under a commercial crime insurance policy. The loss
stemmed from a sophisticated phishing scheme in which a scammer posing as an
executive of Principle Solutions Group, LLC, persuaded an employee to wire
money to a foreign bank account. After Principle discovered the fraud and
determined that it could not recover the funds, it sought coverage under the
“fraudulent instruction” provision of its policy with Ironshore Indemnity, Inc.,
which then denied Principle’s claim. Ironshore asserted that the scammer’s
communications with the employee did not meet the conditions for a fraudulent
instruction under the policy and that the loss did not result directly from the alleged
fraudulent instruction, as the policy required. Principle filed a complaint against
Ironshore to enforce the policy. The district court concluded that the policy
covered the loss and granted summary judgment to Principle. Because we also
conclude that the policy unambiguously covers Principle’s claim, we affirm.
I. BACKGROUND
On the morning of July 8, 2015, Principle lost over $1.7 million in a fraud
scheme. It began at 9:10 a.m., when Loann Lien, the controller for Principle,
received an email purporting to be from Josh Nazarian, a managing director of
Principle. The email informed Lien that Principle had been secretly working on a
“key acquisition” and asked her to wire money “in line with the terms agreed . . .
2
Case: 17-11703 Date Filed: 12/09/2019 Page: 3 of 30
as soon as possible.” As for the details of the wire transfer, the email told Lien to
give her “full attention” to “attorney Mark Leach,” who would provide further
information. Because the purported deal was not public, Lien was to “treat [the]
matter with the upmost discretion and deal solely with” Leach. Lien responded to
Nazarian’s purported email that she would give her “total attention” to Leach.
Lien received an email five minutes later from someone purporting to be
Leach, a partner at the London-based law firm Bird & Bird. After Lien confirmed
that Principle could wire the money, Leach sent Lien remittance details for a bank
in China. Leach later reiterated to Lien over the phone that Nazarian approved the
wire transfer.
Lien worked with another Principle employee to create and approve the
transfer, but a fraud prevention service, Wells Fargo, asked for verification that the
wire transfer was legitimate. Lien then confirmed with Leach that Nazarian had
approved the transaction. Lien relayed this information to Wells Fargo, which
released the hold. At 11:21 a.m., about two hours after Lien received the first
email, Principle wired more than $1.7 million to the scammers.
Lien discovered that the request was fraudulent a day later when she spoke
with Nazarian, who told her that he was not even in the office that day. Nazarian
promptly called Wells Fargo to report the fraud, but neither Principle nor law
enforcement could recover the funds.
3
Case: 17-11703 Date Filed: 12/09/2019 Page: 4 of 30
Principle sought coverage for the loss under its insurance policy with
Ironshore. The policy covered “[l]oss resulting directly from a fraudulent
instruction directing a financial institution to debit [Principle’s] transfer account
and transfer, pay or deliver money or securities from that account.” Ironshore
denied coverage. It asserted that Nazarian’s purported email did not “direct[] a
financial institution to debit [Principle’s] transfer account” because it only told
Lien to await instructions from Leach. Ironshore also argued that the asserted loss
did not “result[] directly from” a fraudulent instruction because Leach conveyed
necessary details to Lien after the initial email and Wells Fargo held the
transaction, both of which were intervening events between the instruction and the
loss.
Principle filed a complaint against Ironshore in state court seeking payment
under the policy and alleging that Ironshore had acted in bad faith. Ironshore
removed the case to federal court based on diversity jurisdiction. 28 U.S.C.
§§ 1332(a)(1), 1441(a). The parties filed competing motions for summary
judgment. Although the district court concluded that the policy provision was
ambiguous, it held that Georgia’s rule requiring construction of insurance policies
in favor of policyholders required it to grant partial summary judgment to Principle
on its coverage claim. The district court also granted partial summary judgment to
Ironshore on Principle’s claim of bad faith. Only Ironshore appealed.
4
Case: 17-11703 Date Filed: 12/09/2019 Page: 5 of 30
II. STANDARD OF REVIEW
We review a summary judgment de novo. Regions Bank v. Legal Outsource
PA, 936 F.3d 1184, 1189 (11th Cir. 2019). Summary judgment is warranted “if the
movant shows that there is no genuine dispute as to any material fact and the
movant is entitled to judgment as a matter of law.” Fed. R. Civ. P. 56(a).
III. DISCUSSION
Under Georgia law, which the parties agree governs, we use a three-step
approach to interpret insurance policies. As with any contract, we first look to the
text of the policy and, if it is “explicit and unambiguous, [our] job is simply to
apply the terms of the contract as written, regardless of whether doing so benefits
the carrier or the insured.” Ga. Farm Bureau Mut. Ins. Co. v. Smith, 784 S.E.2d
422, 424 (Ga. 2016) (citation and internal quotation marks omitted). But “if a
provision of an insurance contract is susceptible of two or more constructions, even
when the multiple constructions are all logical and reasonable, it is ambiguous,”
and we must move to the second step of applying Georgia’s “statutory rules of
contract construction.” Hurst v. Grange Mut. Cas. Co., 470 S.E.2d 659, 663 (Ga.
