OPINION

KAREN NELSON MOORE, Circuit Judge.

The plaintiff, American Tooling Center, Inc. ("ATC"), is a Michigan company that subcontracts some of its manufacturing work to a vendor in China. Between October 1, 2014 and October 1, 2015, it was insured by the defendant, Travelers Casualty and Surety Company of America ("Travelers"). During this time period, ATC received a series of emails, purportedly from its Chinese vendor, claiming that the vendor had changed its bank accounts and ATC should wire transfer its payments to these new accounts. After ATC had transferred approximately $834,000, it learned that the emails were fraudulent and had been sent by a wrongdoer impersonating its Chinese vendor. ATC therefore sought coverage for its loss under its "Wrap+" business insurance policy ("the Policy"), which it had purchased from Travelers. Travelers denied the claim. ATC sued for breach of contract, both parties moved for summary judgment, and the district court granted summary judgment to Travelers. For the following reasons, we REVERSE the district court's grant of summary judgment to Travelers, grant summary judgment to ATC, and REMAND for further proceedings consistent with this opinion.

I. FACTS AND PROCEDURE

ATC is a tool and die manufacturer in Michigan that produces stamping dies for the automotive industry. R. 21-3 (Gizinski Dep. at 8) (Page ID #286). The company outsources some of its manufacturing orders. Id. at 19 (Page ID #289). Shanghai YiFeng Automotive Die Manufacture Co., Ltd. ("YiFeng"), a Chinese company, is one of ATC's vendors. Id. ATC pays its vendors in four separate payments, based on the manufacturing progress of the order. Id. at 36-42 (Page ID #293-95). In order to be paid for the work it has done, YiFeng emails ATC invoices. Id. at 45 (Page ID #296). After receiving an invoice from YiFeng, ATC goes through a multi-step process before it will wire the money to YiFeng.

First, ATC employees verify that YiFeng has completed the necessary steps required by the payment schedule for the next payment. Id. at 48 (Page ID #296). Each week, ATC's Vice President and Treasurer, Gary Gizinski, reviews a physical spreadsheet of the outstanding accounts payable and determines which bills need to be paid that week. R. 21-3 (Gizinski Dep. at 59-61) (Page ID #299-300). ATC pays YiFeng and its other international vendors via wire transfer. Id. at 62 (Page ID #300). To initiate a wire transfer, Gizinski signs into a banking portal using software on his computer. Id. at 70 (Page ID #302). He manually enters the payee's name, banking information, and the amount to be wired. Id. at 69, 140 (Page ID #302, 319). After Gizinski submits the wire transfer request, ATC's Assistant Comptroller must log into the banking portal using his computer to approve it. Id. at 72 (Page ID #302).

This is the procedure for paying invoices that ATC employees followed in the spring of 2015. On March 18, 2015, Gizinski emailed YiFeng employee Jessie Chen requesting that Chen provide ATC all outstanding invoices. R. 21-4 (Proof of Loss at 23) (Page ID #351). An unidentified third party, through means unknown, intercepted this email. Id. at 24 (Page ID #352). This third party, impersonating Chen, then began a correspondence with Gizinski about the outstanding invoices. See, e.g., id. at 39-40 (Page ID #367-68). On March 27, 2015, the impersonator emailed Gizinski and claimed that, due to an audit, ATC should wire its payments to a different account from usual. Id. at 45 (Page ID #373). YiFeng had previously (and legitimately) informed ATC it had changed its banking details, and ATC had no process for verifying the changed information. R. 21-3 (Gizinski Dep. at 114, 117) (Page ID #313-14). Consequently, Gizinski wired the money to the new account. Id. at 142 (Page ID #320).

On April 3, the impersonator emailed Gizinski and informed him that "due to some new bank rules in the province," the previous wire transfer was not credited to its account and therefore it would return the payment. R. 21-4 (Proof of Loss at 63) (Page ID #391). The impersonator requested that Gizinski instead wire the money to a different bank account. Id. Gizinski wired the money to this new account on April 8, 2015. R. 23-10 (Apr. 8, 2015 Wire Transfer) (Page ID #736). The impersonator ran this scam two more times and Gizinski wired additional payments of $1575 and $482,640.41 on April 9, 2015 and May 8, 2015. R. 21-4 (Proof of Loss at 3) (Page ID #331). When the real YiFeng demanded payment, ATC realized it had wired the money to an imposter. R. 21-3 (Gizinski Dep. at 166) (Page ID #326). ATC paid YiFeng approximately 50% of the outstanding debt, and agreed that the remaining 50% would be contingent on ATC's insurance claim. Id. at 126-27 (Page ID #316).

