In a recent decision by the U.S. District Court for the Western District of Pennsylvania, the court held that a policyholder had not violated the “voluntary payments” clause in its insurance policy where the payments it made prior to requesting the insurer’s consent were required by state law.  First Commonwealth Bank v. St. Paul Mercury Ins. Co., (W. Pa. Oct. 6, 2014).  On or about August 31, 2012, a customer of First Commonwealth Bank (“First Commonwealth”) was the victim of malware that allowed an unknown third party to access the customer’s computer system and obtain the online banking username and password for the customer’s accounts at First Commonwealth.  Following the breach, the unknown third party initiated three unauthorized wire transfers from the customer’s accounts between August 31, 2012 and September 4, 2012, totaling more than $3.5 million.  Once discovered, First Commonwealth was able to recover only $76,520 of the stolen funds and had to reimburse the remainder using its own funds.  First Commonwealth subsequently tendered the claim to its insurer, St. Paul Mercury Insurance Company (“St. Paul”).  St. Paul denied coverage, arguing that by reimbursing the funds to the customer without St. Paul’s consent First Commonwealth violated the “voluntary payments” clause in the insurance policy, which provided that “[t]he Insureds agree not to settle or offer to settle any Claim . . . [or] voluntarily make any payment . . . without the Insurer’s written consent.”  The district court rejected St. Paul’s argument, noting that First Commonwealth was obligated to promptly reimburse the funds to its customer under Pennsylvania law—13 Pa. C.S.A. § 4A204.  As a result, the district court held that First Commonwealth’s payments were not “voluntary” for purposes of applying the “voluntary payments” clause to exclude coverage.