1996). And if the ambiguity “cannot be resolved through the rules of construction,”
we may, at the third step, look to parol evidence. Coppedge v. Coppedge, 783
S.E.2d 94, 97 n.3 (Ga. 2016) (citation and internal quotation marks omitted). But
“if the parol evidence is in conflict, the question of what the parties intended
5
Case: 17-11703 Date Filed: 12/09/2019 Page: 6 of 30
becomes a factual issue for the jury.” Id. (citation and internal quotation marks
omitted); see also Ga. Code Ann. § 13-2-1 (“The construction of a contract is a
question of law for the court. Where any matter of fact is involved, the jury should
find the fact.”).
Ironshore repeats its twin justifications for denying coverage: no
communication between the scammers and Lien triggered the fraudulent-
instruction provision, and the loss did not “result[] directly from” any alleged
fraudulent instruction. Both fail. We address each argument in turn.
A. The Loss Involved a Fraudulent Instruction Directing a Financial
Institution to Transfer Funds.
To receive coverage, Principle had to identify a “fraudulent instruction” that
“direct[ed] a financial institution to debit [Principle’s] transfer account and
transfer, pay or deliver money or securities from that account.” As relevant here,
the policy defines a “fraudulent instruction” as an “electronic or written instruction
initially received by [Principle], which instruction purports to have been issued by
an employee, but which in fact was fraudulently issued by someone else without
[Principle’s] or the employee’s knowledge or consent.” Ironshore contends that no
communication satisfied both conditions of the coverage provision, but we
disagree.
As Ironshore concedes, the email purporting to be from Nazarian, which
informed Lien of the need to wire money and told her to await further instructions
6
Case: 17-11703 Date Filed: 12/09/2019 Page: 7 of 30
from Leach, qualifies as a fraudulent instruction. It was, after all, a “fraudulently
issued” “electronic . . . instruction” that “purport[ed] to have been issued by an
employee . . . without [Principle’s] or the employee’s knowledge or consent.” But
Ironshore asserts that the email instructed Lien only to work with Leach to wire
funds later in the day, not to wire a specific amount of money to a specific
recipient. So, it explains, the email did not “direct[]” Principle to pay money out of
its accounts, as the coverage provision required.
This argument is unpersuasive. As an initial matter, we are hard pressed to
construe the email as doing anything but “directing a financial institution to debit
[Principle’s] transfer account and transfer . . . money . . . from that account.” The
email told Lien, “I will need you to make the initial wire as soon as possible, for
which you have my full approval to execute.” But even if we assume that the email
needed additional details before we could fairly construe it as “directing” a wire
transfer, a later email from Leach identified the amount of the wire transfer, the
recipient bank, and the purported beneficiary of the transfer. That email remedied
any possible lack of detail.
Ironshore agrees that Leach’s email was sufficiently detailed, but it contends
that the email was not a “fraudulent instruction” under the policy because someone
purporting to be an outside attorney, not a Principle employee, sent it. In other
words, Ironshore contends that Leach’s email, though fraudulent and specific, was
7
Case: 17-11703 Date Filed: 12/09/2019 Page: 8 of 30
not a “fraudulent instruction,” and that Nazarian’s purported email, though a
“fraudulent instruction,” was not specific enough to meet the provision’s other
requirements.
We disagree with Ironshore’s divide-and-conquer approach. Nothing in the
policy language warrants the assumption that the two emails could not be part of
the same fraudulent instruction. Although the policy defines a fraudulent
instruction as a singular “electronic or written instruction,” Georgia adopts the
longstanding rule of construction that the “singular or plural number each includes
the other, unless the other is expressly excluded.” Ga. Code Ann. § 1-3-1(d)(6); see
also Antonin Scalia & Bryan A. Garner, Reading Law: The Interpretation of Legal
Texts § 14, at 130 (2012). And reading the emails together leaves no doubt that
they were part of the same fraudulent instruction. Leach’s email supplemented the
email purporting to be from Nazarian, which cloaked Leach with the authority to
give additional details. That email told Lien to “deal solely” with Leach and to
“give [Leach her] full attention” to make sure “the wire goes out today.” And
Leach’s email informed Lien that the additional remittance details were “requested
by” Nazarian. Viewing the emails together, the sole purpose of Leach’s email was
to provide details to effectuate an explicit instruction to make a wire transfer. So
the fraudulent instruction from the scammer purporting to be Nazarian
unambiguously falls within the coverage provision.
8
Case: 17-11703 Date Filed: 12/09/2019 Page: 9 of 30
B. The Loss Resulted Directly from a Fraudulent Instruction.
Ironshore next contends that Principle’s losses did not “result[] directly
from” a fraudulent instruction as the policy required. Citing dictionary definitions,
it interprets the policy’s use of “directly” to require an “immediate” link between a
fraudulent instruction and a loss. Because the loss depended on Lien’s
conversations with Leach and Wells Fargo, which occurred after Nazarian’s
purported email told Lien to wire money, Ironshore concludes that no immediate
link existed between the instruction and the loss.