ATC sought recovery for its loss from Travelers, arguing that it fell within the "Computer Fraud" provision of the Policy, but Travelers denied the claim. R. 21-5 (July 8, 2015 Denial Ltr.) (Page ID #459-61); R. 21-6 (Sept. 16, 2015 Appeal Ltr.) (Page ID #463-67); R. 21-7 (Oct. 23, 2015 Affirming Denial Ltr.) (Page ID #469-71). ATC subsequently sued Travelers for breach of contract. R. 1 (Compl.) (Page ID #1-16). After discovery, both parties moved for summary judgment. R. 21 (Pl. Mot. for Summ. J.) (Page ID #170-98); R. 22 (Def. Mot. for Summ. J.) (Page ID #591-623). The district court granted Travelers summary judgment, holding that ATC's loss was not covered under the Policy. R. 33 (Dist. Ct. Op. at 7-8) (Page ID #969-70). ATC timely appealed. R. 35 (Notice of Appeal) (Page ID #972-73).

II. ANALYSIS

A. Standard of Review

We review de novo a district court's grant of summary judgment. Luna v. Bell, 887 F.3d 290, 297 (6th Cir. 2018). Summary judgment is proper if the moving party "shows that there is no genuine dispute as to any material fact." FED. R. CIV. P. 56(a). "For this determination, we review all facts in a light that is most favorable to, and draw all reasonable inferences in favor of, the nonmoving party." Byrd v. Tenn. Wine & Spirits Retailers Ass'n, 883 F.3d 608, 613 (6th Cir. 2018) (quoting Matsushita Elec. Indus. Co. v. Zenith Radio Corp., 475 U.S. 574, 587, 106 S.Ct. 1348, 89 L.Ed.2d 538 (1986)).

The parties agree that Michigan law governs the interpretation of the Policy. Appellant Br. at 4; Appellee Br. at 18. Under Michigan law, the insured has the burden of proving coverage. Pioneer State Mut. Ins. Co. v. Dells, 301 Mich.App. 368, 836 N.W.2d 257, 263 (2013) (citing Solomon v. Royal Maccabees Life Ins. Co., 243 Mich.App. 375, 622 N.W.2d 101, 103 (2000)). If the insured demonstrates that the policy provides coverage, then the insurer has the burden of showing that an exclusion provision precludes coverage. Id. (citing Heniser v. Frankenmuth Mut. Ins. Co., 449 Mich. 155, 534 N.W.2d 502, 510 (1995)).

B. Coverage

ATC argues that its loss is a result of computer fraud, which is a type of computer crime the Policy covers. Appellant Br. at 5. The Policy states:

R. 21-2 (Policy at 27) (Page ID #227) (emphasis in original denoting terms explicitly defined by the Policy). Travelers argues that there is no coverage because: (1) ATC did not suffer a "direct loss"; (2) this is not a case of "Computer Fraud"; (3) the loss was not "directly caused by Computer Fraud." Each of these arguments fails: ATC's loss is covered by the Policy.

1. ATC Suffered a "Direct Loss"

ATC and Travelers disagree about whether the three wire transfers of money to the impersonator constitute a "direct loss" of ATC's money. Appellant Br. at 13-14; Appellee Br. at 15-17. ATC argues that it suffered a direct loss the moment it paid $834,107.76 to the impersonator, because it no longer had that money in its bank account. Appellant Br. at 13. In contrast, Travelers argues that the loss did not arise when ATC paid the impersonator — because ATC had already contracted with YiFeng to pay that amount of money for the product it had received — but instead the loss arose later, after the fraud was discovered, when ATC agreed to pay YiFeng at least half of the money still owed. Appellee Br. at 15. At issue is what is meant by the word "direct."

