Theft of Credit Card Numbers from Merchant

Restaurant employee or outsider (cleaning crew perhaps)stole the credit card information from patrons of restaurant. Over $15,000 charges were made against the cards. The credit card company has requested reimbursement from restaurant. Is this covered under the employee dishonesty coverage or another coverage under crime policy, and what if an outsider committed the theft? If not, would general liability policy respond if restaurant was sued by credit card company?

Pennsylvania Subscriber

Let's start with an employee stealing the information, then we'll look at an outsider. The crime policy provides coverage for loss or damage to money, securities, or other property resulting directly from theft by an employee. These are defined terms-money includes currency, coins, bank notes, travelers checks, etc. Securities are negotiable and nonnegotiable instruments that represent money and include tokens, tickets, evidences of debt issued in connection with credit cards. Other property is tangible property other than money and securities, and excludes electronic data. Theft is the unlawful taking of property to the deprivation of the insured.

 

In this situation money has not been stolen, nor have securities. The credit card numbers themselves aren't evidences of debt, they allow access to the holder's account which may have credit available but may not as well. So the credit card numbers are really electronic data that is excluded under other property. Also, the insured hasn't been deprived, the credit card companies have, so this isn't covered under the employee theft insuring agreement or any of the other agreements in the crime policy.

 

The CGL policy provides coverage for sums the insured becomes legally liable to pay for bodily injury or property damage. Bodily injury is defined as bodily injury, sickness, disease sustained by a person. Property damage is physical injury to tangible property, including loss of use of that property, and loss of use of tangible property that is not physically injured. Again, electronic data is not tangible property.

 

There is certainly no bodily injury involved, and likewise there is no property damage. The credit card company extended credit to an unauthorized person using a valid number, but that is not property damage. Legal liability is a legal issue that we can't really address, but since there is no injury or property damage it's a moot point. However you asked if there was coverage under the CGL if the insured was sued for the loss. The policy states that the company has a duty to defend if the suit is seeking damages that are covered by this policy. Since we have determined that there is no coverage under this policy for such loss, then there is no duty to defend.

 

So there is no coverage for this loss if an employee stole the numbers. The same applies for an outsider -there was no tangible property stolen, and no one was physically injured. Even if the restaurant hired the cleaning crew, the cleaning company is responsible for their employees, not the restaurant.

 

This premium content is locked for FC&S Coverage Interpretation Subscribers

Enjoy unlimited access to the trusted solution for successful interpretation and analyses of complex insurance policies.

  • Quality content from industry experts with over 60 years insurance experience, combined
  • Customizable alerts of changes in relevant policies and trends
  • Search and navigate Q&As to find answers to your specific questions
  • Filter by article, discussion, analysis and more to find the exact information you’re looking for
  • Continually updated to bring you the latest reports, trending topics, and coverage analysis