We again disagree with Ironshore. Georgia gives terms in insurance
contracts their ordinary meaning. See Ga. Code Ann. § 13-2-2(2). And the ordinary
meaning of the phrase “resulting directly from” requires proximate causation
between a covered event and a loss, not an “immediate” link. To be sure, the
definitions that Ironshore cites reveal that “directly” can sometimes mean
“immediately.” See, e.g., Directly, Black’s Law Dictionary (10th ed. 2014)
(“immediately”). But discerning the ordinary meaning of a term requires more than
uncritically citing dictionaries. By isolating “directly” from the surrounding
language, Ironshore erroneously defined the term “without accounting for its
semantic nuances.” Scalia & Garner, Reading Law app. A, at 418.
Situating “directly” within the phrase “resulting directly from” reveals a
different meaning. When used with the preposition “from,” “resulting” means “to
9
Case: 17-11703 Date Filed: 12/09/2019 Page: 10 of 30
proceed, spring, or arise as a consequence, effect or conclusion.” Result/-ing,
Webster’s Third New International Dictionary (1993); see also Resulting, The
American Heritage Dictionary (5th ed. 2012) (“[t]o happen as a consequence”).
“‘Results from’ imposes, in other words, a requirement of actual causality.”
Burrage v. United States, 571 U.S. 204, 211 (2014); see also Blockum v. Fieldale
Farms Corp., 573 S.E.2d 36, 39 (Ga. 2002) (using “causes” and “resulting from”
interchangeably). So reading the phrase “resulting directly from” as a whole
requires us to define “directly” within the context of causation. And in that context,
“directly” means “proximately.” See Directly, Webster’s Third New International
Dictionary (“in close relational proximity”); Direct Cause, Black’s Law Dictionary
(11th ed. 2019) (“proximate cause”); cf. Proximate Cause, Webster’s Third New
International Dictionary (“a cause that directly or with no mediate agency
produces an effect”). In short, the ordinary meaning of “resulting directly from”
requires us to determine whether the fraudulent instruction here proximately
caused Principle’s loss.
In Georgia, a “[p]roximate cause is not necessarily the last act or cause, or
the nearest act to the injury.” Sprayberry Crossing P’ship v. Phenix Supply Co.,
617 S.E.2d 622, 624 (Ga. Ct. App. 2005) (citation and internal quotation marks
omitted). Instead, it encompasses “all of the natural and probable consequences” of
an action, “unless there is a sufficient and independent intervening cause.” Cowart
10
Case: 17-11703 Date Filed: 12/09/2019 Page: 11 of 30
v. Widener, 697 S.E.2d 779, 784 (Ga. 2010) (emphasis added). An intervening
cause is not sufficient and independent if “its probable or natural consequences
could reasonably have been anticipated, apprehended, or foreseen by the original
wrong-doer.” Goldstein Garber & Salama, LLC v. J.B., 797 S.E.2d 87, 89 (Ga.
2017) (citation omitted).
Neither of the two “causes” that Ironshore asserts intervened between
Nazarian’s purported email and Principle’s loss—Lien’s communications with
Leach and Wells Fargo’s involvement—can sever the causal chain. Both were
foreseeable consequences of the email. Nazarian’s purported email told Lien that
Leach would contact her and provide further details on the wire request. And
although Wells Fargo’s involvement was not inevitable, it was certainly
foreseeable. The email proactively sought to avoid third-party interference by
requiring Lien to “deal solely” with Leach. Because of this instruction, the
scammers could circumvent Wells Fargo’s fraud-prevention process; through a
series of phone calls and emails between Leach and Lien, they fabricated the
precise information that Wells Fargo required to release the hold. So not only did
the scammers foresee that a fraud prevention service might get involved, they put a
system in place to circumvent that risk. Georgia courts have held that intervening
acts were foreseeable in more attenuated circumstances. See, e.g., Imperial Foods
Supply, Inc. v. Purvis, 580 S.E.2d 342, 345 (Ga. Ct. App. 2003) (holding that it
11
Case: 17-11703 Date Filed: 12/09/2019 Page: 12 of 30
was foreseeable that the driver of a borrowed car would try to fix a broken door
latch with a “makeshift, rigged mechanism” that did not perform reliably and
caused injury).
For the same reason, we are not persuaded by the dissent’s enumeration of
eleven events that occurred between the fraudulent instruction and loss, such as
each call that Lien made to Leach and Lien’s approval of the wire transfer. Each of
these events was either a necessary action to transfer the money or falls under one
of the two ostensible intervening causes that Ironshore proposes—Lien’s
communication with the scammers and Wells Fargo’s involvement. Although the
dissent parses the events more finely than Ironshore, each of its eleven events was
still a foreseeable consequence of the fraudulent instruction.
We also cannot agree with the dissent that Rustin Stamp & Coin Shop, Inc. v.