Michigan courts interpret the terms of an insurance policy "in accordance with Michigan's well-established principles of contract construction." Citizens Ins. Co. v. Pro-Seal Serv. Grp., Inc., 477 Mich. 75, 730 N.W.2d 682, 685 (2007) (quoting Henderson v. State Farm Fire & Cas. Co., 460 Mich. 348, 596 N.W.2d 190, 193 (1999)). If a policy does not define a relevant term "reviewing courts must interpret the terms of the contract in accordance with their commonly used meanings." Id. at 686 (quoting Henderson, 596 N.W.2d at 194).

The Michigan Supreme Court has not previously analyzed the meaning of the word "direct" in an insurance policy. But the Michigan Court of Appeals, in an unpublished decision, has done so.1 In Acorn Investment Co. v. Michigan Basic Property Insurance Ass'n, No. 284234, 2009 WL 2952677, at *2 (Mich. Ct. App. Sept. 15, 2009), Michigan's appellate court defined a "direct" loss as one resulting from an "`immediate' or `proximate' cause, as distinct from remote or incidental causes." This definition comports with the plain meaning of the word "direct," as evidenced by relevant dictionary definitions. Id. at *2 (citing a dictionary "defining `direct,' in pertinent part, as `without intermediary agents, conditions, etc.; immediate"). Merriam-Webster defines "direct" as "proceeding from one point to another in time or space without deviation or interruption[;]... characterized by or giving evidence of a close especially logical, causal, or consequential relationship." Direct, MERRIAM-WEBSTER UNABRIDGED, http://unabridged.merriam-webster.com/unabridged/direct (last visited June 6, 2018). Similarly, Black's Law Dictionary states that direct means: "(Of a thing) straight; undeviating... immediate." Direct, BLACK'S LAW DICTIONARY (10th ed. 2014); see also Loss — Direct Loss, BLACK'S LAW DICTIONARY (10th ed. 2014) ("A loss that results immediately and proximately from an event.").

Travelers argues that we should reject the definition of "direct" from Acorn, and instead utilize a narrower definition articulated by this court in the context of Michigan employee-fidelity bonds. Appellee Br. at 14. In Tooling, Manufacturing & Technologies Ass'n v. Hartford Fire Insurance Co., 693 F.3d 665, 676 (6th Cir. 2012), we stated that "direct is direct." In other words, "direct" means "immediate." See Retail Ventures, Inc. v. Nat'l Union Fire Ins. Co. of Pittsburgh, 691 F.3d 821, 828 (6th Cir. 2012) (describing the "direct means direct" approach); Universal Mortg. Corp. v. Württembergische Versicherung AG, 651 F.3d 759, 761-62 (7th Cir. 2011) (same). Our decision in Tooling is entrenched in the jurisprudence of interpreting employee-fidelity bonds, where a split has arisen over the issue of how to define "direct," and the development of the language of these bonds plays an important role in interpreting them. Compare Tooling, Mfg. & Techs., 693 F.3d at 674-75, with Universal Image Prods., Inc. v. Fed. Ins. Co., 475 F. App'x 569, 573 (6th Cir. 2012) (applying the definition of "direct" from Acorn to a property-damage insurance policy governed by Michigan law). In Tooling, we cited this "unique" context as a reason to distinguish the facts in Tooling from Acorn. Id. at 677. We need not resolve here whether Tooling is limited to the context of employee-fidelity bonds or is more broadly applicable because ATC suffered a "direct loss" under either definition — direct as immediate only or direct as immediate or proximate.

ATC immediately lost its money when it transferred the approximately $834,000 to the impersonator; there was no intervening event. Id. at *2. Despite Travelers' argument to the contrary, Appellee Br. at 15, the fact that ATC contractually owed that money to YiFeng and the two parties later agreed to spread the loss between them has no bearing on whether this loss was directly suffered by ATC. A simplified analogy demonstrates the weakness of Travelers' logic. Imagine Alex owes Blair five dollars. Alex reaches into her purse and pulls out a five-dollar bill. As she is about to hand Blair the money, Casey runs by and snatches the bill from Alex's fingers. Travelers' theory would have us say that Casey caused no direct loss to Alex because Alex owed that money to Blair and was preparing to hand him the five-dollar bill. This interpretation defies common sense.

