Social Engineering Fraud: Cyber Insurance vs. Crime Insurance

The loss can be entirely human, not technical

An employee wiring funds, changing a vendor's bank details, buying gift cards for a fake executive, or handing over credentials to a convincing impersonator are all social-engineering losses. No server needs to be breached and no ransomware needs to run for the money to disappear.

That distinction matters because cyber insurance is generally written around computer systems and data, while crime insurance is generally written around theft, fraud, and dishonesty — and social-engineering fraud sits uncomfortably between the two, which is exactly why insurers write narrow, specific language for it rather than assuming one policy automatically covers it.

A believable email cost a real invoice payment

An accounts-payable employee at a small agency receives an email that looks like it comes from a long-time supplier, referencing a real invoice number and a plausible reason for updating banking details. The employee updates the vendor record and pays the next invoice to the new account.

The money is gone, the supplier never received it, and the agency has to decide whether this is a cyber claim, a crime claim, or both — while also contacting its bank about a possible recall, which is a race against time that insurance alone cannot win.

Verification conditions can decide the claim before it is filed

Many social-engineering and funds-transfer-fraud endorsements require proof that the business followed a verification procedure — a callback to a known number, a second authorization — before changing payment instructions. If that step was skipped, the endorsement can apply a reduced sublimit or no coverage at all, regardless of how convincing the fraud was.

This is a rare case where the insurance question and the fraud-prevention question are the same question: building a callback-verification habit into vendor-payment changes is both the best defense and, often, a condition of the coverage responding at all.

What to preserve within hours, not days

Preserve the original fraudulent email with full headers rather than a screenshot, the payment instructions that were changed, any callback or verification records, bank notices about the transfer, and a timeline of who did what and when.

• Original email with headers, not a forwarded screenshot
• Old and new payment instructions side by side
• Any verification or callback attempt, successful or not
• Bank contact log and recall request confirmation
• Internal timeline: who received it, who acted, who caught it
• Both the cyber and crime policy forms, not just the summary page

Ask the broker to map the mechanism, not the label

Rather than asking "is this covered," describe the mechanism precisely: who was impersonated, what communication channel was used, whether any system was actually accessed, and how the funds moved. That level of detail is what lets a broker point to the right insuring agreement instead of guessing from a one-line description.

Frequently asked questions