Ray Brothers Roofing & Sheet Metal Co., 332 S.E.2d 341 (Ga. Ct. App. 1985),
controls this appeal. Rustin held that no proximate causation existed between a
roofing company’s negligent decision to leave unmarked holes on a roof covered
by fiberglass and rain damage to the interior of the building. Id. at 342–44. The
court found that the causal chain was severed by the actions of an air-conditioning
repairman, who exposed the building’s interior to rain by perforating the fiberglass
covering and failed to notify the roofing company about the problem. Id. It
concluded that the defendant could not foresee that someone would both expose
12
Case: 17-11703 Date Filed: 12/09/2019 Page: 13 of 30
the interior of the building to outside rain and fail to notify anyone else about it. Id.
at 344. But a fraudulent instruction necessarily contemplates that an unwitting
employee will negligently transfer money. And unlike the intervening act in
Rustin, Wells Fargo did not cause Principle’s loss, which would have occurred
whether or not it became involved. Needless to say, something that is not a cause
of damage cannot be an intervening cause. See Ga. Bank & Tr. v. Cin. Ins. Co.,
538 S.E.2d 764, 765–66 (Ga. Ct. App. 2000) (holding that a financial loss did not
“result[] directly from” a forged signature when the loss would have occurred
“[e]ven if the signature . . . was authentic”).
Nor can we agree with the dissent’s argument that the ostensibly “suspicious
nature of the entire transaction” severed the causal chain because it gave Principle
“notice that the wire transfer may be fraudulent” and the “opportunity to prevent
the loss.” Dissenting Op. at 27. To start, the record does not support the
assumption that the entire transaction was “suspicious.” The scammers’
interactions with Lien revealed that they had a sophisticated knowledge of
Principle’s operations and personnel. Without the benefit of hindsight, we cannot
say that the transaction was inherently suspicious. And in any event, whether
various red flags “arguably should have triggered a deeper investigation,” id. at 28,
is not the relevant question. Instead, the relevant question is whether Lien’s failure
to verify the transfer in the ways the dissent suggests was foreseeable. And that
13
Case: 17-11703 Date Filed: 12/09/2019 Page: 14 of 30
failure was foreseeable: the scammers set up a system designed to prevent Lien
from verifying the request, which means that they foresaw Lien’s failure.
Finally, we disagree that proximate causation is a question for the jury in
this appeal. To be sure, “the issue of proximate cause is generally a question of fact
for the jury.” Bennett v. Dep’t of Transp., 734 S.E.2d 77, 78 (Ga. Ct. App. 2012).
But “it may be decided as a matter of law where the evidence is clear and leads to
only one reasonable conclusion.” Id. And the evidence in this appeal leads to only
one reasonable conclusion: No unforeseeable cause intervened between Nazarian’s
purported email and Principle’s loss. The loss unambiguously “resulted directly
from” the fraudulent instruction.
IV. CONCLUSION
We AFFIRM the summary judgment to Principle.
14
Case: 17-11703 Date Filed: 12/09/2019 Page: 15 of 30
TJOFLAT, Circuit Judge, dissenting:
Principle suffered a loss of $1.717 million after it was duped into
transferring funds to an international bank account. Principle now seeks recovery
under its “Commercial Crime Policy” insurance agreement with Ironshore, which
provides coverage for a “[l]oss resulting directly from a ‘fraudulent instruction’
directing a ‘financial institution’” to transfer or pay funds.
As the majority lays out, Principle’s controller transferred $1.717 million to
an international bank account after receiving a spoofed email, purportedly sent by
Principle’s Managing Director Josh Nazarian (hereinafter the “Nazarian email”).
After receiving the Nazarian email, the controller received instructions from an
“outside attorney” about how much to send, as well as where and to whom to send
the money. The controller, Loann Lien, also helped initiate a wire transfer;
approved the wire transfer; and verified the transaction after the fraud prevention
department of Principle’s bank placed a hold on the transaction.
The majority claims that the insurance agreement unambiguously covers the
loss because it resulted directly from the Nazarian email. I disagree with the
majority’s conclusion that the Nazarian email unambiguously directed a “financial
institution” to transfer funds. Furthermore, I conclude that the bank’s intervention
presents a jury question for whether Principle’s loss resulted directly from this
“fraudulent instruction.”
15
Case: 17-11703 Date Filed: 12/09/2019 Page: 16 of 30
I.
A.
The majority lays out the relevant, and uncontested, facts for the events
leading up to Lien’s initiation and approval of the wire transfer. However, Wells
Fargo did more than “ask[] for verification that the wire transfer was legitimate.”
Wells Fargo’s intervention arguably short-circuited the causal connection between
the Nazarian email and Principle’s loss. Here is what Wells Fargo did:
Less than fifteen minutes after Lien approved the wire, Wells Fargo emailed
her that the transaction was being temporarily held pending verification. The email
clearly flagged the potential for fraud—it was sent from
“CEOFraudPrevention@wellsfargo.com” and stated that the sender, Bryan Chu,
identified as a Fraud Prevention Consultant, would call Lien. Chu assigned the
transaction a case number as well as provided a phone number for the Fraud
Prevention Department.