2. The Impersonator's Conduct Constitutes "Computer Fraud"

The two parties also contest whether the impersonator's fraudulent scheme constitutes "Computer Fraud." Appellant Br. at 19; Appellee Br. at 19. The Policy specifically defines the term:

R. 21-2 (Policy at 31) (Page ID #231) (emphasis in original denoting terms explicitly defined by the Policy). Travelers does not contest that there was a transfer of money from ATC's bank (a "Financial Institution Premises") to a person (other than a "Messenger"). Instead, it argues that this definition of "Computer Fraud" requires a computer to "fraudulently cause the transfer. It is not sufficient to simply use a computer and have a transfer that is fraudulent." Appellee Br. at 19.

In support of this argument, Travelers points to an unpublished decision from the Ninth Circuit, which interpreted this exact provision under California law. Appellee Br. at 19-20. In Pestmaster Services, Inc. v. Travelers Casualty & Surety Co. of America, 656 F. App'x 332, 333 (9th Cir. 2016), our sister circuit "interpret[ed] the phrase `fraudulently cause a transfer' to require an unauthorized transfer of funds." The Ninth Circuit acknowledged that "Travelers could have drafted this language more narrowly," but "[b]ecause computers are used in almost every business transaction, reading this provision to cover all transfers that involve both a computer and fraud at some point in the transaction would convert this Crime Policy into a `General Fraud' Policy." Id.

Pestmaster is distinguishable for multiple reasons, but principally it is distinguishable on its facts. In that case, Pestmaster had hired Priority 1 Resource Group to handle its payroll tax services and granted Priority 1 electronic access to its bank account. Pestmaster Servs., Inc. v. Travelers Cas. & Sur. Co. of Am., No. CV 13-5039-JFW (MRWx), 2014 WL 3844627, at *1 (C.D. Cal. July 17, 2014), aff'd in part and rev'd in part, Pestmaster Servs., Inc. 656 F. App'x 332. Priority 1 was then authorized to transfer funds out of Pestmaster's bank account into its own account, and from there it was to pay Pestmaster's payroll taxes. Id. The fraud occurred when Priority 1 failed to pay the taxes and kept the money instead. Id. at *2. Thus, in Pestmaster, everything that occurred using the computer was legitimate and the fraudulent conduct occurred without the use of a computer.

In contrast, here the impersonator sent ATC fraudulent emails using a computer and these emails fraudulently caused ATC to transfer the money to the impersonator. See, e.g., R. 21-4 (Proof of Loss at 39-40) (Page ID #367-68). And the Policy definition does not require, as Travelers argues, that the fraud "cause any computer to do anything." Appellee Br. at 20. Travelers' attempt to limit the definition of "Computer Fraud" to hacking and similar behaviors in which a nefarious party somehow gains access to and/or controls the insured's computer is not well-founded. If Travelers had wished to limit the definition of computer fraud to such criminal behavior it could have done so.2 Cf. Citizens Ins. Co., 730 N.W.2d at 686 (holding that a contract is construed in favor of the insured if there is an ambiguity). Because Travelers did not do so, the third party's fraudulent scheme in this case constitutes "Computer Fraud" per the Policy's definition.

3. ATC's "Direct Loss" Was "Directly Caused by Computer Fraud"

ATC must also show that its "direct loss" was "directly caused" by the computer fraud. ATC has met its burden, because the computer fraud was an immediate cause of its loss. Acorn Inv. Co., 2009 WL 2952677, at *2; Tooling, Mfg. & Techs., 693 F.3d at 676.

The chain of events that was precipitated by the fraudulent emails and led to the wire transfers involved multiple internal actions at ATC. After receiving each fraudulent email, ATC verified that YiFeng had completed the tasks required for the next scheduled payment. R. 21-3 (Gizinski Dep. at 48 (Page ID #296). Gizinski subsequently determined which outstanding invoices to pay, and chose to pay the YiFeng invoice. Id. at 59-61 (Page ID #299-300). He then signed into the banking portal and manually entered the fraudulent banking information emailed by the impersonator. Id. at 69, 140 (Page ID #302, 319). Finally, after Gizinski submitted the wire transfer, ATC's Assistant Comptroller approved the payment. Id. at 72 (Page ID #302). ATC thus suffered its loss immediately after the transfer, which marked the end of the "Computer Fraud' as defined in the policy.

