Business email compromise has become one of the most damaging forms of cybercrime for businesses of all sizes. The FBI’s Internet Crime Complaint Center consistently reports it among the costliest types of online fraud. Criminals trick someone inside the business into sending money or changing payment details, and insurance doesn’t always respond the way owners expect.
Common Social Engineering Schemes
| Scheme | How It Often Works |
|---|---|
| Vendor impersonation | A message that appears to come from a supplier asks you to update its bank account for future payments |
| Executive impersonation | An urgent request that appears to come from an owner or manager asks an employee to wire funds |
| Payroll diversion | A fake request asks HR to change an employee’s direct deposit information |
Your Coverage Questions, Answered
Doesn’t cyber insurance cover this?
Not always. Many cyber policies focus on data breaches, ransomware, and network events. Losses from an employee voluntarily sending money to a fraudster may be excluded or covered only through a specific add-on.
What about a crime policy?
Crime policies often cover employee theft and certain types of fraud, but many exclude losses where someone voluntarily parted with funds. Social engineering fraud coverage is often added by endorsement, sometimes with a lower limit.
Are there conditions to coverage?
Some policies require businesses to verify payment changes through a separate channel, such as a phone call to a known number. Skipping that step can affect a claim.
Steps That Help Prevent Losses
- Verify any change to payment instructions by calling a number you already have on file
- Require two approvals for wires and new vendor accounts
- Use multi-factor authentication on email and banking accounts
If It Happens
Contact your bank immediately to try to stop or recall the transfer, report the incident to the FBI’s Internet Crime Complaint Center, and notify your insurer as soon as possible.
Seraph Risk Advisors works with businesses nationwide to review cyber and crime coverage for social engineering gaps. Policy terms vary. Business owners across the country can reach out to Seraph Risk Advisors or browse our insurance blog to learn more.