Beneath Chu’s signature line, the email included a note, which stated that
“Imposter Fraud is on the rise” and identified three best practices to avoid this type
of fraud, including, in underlined font, “[v]erify your requestor.” In bold face type,
the note directed Lien to the Fraud Protection section of Wells Fargo’s website to
learn more about Imposter Fraud. In addition, Chu attached a pdf entitled
“Imposter Fraud Information.” The attachment cautioned that one version of
16
Case: 17-11703 Date Filed: 12/09/2019 Page: 17 of 30
imposter fraud was when “[a] fraudster posing as an executive of your company . .
. instructs you to make one or more payments outside of normal channels – usually
by wire for a high dollar amount.” The attachment again provided a list of tips to
“help reduce your risk,” including “[v]erify your requestor”—which in this case
was Josh Nazarian—and recommended that clients “[s]et a policy requiring all
requests for unusual payments made outside normal channels to be verified with a
phone call to the requestor.”
Upon receipt of the email, Lien called the Wells Fargo Fraud Prevention
Department. She spoke to an employee, identified only as Daniel, regarding the
purpose and details of the wire. According to Lien, Daniel asked her “to verify
with Mark Leach how he had received the wire instructions.”
While Lien was on the phone with Daniel, she received a voicemail and
another email from Chu. The second email largely mirrored the first and stated
that Chu had left Lien a voicemail regarding the transaction. The record does not
reveal the contents of the voicemail.
Immediately after getting off the phone with Daniel and without listening to
the voicemail from Chu, Lien emailed Leach asking him to call her so that she
could verify how he had received the wire instructions. Leach called Lien and
stated that he had received the wire instructions telephonically from Josh.
17
Case: 17-11703 Date Filed: 12/09/2019 Page: 18 of 30
Lien then called Daniel at the Wells Fargo Fraud Prevention Department and
relayed the details of her conversation with Leach. Wells Fargo released the wire.
B.
As relevant here, Principle’s policy covers “Computer and Funds Transfer
Fraud,” which includes “[l]oss resulting directly from a ‘fraudulent instruction’
directing a ‘financial institution’” to transfer or pay funds. A “fraudulent
instruction” is defined to include:
A computer, telegraphic, cable, teletype, telefacsimile, telephone, or
other electronic or written instruction initially received by you, which
instruction purports to have been issued by an “employee”, but which
in fact was fraudulently issued by someone else without your or the
“employee’s” knowledge or consent. 1
1
The policy also defines “fraudulent instruction” as:
(1) A computer, telegraphic, cable, teletype, telefacsimile, telephone or
other electronic instruction directing a “financial institution” to debit your
“transfer account” and to transfer, pay or deliver “money” or “securities”
from that “transfer account”, which instruction purports to have been
issued by you, but which in fact was fraudulently issued by someone else
without your knowledge or consent.
(2) A written instruction (other than those covered by Insuring Agreement
A.2.) issued to a “financial institution” directing the “financial institution”
to debit your “transfer account” and to transfer, pay or deliver “money” or
“securities” from that “transfer account”, through an electronic funds
transfer system at specified times or under specified conditions, which
instruction purports to have been issued by you, but which in fact was
issued, forged or altered by someone else without your knowledge or
consent.
Insuring Agreement A.2 pertains to forgery or alteration of “checks, drafts,
promissory notes, or similar written promises, orders or directions to pay a sum certain.”
18
Case: 17-11703 Date Filed: 12/09/2019 Page: 19 of 30
C.
The District Court found that the computer-and-funds-transfer-fraud
provision was ambiguous. Principle argued that the provision provides coverage
despite the existence of intervening events between the fraud and the loss.
Ironshore argued that the term “directly” requires an immediate link between the
fraud and the loss. The Court determined that both interpretations were
reasonable. Under Georgia law, because the language was ambiguous, the
provision must be construed in the light most favorable to the insured and
therefore, the District Court held that “the loss resulted directly from an instruction
that Ironshore admit[ed] was fraudulent.”
III.
The majority affirms on a different basis: that the insurance provisions are
unambiguous, and we can simply apply the terms as written. I agree that the
Nazarian email was unambiguously a “fraudulent instruction” and that it
functioned to direct Wells Fargo to transfer funds. But the question of coverage
does not end there. To be covered under the policy, Principle must have suffered a
“[l]oss resulting directly from a ‘fraudulent instruction’ directing a ‘financial
institution’” to transfer money. Whether Principle’s loss resulted directly from the
Nazarian email is a question that the District Court impermissibly removed from
the jury.
19
Case: 17-11703 Date Filed: 12/09/2019 Page: 20 of 30
A.
