Subscriber Benefit
As a subscriber you can listen to articles at work, in the car, or while you work out. Subscribe Now
The city of Aurora is suing its insurance company in a claims dispute involving a cybercrime in which the city was tricked into sending more than $233,000 to a fraudster.
Aurora, which is on the Ohio River about 35 miles west of Cincinnati, originally filed its complaint against Bloomington, Illinois-based National Fire & Casualty Co. in Dearborn Circuit Court on Jan. 3. The case was removed this month to the U.S. District Court for the Southern District of Indiana, New Albany Division. The case is City of Aurora, Indiana v. National Fire & Casualty Co., 4:23-cv-00017.
The dispute traces back to February 2022, when Aurora’s clerk-treasurer, Benjamin Turner, was communicating with a contractor who was doing reconstruction work on a city swimming pool.
In its complaint, the city alleges that a hacker followed an email conversation between the two, then inserted himself into the conversation. Posing as the contractor, the hacker sent an email to the clerk-treasurer asking that the next partial payment for the project be sent by automatic clearing house, or ACH, because the contractor was trying to eliminate the use of paper checks.
The city authorized a payment of $233,585, the complaint says. The hacker’s email address was very similar to the contractor’s email address, the complaint says, and the city did not notice the discrepancy at the time.
A few days later, the hacker — still posing as the contractor — contacted the city saying the payment had been rejected by the bank, the city alleges. The hacker then provided information for an account at a different bank.
The clerk-treasurer became suspicious at this point and called the actual contractor, who said he had not requested the automated clearing house payment, according to the complaint. The clerk-treasurer then contacted the bank in an attempt to recover the money it had sent, but the bank denied the request, the complaint says.
On Aug. 1, 2022, the city of Aurora submitted an insurance claim with National Fire & Casualty.
According to documents filed as part of the city’s complaint, the city’s insurance with National Fire & Casualty for the period of March 15, 2021, to March 15, 2022, included coverage for governmental crime, with coverage of up to $100,000 per incident and a $250 deductible.
In a letter dated Aug. 10, 2022, National Fire & Casualty denied the claim, saying the loss was not covered under the city’s policy. The coverage applied to cases in which an outside entity committed fraud by pretending to be a city employee — which was not the case in this incident, the insurer said.
“The instructions to your bank to issue an ACH payment were actually made by City staff and not someone else without your knowledge,” National Fire & Casualty’s letter said.
National Fire & Casualty also said coverage was limited to losses that originated from within the city’s computer system. “The City’s loss did not emanate from or within a computer system that it owned, leased or operated” by the city and thus was not covered, the insurer’s letter said.
The city of Aurora is asking the court to award it a judgment of $99,750, which represents the insurance policy’s $100,000 coverage limit for the loss minus the $250 deductible.
The city is also asking the court to award punitive damages against National Fire & Casualty “in an amount as will deter Defendant from engaging in similar conduct in the future,” though it does not name a specific dollar amount.
In its legal answer to the city’s complaint, which National Fire & Casualty filed Feb. 6, the insurer agreed that it had issued a policy to the city of Aurora for the coverage period of March 15, 2021, to March 15, 2022. But the insurer denied that Aurora was entitled to the $99,750 it is seeking.
The city’s complaint alleged “there is no reasonable basis to support the denial of insurance coverage by the defendant” — an allegation that National Fire & Casualty also denied in its answer.
National Fire & Casualty’s counsel in the case, Chicago attorney Phillip K. Beth of Hinkhouse Williams Walsh LLP, did not return phone calls seeking comment.
Lawrenceburg attorney Jared Ewbank of Ewbank & Kramer is representing the city.
Ewbank said the incident shows how easy it can be to fall victim to a cyberscam, noting Turner, who remains Aurora’s clerk-treasurer, has a background in banking.
“He understands this (the financial world) and even he got taken advantage of. It’s a lesson for everyone to always take precautions,” Ewbank said.
ACH transfers are immediate, Ewbank said, so once the transfer is initiated, there is no opportunity to stop payment as there is when paying by check. A best practice when sending payments by ACH, he said, is to first call the recipient to confirm their identity.
Indiana Lawyer left phone messages Friday seeking comment from both Turner and Aurora’s mayor, Mark Drury. As of IL deadline, neither had responded.
Please enable JavaScript to view this content.