Design Highlights
- The court ruled that only one fraud event occurred, limiting coverage despite multiple fraudulent transfers.
- Perry & Perry’s insurance policy had a low sublimit of $250,000 for cyber crime losses.
- The ruling highlighted the inadequacy of existing cyber coverage for large losses.
- Businesses must scrutinize policy details to ensure adequate protection against social engineering fraud.
- The case emphasizes the need for tailored cyber insurance coverage to address significant risks.
In a world where cyber fraud is becoming the norm, Perry & Perry Builders, Inc. found themselves on the unfortunate end of an $874,863.70 loss due to a slick social engineering scheme. Yes, you heard that right—nearly nine hundred grand vanished thanks to some clever trickery. The fraud unfolded through two ACH transfers, cleverly split into separate invoices just a minute apart. Talk about a well-orchestrated scam! The culprits targeted the company’s business manager, who, let’s be honest, probably didn’t see it coming.
When the dust settled, Perry & Perry turned to their insurers, Cowbell Cyber, Inc. and Obsidian Specialty Insurance Co., hoping for a lifeline. But here’s where things get murky. Their policy had a sublimit of $250,000 for Cyber Crime Loss. That’s right—a quarter of a million dollars for all their cyber woes, regardless of how many incidents occurred. So, when the insurers paid out that sublimit, Perry thought they could claim another $250,000 because, hey, they had two transfers! But the court had other ideas.
Perry & Perry’s hope for double claims crumbled as the court clarified: one fraud event, one sublimit—no exceptions.
Fast forward to March 9, 2026, when the United States District Court for the Western District of Texas slapped down Perry’s hopes of getting more money. The court didn’t mince words. They emphasized that one fraud event happened here, not two. The distinction between those transfers? Irrelevant. The insurers’ policy clearly stated the cap was for all claims, not per incident. So much for creative accounting.
Perry argued that each transfer was tied to separate invoices, hence deserving separate claims. But the court was having none of it. Their bookkeeping choices didn’t dictate the count of claims. “Sorry, but that’s not how it works,” the ruling seemed to say. The endorsement caps liability across the board, and no ambiguity was found to favor the insured. Ouch.
This ruling serves as a harsh wake-up call for businesses. It highlights just how vulnerable they are when it comes to social engineering fraud. The sublimits can gut coverage and leave companies hanging, especially with a total claimed amount of $874,863.70. Insurers covered only $250,000 due to the per-claim limit.
Policyholders are now left to ponder: Is their coverage enough? What about the fine print? It’s a tough lesson learned, and Perry & Perry got burned. Higher, tailored cyber-crime limits seem like a necessity now, but who knows if anyone will take that advice seriously? Much like cyber policies, standard insurance coverage often excludes pre-existing conditions and other critical scenarios that policyholders assume are protected, leaving them exposed when they need coverage most.