The Nazarian email is a “fraudulent instruction.” It unambiguously falls
within the explicit terms of the agreement: it was an “electronic . . . instruction
initially received by” Lien, which was purportedly from Nazarian, but “which in
fact was fraudulently issued by someone else” without Principle’s, Lien’s or
Nazarian’s “knowledge or consent.” Furthermore, Ironshore conceded that the
Nazarian email may be a “fraudulent instruction” within the meaning of the policy
and, under Georgia law, we construe any ambiguity in favor of the insured. Ga.
Farm Bureau Mut. Ins. Co. v. Smith, 784 S.E.2d 422, 425 (Ga. 2016).
B.
The contract is ambiguous as to how an instruction “initially received by
[Principle]” can direct a financial institution 2 to transfer money. In contrast to the
contract’s two other definitions of fraudulent instruction, there is no requirement
that the “electronic or written instruction initially received by [Principle]” be
issued to or directed toward a financial institution to qualify as a “fraudulent
instruction.”3 Under the coverage provision, however, Ironshore will only pay for
2
“Financial institution” is defined as
(1) A bank, savings bank, savings and loan association, trust company, credit union or
similar depository institution;
(2) An insurance company; or
(3) A stock brokerage firm or investment company.
3
See note 1, supra.
20
Case: 17-11703 Date Filed: 12/09/2019 Page: 21 of 30
“[l]oss resulting directly from a ‘fraudulent instruction’ directing a ‘financial
institution’” to transfer money. The duplicity of the phrase “direct a financial
institution” in combination with the uncertain meaning of that expression renders
these provisions ambiguous. Ga. Farm Bureau Mut. Ins. Co. v. Meyers, 548
S.E.2d 67, 69 (Ga. App. 2001) (“Ambiguity in an insurance contract is duplicity,
indistinctiveness, uncertainty of meaning of expression, and words or phrases
which cause uncertainty of meaning and may be fairly construed in more than one
way.”).
“[I]f a provision of an insurance contract is susceptible of two or more
constructions, even when the multiple constructions are all logical and reasonable,
it is ambiguous,” Hurst v. Grange Mut. Cas. Co., 470 S.E.2d 659, 663 (Ga. 1996),
and this provision is susceptible of at least three logical and reasonable
interpretations. One interpretation, which Ironshore argues, is that the instruction
received by Principle, must be sent as is to a financial institution. Another
interpretation is that the instruction must include all necessary details, even if some
internal processes, such as input into a system, are required to transmit the
information to a financial institution. A third interpretation, which Principle
advocates, is that the instruction direct or authorize someone within Principle to
issue an instruction to a financial institution, regardless of whether the instruction
initially received by Principle includes the necessary details. As the statutory rules
21
Case: 17-11703 Date Filed: 12/09/2019 Page: 22 of 30
of construction require that we construe the ambiguous clause against the insurer,
we adopt the interpretation least favorable to the insurer. Id.; OCGA § 13-2-2(5).
Therefore, although the contract is ambiguous, the Nazarian email qualifies as a
fraudulent instruction that directs a financial institution to transfer money as it, in
combination with the information that Lien received from Leach, directed Wells
Fargo to transfer money.
B.
I agree with the majority that directly must be defined in the context of
causation. And, I agree that the ordinary meaning of “resulting directly from”
requires a proximate cause analysis.
But our inquiry does not end there. Determinations of proximate cause can
be made as a matter of law “only if reasonable persons could not differ as to both
the relevant facts and the evaluative application of legal standards (such as the
legal concept of ‘foreseeability’) to the facts.” Atlanta Obstetrics & Gynecology
Grp., P.A. v. Coleman, 398 S.E.2d 16, 17 (Ga. 1990). Summary judgment should
be granted only in “plain and undisputed cases.” Id. at 18. Given the intervention
of the Wells Fargo Fraud Prevention Department, this is not such a case. Under
Georgia law, whether Principle’s loss was proximately caused by the Nazarian
email and therefore covered by the insurance agreement is a fact question that the
District Court impermissibly removed from the jury’s consideration.
22
Case: 17-11703 Date Filed: 12/09/2019 Page: 23 of 30
1.
Despite legal scholars’ and Georgia courts’ best efforts, there is “no
satisfactory universal formula” to determine proximate cause. Id. at 17 (citing
Prosser and Keeton on Torts, 5th ed., § 42 at pp. 276–279 (1984)). Instead,
proximate cause “is always to be determined on the facts of each case upon mixed
considerations of logic, common sense, justice, policy and precedent.” Id.
Proximate cause requires an evaluative application of the law to the facts. Id. at
18. That is why, under Georgia law, what amounts to proximate cause is
“undeniably a jury question.” Id. (quoting McAuley v. Wills, 303 S.E.2d 258, 260–
61 (Ga. 1983)). Proximate cause may be determined by the courts only “in plain
and undisputed cases.” Ontario Sewing Mach. Co. v. Smith, 572 S.E.2d 533, 536
(Ga. 2002) (quoting Atlanta Obstetrics, 398 S.E.2d at 18).
