Fraud victim loses claim dispute after failing to take precautions

A small business that had $130,510 siphoned from its accounts by an employee will not be compensated for its losses after a dispute ruling determined that its insurer’s “segregation of duty” exclusion was correctly applied.

The complainant lodged a claim on February 3 last year after it uncovered that a part-time accounts administrator, referred to as EK, misappropriated funds. The employee was subsequently fired from the business, and the matter was referred to the police.

The claimant alleged that EK had been misappropriating funds from when she first began working at the business in September 2019 through thefts of cash, cheques and EFT payments.

It said that EK utilised an authorisation token from another employee, referred to as AK, to access the funds and hid the transactions by debiting accruals in the accounting system.

EK was found to have engaged in 56 fraudulent transactions amounting to $130,510 between April 2020 and February last year, with individual transfers ranging between $500 to $6000.

Lloyd’s Australia declined to cover majority of the losses, saying that its management liability policy held exclusions for transactions exceeding $1000 that were sustained by a “failure to have a clear segregation of duties”.

The policy stated that transactions above $1000 “must be counter signed or authorised by another authorised officer,” independent of the person handling the transfer.

The insurer accepted 19 transactions below $1000, totalling $15,760, but said the amount fell below the $20,000 policy excess. It said it was not required to pay the remaining $114,750 because of the applied segregation of duties exclusion.

Lloyd’s Australia told the Australian Financial Complaints Authority (AFCA) panel that there had been “no written proof” to show that employees were informed on the appropriate use of the security tokens.

AK was found to have provided EK with his authorisation token and password, which the insurer said showed that “there was no formal segregation of duties, process or procedure in place within the company”.

It contended that if the company had conducted “a simple review” of its accounts, it would have uncovered the fraud earlier.

The complainant said there had only been one instance where AK had prompted EK to use his authorisation token, and “on all further occasions the token was fraudulently acquired from AK and used without his knowledge and will”.

The business said it had two employees authorise all payments and that it acted according to the policy’s protocol. It said AK “would have no reason to question EK’s requests,” given that she had handled the company’s accounting.

AFCA said that while the claimant “theoretically” established a segregation of duties process, its accounts transaction process showed that it was not practically enforced.

“The panel is satisfied that by providing EK access to his token and password, AK effectively removed the segregation of duties process, that should have been in place and was required to be in place for policy coverage,” it said.

It said the insurer was entitled to apply the exclusion for the appropriate funds and accepted that the insurer was not required to pay the covered funds because it was lower than the policy excess.

The ruling also supported Lloyd’s Australia’s refusal to cover costs for an investigator hired by the insured who conducted an internal audit.

The insurer said it had already hired an investigator and did not authorise the claimant’s appointment. It alleged that most of the investigator’s work did not cover the claimed event and therefore was not applicable.

The panel said it was not satisfied that the accounting costs incurred by the complainant “assisted in the resolution of the claim”.

Click here for the ruling.