In RealPage Inc. v. Nat’l Union Fire Ins. Co. of Pittsburgh, 2021 WL 718366 (N.D. Tex. Feb. 24, 2021), the U.S. District Court for the Northern District of Texas considered whether RealPage, Inc., was entitled to coverage under a commercial crime insurance policy for the loss of its clients’ funds, which were diverted through a phishing scheme. The central issue to the coverage determination was whether RealPage “owned” or “held” the diverted funds despite its use of a third-party payment processor, Stripe, Inc. (“Stripe”).
RealPage provided services for property owners and managers in the real estate industry, including the collection of rental and other payments from residents and the transfer of those payments to clients. RealPage’s clients (the property-management companies) entered contracts with RealPage authorizing it to “act as an agent on [the] Client’s behalf,” manage and collect monies debited from the customers’ accounts, and to credit the client’s bank account less any transaction fees. To facilitate its services, RealPage contracted with Stripe, a third party, to provide “software services that enable payment processing and related functions,” including a website platform that residents and tenants could use to submit their payments. The payments were then directed to a bank account held by Stripe to complete the transaction.
In 2018, a data breach occurred where a group of bad actors used a phishing scheme to obtain the credentials of a RealPage employee. They then used these credentials to access the Stripe website and alter RealPage’s fund-disbursement instructions to Stripe diverting over $10 million worth of funds to a fraudulent account. When RealPage noticed the fraudulent activity, it was able to recover some of the funds, but over $6 million was lost. RealPage reimbursed its clients for the lost funds and sought coverage from National Union under a Commercial Crime Policy and an Excess Fidelity and Crime Policy issued by Beazley. In response, National Union concluded that under the policy’s Computer Fraud coverage, RealPage was entitled to coverage for the portion of the loss of funds that represented transactional fees owed to RealPage “since it owned those funds.” With respect to diverted funds that were owed to RealPage’s clients, however, National Union denied coverage arguing that RealPage “did not own or hold the” funds and thus was not entitled to coverage.
In evaluating the policy coverage, the Court concluded that the client funds were not covered property under the policy because RealPage did not own or hold the funds at the time of the phishing scheme. The Court reasoned that the one defining characteristic of the term “hold” was possession. The ability to direct property, without more, is insufficient. In other words, RealPage’s authority to direct the transfer of the funds from residents to its clients did not amount to holding the funds. The funds, until diverted to the bad actors’ accounts, remained in an account in Stipe’s name – not RealPage’s. The Court reasoned that RealPage had no rights to the funds in the account and could not withdraw these funds. Further, the funds were commingled with those of other Stripe users. Under these circumstances, the Court found that RealPage did not possess the funds in any manner; thus, RealPage did not “hold” the funds.
In addition to demonstrating that its claim involved property covered under the Policy, RealPage was also required to show that it suffered a loss resulting directly from Computer Fraud or Funds Transfer Fraud. According to the Court, because RealPage did not hold (or own) the funds it did not suffer a direct, out-of-pocket loss. Instead, its loss resulted from its later decision to reimburse its clients for the lost funds. Accordingly, RealPage did not suffer a direct loss as required under the Policy. Additionally, in the absence of a direct loss, the Policy’s indirect-loss exclusion, which barred coverage for “[l]oss that is an indirect result of an ‘occurrence’ covered by” the Policy, also precluded RealPage’s claim for coverage. Ultimately, as RealPage could not demonstrate coverage under the National Union policy, summary judgment was granted in favor of the carriers precluding coverage for over $6M in diverted client funds.