At bottom, proximate cause is a “limit on legal liability.” Atlanta Obstetrics,
398 S.E.2d at 17. It represents a “policy decision” that the conduct at issue and the
loss “are too remote for the law to countenance recovery.” Id. While proximate
cause encompasses “natural and probable consequences,” it does not include those
that are “merely possible.” Rustin Stamp & Coin Shop, Inc. v. Ray Bros. Roofing
& Sheet Metal Co., 332 S.E.2d 341, 343–44 (Ga. Ct. App. 1985).
A determination that certain conduct is not the proximate cause of a loss is
not to say that the conduct is not a “cause in fact” of the loss. Atlanta Gas Light
23
Case: 17-11703 Date Filed: 12/09/2019 Page: 24 of 30
Co. v. Gresham, 394 S.E.2d 345, 347 (Ga. 1990). Something can furnish the
condition or occasion of an injury without proximately causing the loss. Id.; see
also Ovbey v. Cont’l Ins. Co., 613 F. Supp. 726, 728 (N.D. Ga. 1985) (“[A]
situation which merely sets the stage for the later event is not regarded as being the
proximate cause merely because it made possible the subsequent loss.” (quoting
10A Couch on Insurance 2d § 42:650, p. 690 (1982)), aff’d sub nom. Ovbey v.
Cont’l Ins., 782 F.2d 178 (11th Cir. 1986).
Something also ceases to be a proximate cause when “several additional
factors” must happen between the conduct at issue and the loss. See, e.g., Rustin
Stamp, 332 S.E.2d at 344. In Rustin, an air conditioning repairman stepped on a
concealed hole on the roof of a building and perforated the opening. Id. at 342.
Rain later leaked into the opening, destroying some merchandise in Rustin’s store.
Id. Rustin sought to recover from the roofer, Ray Bros, for its failure to warn of
the hidden openings. Id. at 343. The Court determined that the causal connection
between the negligent failure to warn and the resulting loss of merchandise was too
remote to allow recovery. Id. The Court held that “several additional factors” had
to happen between the negligence and the loss. Id. at 344. Although it was
foreseeable that someone might step in the hidden opening, the Court held that in
order for damages to arise, that event had to be “followed by inaction on the part of
24
Case: 17-11703 Date Filed: 12/09/2019 Page: 25 of 30
all concerned in either recognizing the problem and correcting it or notifying Ray
Brothers or anyone else for that matter of the situation” before it rained. Id.
2.
Whether the Nazarian email proximately caused Principle’s loss or just set
the stage for that loss to occur is a jury question. Arguably, Principle did not suffer
a loss “resulting directly” from the admittedly fraudulent Nazarian email because
Wells Fargo intervened before Principle suffered a loss. The Nazarian email set
the stage for Principle’s loss, but it did not directly cause it.
To illustrate, consider all the additional factors that happened between
Lien’s receipt of the Nazarian email and Principle’s loss. 4
• Step 1: The fraudsters send the Nazarian email to Lien. Lien responds that she understands and
will work with Leach.
• Step 2: Leach emails Lien. Leach asks her whether Principle can send a wire transfer in an
international currency to an international bank.
• Step 3: Lien calls Wells Fargo to confirm that the account can send an international wire transfer
in a different currency.
• Step 4: Lien confers with Leach, who indicates that per “Josh,” Lien should approve the wire.
Lien confirms that she can approve the transfer.
4
Temporally, Principle suffered the loss a little over two hours after receiving the
Nazarian email. The entire scheme was accomplished between 9:10 a.m., when Lien received
the Nazarian email, and 11:21 a.m., when the funds were successfully transferred. But just
because the loss happened quickly does not mean that the loss was a proximate result of the
Nazarian email. The intervention of Wells Fargo’s Fraud Prevention Department rendered the
loss too “remote” to allow recovery.
25
Case: 17-11703 Date Filed: 12/09/2019 Page: 26 of 30
• Step 5: Leach emails Lien the wire instructions. Leach also calls to say that he had spoken to
“Josh,” and represents that “Josh” had given his full approval.
• Step 6: Andrea initiates the wire. Lien approves the wire.
• Step 7: Wells Fargo holds the wire and contacts Principle for a fraud investigation. Lien receives
an email from a Wells Fargo Fraud Prevention Consultant named Bryan Chu with information on
how to identify and prevent fraudulent transfers.
• Step 8: Following receipt of the email, Lien calls Wells Fargo Fraud Prevention Department and
has a telephone conversation with an employee named Daniel. Lien receives a second email
and voicemail from Chu while on the phone with Daniel.
• Step 9: Lien emails Leach and asks him to call. Leach immediately calls Lien and states that he
verbally received the wire instructions from “Josh.”
• Step 10: Lien calls the Wells Fargo Fraud Prevention Department to approve the wire transfer.
• Step 11: Wells Fargo releases the hold and the money is wired.
There is no question that a fraudulent instruction, as defined in the policy,
occurred in Step 1. Principle’s loss, however, did not occur until Step 11—when
the transfer was complete. Several additional factors had to occur: one, Lien had
to communicate with Leach to receive the instructions (steps 2-5); two, the wire
had to be initiated and approved; and three, Lien had to override Wells Fargo’s
fraud prevention hold (steps 7-11).