A recent unpublished decision from the Eleventh Circuit provides a helpful counterpoint. In Interactive Communications International, Inc. v. Great American Insurance Co., ___ F. App'x ___, No. 17-11712, 2018 WL 2149769 (11th Cir. May 10, 2018), the Eleventh Circuit analyzed whether, under Georgia law, the insured's loss "resulted directly" from computer fraud. In that case, there was a multi-step, multi-actor process that caused the loss. First, the bad actors manipulated the insured's computer system essentially allowing for a double redemption of pre-paid, reloadable debit cards — this was the computer fraud. Id. at ___, 2018 WL 2149769 at *4. Second, this fraud induced the insured to transfer the money to its account held by an innocent third-party intermediary. Id. Third, the bad actors made a purchase using the debit cards. Id. at ___, 2018 WL 2149769 at *5. Fourth, the third party deducted the amount of the purchase from the insured's account. Id. Even though the insured transferred the money at step two, it retained control over the money until after the fourth step. Indeed, "[o]n one particular occasion, after identifying fraud associated with $1.9 million in duplicate redemptions by some debit card holders," the insured unilaterally froze those cards. Id. Thus, the computer fraud occurred at step one; but "the point of no return" after which the money had left the control of the insured occurred not at step two — when it transferred the money to the third-party intermediary — but after step four. Id. The Eleventh Circuit concluded that "[t]he lack of [temporal] immediacy — and the presence of intermediate steps, acts, and actors —" meant "that the loss did not `result[] directly'" from the computer fraud. Id. (third alteration in original). In reaching this decision, the Eleventh Circuit applied a "direct means immediate" definition, as opposed to the "direct means immediate or proximate" definition.3 Applying the narrower definition, the Eleventh Circuit suggested that if the "point of no return" was at step two — when the insured transferred the money — this would have been a direct result of the computer fraud at step one. Id.

This is what occurred in this case, when framed at the same level of generality as the Eleventh Circuit used. ATC received the fraudulent email at step one. ATC employees then conducted a series of internal actions, all induced by the fraudulent email, which led to the transfer of the money to the impersonator at step two. This was "the point of no return," because the loss occurred once ATC transferred the money in response to the fraudulent emails. Thus, the computer fraud "directly caused" ATC's "direct loss."

C. Exclusions

Travelers argues that, regardless of the Policy's coverage, three exclusion provisions apply: G, H, and R. Travelers made this argument in front of the district court, R. 22 (Def. Mot. for Summ. J. at 20-23) (Page ID #618-20), but the district court did not reach it. Under Michigan law, exclusions are "strictly construed in favor of the insured," although "clear and specific exclusions must be enforced." Hunt v. Drielick, 496 Mich. 366, 852 N.W.2d 562, 565-66 (2014) (brackets omitted) (first quoting Auto-Owners Ins. Co. v. Churchman, 440 Mich. 560, 489 N.W.2d 431, 434 (1992); and then quoting Group Ins. Co. of Mich. v. Czopek, 440 Mich. 590, 489 N.W.2d 444, 447 (1992)). None of the exclusions asserted by Travelers preclude coverage in this case.

1. Exclusion R

Travelers first argues that Exclusion R applies. Appellee Br. at 33-34. This provision states, in pertinent part:

R. 21-2 (Policy at 39) (Page ID #239) (emphasis in original denoting terms explicitly defined by the Policy). Travelers contends that Exclusion R applies because ATC transferred the money to the impersonator, believing it to be YiFeng, in exchange for the goods it had received from the vendor. Appellee Br. at 34. ATC correctly points out that it did not transfer the money to the impersonator in exchange for anything from the impersonator, and therefore the fraudulent transfer does not fall within this exclusion provision. Appellant Reply Br. at 9.

