Ask the Underwriter: Wire Fraud, Real Estate Closings, and the Limits of Professional Liability Coverage

Recently, I was asked by a real estate lawyer preparing for an upcoming CLE presentation what lawyers can do to protect themselves from the risk of fraud and, in particular, fraudulent wiring instructions. I don’t need to tell you that lawyers are in the crosshairs of cybercriminals. And those of you who close real estate transactions or regularly hold and wire client and other third party funds are prime targets. The answer begins with strong internal policies and procedures, but it does not end there. Lawyers also need to understand how insurance may—or may not—respond when funds are lost because of fraudulent wiring instructions.

Prevention Still Comes First

No insurance policy should be treated as a substitute for good risk management. If your practice regularly involves wiring funds, you should have written procedures for verifying all wire instructions. We talked about out-of-band communication procedures here and other protocols here.

Many wire fraud losses occur not because a firm lacked a policy (though many do), but because someone made an exception under pressure. A closing was urgent. A client was anxious. A lender wanted funds sent immediately. A staff member trusted what appeared to be a familiar email address. Cybercriminals rely on urgency, distraction, and routine. A good procedure is only effective if the firm has the discipline to follow it every time. 

Do Not Assume the LPL Policy Will Cover the Loss

An important point for lawyers to understand is that the lawyers professional liability policy (“LPL policy”) may not cover wire fraud loss. LPL policies are designed primarily to respond to claims arising out of the rendering of professional legal services. Many LPL policies contain exclusions or limitations for claims involving theft, conversion, misappropriation, or disappearance of funds. And they exclude claims arising from fraudulent wiring instructions, social engineering schemes, cyber events, or unauthorized access to electronic systems. 

And though some policies have cyber endorsements, those cyber endorsements are designed to provide the insured with a basic level of coverage for cyber incidents and breaches. The limited coverage the endorsement provides is not likely to be sufficient to cover the lost funds, and may only apply to loss of firm funds, not thirty party funds (i.e., client funds). 

Cyber Liability Coverage May Be the Place to Look

Because of these limitations, lawyers who regularly wire funds should seriously consider cyber liability insurance. More specifically, they should understand whether the cyber policy includes coverage for cybercrime, social engineering fraud, funds transfer fraud, or similar coverages. And the lawyer should pay particular attention to whether the cyber policy provides third-party coverage or otherwise responds when the firm is alleged to be legally responsible for the loss of funds belonging to clients or other third parties. Questions to ask about the policy include, does this cyber policy cover fraudulent wiring instructions? Does it include cybercrime or social engineering coverage? Does it cover funds held by the firm on behalf of clients or other third parties? Does it provide third-party coverage if a client, seller, lender, or other party claims the firm is responsible for the loss? Are there sublimits, exclusions, callback requirements, or verification conditions that apply?  

These details can make the difference between a covered claim and an uninsured loss.

Practical Takeaway

Lawyers who regularly wire funds on behalf of clients or other third parties should approach the risk of wire fraud from two directions. 

First, they need strong, written, consistently followed and enforced procedures for verifying wiring instructions. No wiring instructions should be accepted or changed based solely on an email. Every transaction should include independent verification and the verification documented in the file.   

Second, lawyers should review their insurance coverages with this specific risk in mind. The LPL policy is most likely not enough. Cyber liability coverage with particular attention to cybercrime, social engineering, funds transfer fraud, and third-party coverage for funds held on behalf of clients or others should be strongly considered. Finally, consider the limit or sublimit you need for fraudulent wiring instruction losses to ensure there is sufficient coverage under the cyber policy should a loss occur.

Underwriter’s Tip 

Do not wait until a wire fraud loss to find out whether your insurance responds. If your firm handles real estate closings or regularly holds/wires funds for clients or third parties and you do not have a cyber liability policy, contact AIM today as we can obtain a policy for you from the top markets writing cyber liability insurance.