Did the Nazarian email proximately cause Lien to talk to Leach? It did.
Lien’s initial communications with Leach were a natural consequence of the
Nazarian email. The email told Lien to expect a communication from Leach and
26
Case: 17-11703 Date Filed: 12/09/2019 Page: 27 of 30
that he would explain the requirements. It also asked for her to “work with
[Leach],” “to treat this matter with utmost discretion,” and give Leach her “full
attention.” The communications with Leach were a “plain and undisputed”
“natural and probable” consequence of the Nazarian email.
Did the Nazarian email proximately cause Lien to approve a wire transfer?
It did. Lien continued to follow the instructions given by the Nazarian email and
reiterated by Leach. The Nazarian email also gave Lien “full approval to execute”
the wire. Again, this was a “plain and undisputed” “natural and probable”
consequence of the Nazarian email.
But did the Nazarian email proximately cause Principle’s loss? That is a
jury question. As the majority concludes, Lein’s decision to call Leach may have
been a “natural and probable” consequence of the Nazarian email. On the other
hand, once Wells Fargo stepped in, Lien was no longer relying on the Nazarian
email to override the hold and release the funds.
As soon as Wells Fargo put the hold on the funds, the link between the
Nazarian email and the loss was arguably short-circuited. Principle was given
notice that the wire transfer may be fraudulent, and it had an opportunity to prevent
the loss. Multiple emails were sent from the Wells Fargo Fraud Prevention
Department; the emails included information regarding imposter fraud and
cautioned that management should verify the request with the requestor through a
27
Case: 17-11703 Date Filed: 12/09/2019 Page: 28 of 30
different channel than the one by which they received the instruction. This
notification arguably should have triggered a deeper investigation. Like in Rustin,
in order for damages to arise, foreseeable consequences had to be “followed by
inaction on the part of all concerned in either recognizing the problem and
correcting it or notifying . . . anyone else . . . of the situation” before losses
occurred. For example, Lien could have easily called Josh Nazarian to confirm the
wire details. Or she could have talked to other members of management about the
purported acquisition. Alternatively, Lien could have called a different number at
Bird & Bird to confirm Leach’s representation of Principle or to ascertain more
details about the international acquisition.
Given the suspicious nature of the entire transaction, the intervention of the
Wells Fargo Fraud Prevention Department was arguably enough to stop Principle’s
loss. The interruption in the process would have led a reasonable employee to
question why Wells Fargo thought the transaction may be fraudulent and, in turn,
to question the propriety of an unknown attorney providing international wire
instructions for an American IT staffing company to pay over a million dollars to
acquire a Chinese company. Instead, Lien called Leach, an unknown non-
employee, to confirm the international wire instructions for an unspecified
acquisition. It was her response to Wells Fargo’s fraud investigation—not the
28
Case: 17-11703 Date Filed: 12/09/2019 Page: 29 of 30
Nazarian email—that directly caused the money to be released and Principle to
suffer a loss.
The majority conclusory states that “although Wells Fargo’s involvement
was not inevitable, it was certainly foreseeable.” But the majority fails to explain
why overriding the fraud prevention process of Principle’s bank was a “natural or
probable” consequence of the Nazarian email. The majority’s interpretation fails
to draw a line for when resulting consequences are no longer natural or probable.
At what point does the loss become merely a result of the fraudster’s conduct,
instead of resulting directly from the fraudster’s conduct? Regardless of the level
of intervention by a third-party, or even internally by Principle, the majority’s
interpretation of proximate cause would conclude—as a matter of law—that it was
foreseeable that Lien would ignore those interventions and talk only to Leach in
the wake of a fraud investigation.
Concluding that the Nazarian email was, as a matter of law, the proximate
cause of Principle’s loss provides no “limit on legal liability.” Atlanta Obstetrics,
398 S.E.2d at 17. The majority’s interpretation would always provide coverage, no
matter how much notice the insured had that a scheme could be fraudulent, so long
as the insured’s actions could, in some way, be traced to an initial fraudulent
instruction. Such an interpretation renders the word “directly” meaningless. It
allows remote losses to be traced back to one email without a jury’s consideration
29
Case: 17-11703 Date Filed: 12/09/2019 Page: 30 of 30
of whether an intervening act broke the chain of proximate causation. A jury
should decide whether Wells Fargo’s intervention broke the causation chain from
the Nazarian email.
Principle’s loss did not occur until after Wells Fargo Fraud Prevention
Department had contacted Lien, at which time she had a chance to verify the
information, and then called the bank to release the hold. I would hold that the
intervention of Wells Fargo Fraud Prevention Department presents a jury question
regarding whether the Nazarian email proximately caused Principle’s loss. So long
as reasonable minds could differ, it is no longer the “plain and undisputed” case
that a court can decide as a matter of law. I respectfully dissent.
30