We have previously analyzed a similar exclusion provision, under Tennessee law, which included the language "giving or surrendering of Money or Securities in any exchange or purchase." Harrah's Entm't, Inc. v. Ace Am. Ins. Co., 100 F. App'x 387, 391 (6th Cir. 2004). In that case, we noted that the provision was "loosely worded" and potentially ambiguous, and therefore should be construed against the drafter. Id.; see also Hunt, 852 N.W.2d at 565-66. Construing this provision in favor of ATC and against its drafter, Travelers, we hold that ATC's wire transfers to the impersonator do not fall within Exclusion R, because ATC did not give or surrender money to the impersonator in an "exchange or purchase."

2. Exclusion G

Travelers next argues that Exclusion G applies to this situation. Appellee Br. at 35-36. The relevant section of Exclusion G states:

R. 21-2 (Policy at 39) (Page ID #238) (emphasis in original denoting terms explicitly defined by the Policy). "Electronic Data" is defined as "facts or information converted to a form: (1) usable in a Computer System; (2) that does not provide instructions or directions to a Computer System; or (3) that is stored on electronic processing media for use by a Computer Program." Id. at 32 (Page ID #232) (emphasis in original denoting terms explicitly defined by the Policy). A "Computer System" is "a computer and all input, output, processing, storage and communication facilities and equipment that are connected to such a device and that the [sic] operating system or application software used by the Insured are under the direct operational control of the Insured...." Id. at 31 (Page ID #231) (emphasis in original denoting terms explicitly defined by the Policy).

Travelers summarily states that, when Gizinski manually entered the impersonator's name, banking information, and the amount to be wired into the banking portal, he was inputting "Electronic Data." Appellee Br. at 35-36. But the definition of "Electronic Data" excludes "instructions or directions to a Computer System." R. 21-2 (Policy at 32) (Page ID #232) (emphasis in original denoting terms explicitly defined by the Policy). Strictly construed against Travelers, Hunt, 852 N.W.2d at 565-66, Gizinski's manual entry of the imposter's banking details was not "Electronic Data." The physical pressing of the keyboard and mouse sent instructions to the computer to display specific values. Computer, ENCYCLOPÆDIA BRITANNICA, https://academic.eb.com/levels/collegiate/article/computer/117728 (last visited June 7, 2018). These values combined to form "instructions or directions," R. 21-2 (Policy at 32) (Page ID #232), to act in a specific manner; i.e. to transmit the entered values from ATC to the banking portal via the "communication facilities" of the "Computer System," id. at 31 (Page ID #231).

Arguably, this interpretation the Policy's definition of "Electronic Data" is narrower that our ordinary understanding of electronic data. Cf. Citizens Ins. Co., 730 N.W.2d at 686 (holding that courts should look to the common understanding of a word when it is not defined in the policy). But Travelers chose to define this phrase, as opposed to rely on its ordinary meaning, and it did so with the broad exception that "facts or information" that "provide instructions or directions" are not "Electronic Data." R. 21-2 (Policy at 32) (Page ID #232). Ambiguities in an insurance contract are construed in favor of the insured, Citizens Ins. Co., 730 N.W.2d at 686, and exclusion provisions are strictly construed against the insurer, Hunt, 852 N.W.2d at 565-66. Thus, Exclusion G is inapplicable in this case because the fraudulent bank-routing instructions do not constitute "Electronic Data" as defined by Travelers.

3. Exclusion H

Finally, Travelers argues that ATC is not covered by the Policy because of Exclusion H, which states:

R. 21-2 (Policy at 38) (Page ID #238) (emphasis in original denoting terms explicitly defined by the Policy). Travelers contends that the impersonator's emails constitute "fraudulent documents" and that Gizinski relied upon those emails when entering the information into the banking portal to initiate the wire transfer. Appellee Br. at 37. For the reasons stated in Section II.C.2, supra, Gizinski's entries into the banking portal do not constitute "Electronic Data" as defined by the Policy. Consequently, Exclusion H is inapplicable and does not preclude coverage.

III. CONCLUSION

For the foregoing reasons, we hold that ATC's loss is covered by the Policy and none of the asserted Policy exclusions apply. Thus, we REVERSE the district court's grant of summary judgment to Travelers, grant summary judgment to ATC, and REMAND for further proceedings consistent with this opinion.