Social Engineering Fraud and Cyber Insurance: What's Actually Covered

Why Social Engineering Sits in an Insurance No-Man's Land

Here's the scenario every CFO dreads: your accounts payable coordinator receives an email that appears to be from your CEO, urgently requesting a $180,000 wire to close a deal. The email address looks legitimate. The tone matches. She processes it. The money is gone by the time anyone realizes the CEO's email was spoofed.

Now she calls your insurance broker. And here's where it gets complicated.

Your cyber liability policy was designed to cover data breaches, ransomware extortion, and network intrusion costs. Your commercial crime policy was built to handle embezzlement, forgery, and employee theft. Social engineering fraud — where a human being was tricked into voluntarily moving money — often falls squarely between those two products, covered by neither unless you've specifically addressed the gap.

This isn't a technicality invented by claims adjusters to avoid paying. It's a genuine structural issue rooted in how policies were written before business email compromise became a $3-billion-a-year problem in the United States. Understanding this distinction is the first step to making sure you actually have coverage when you need it.

For a broader look at what cyber policies do and don't include, see what cyber liability insurance does not cover — exclusions are where most businesses get blindsided.

How Cyber Policies Treat Social Engineering: The Coverage Language That Matters

Most base cyber liability forms cover losses arising from a computer attack — unauthorized access to your systems, malware, or ransomware. The operative word is unauthorized. When an employee receives a convincing email and willingly initiates a wire transfer, the transfer itself was authorized by a real person with real credentials. There was no system breach in the technical sense.

Carriers use this distinction to exclude or limit social engineering losses under standard forms. The language varies by insurer, but watch for clauses that limit coverage to:

• Losses caused by unauthorized access to computer systems
• Fraudulent instructions received via a compromised computer system (not merely a spoofed email)
• Specific enumerated crime triggers that don't include impersonation or deception

Some insurers have evolved their forms to include social engineering explicitly — particularly insurers competing for small and mid-market commercial accounts where BEC is the dominant threat vector. But even those policies often attach a social engineering fraud endorsement with its own sublimit, deductible, and conditions that differ from the base policy.

If you have a cyber policy and haven't confirmed whether social engineering is explicitly covered and at what limit, that's the phone call to make today. Don't wait for a claim to find out the answer is no.

Crime Policies and the Verification Procedure Trap

Commercial crime policies — sometimes called fidelity bonds — have historically been the home for funds transfer fraud coverage. Many crime forms include a computer fraud or funds transfer fraud insuring agreement that can respond to social engineering losses. But there's a catch that trips up the majority of BEC claimants: the verification procedure condition.

Most crime policies require that before executing a wire transfer based on email instructions, the insured must verify those instructions through a pre-agreed, out-of-band process — typically a phone call to a known number, not one provided in the email itself. If your employee processed a wire based solely on an email without calling to confirm, many carriers will deny the claim on the grounds that required verification procedures were not followed.

This condition exists because the insurance market isn't designed to subsidize inadequate internal controls. If a business hasn't built a process to verify transfer instructions, the carrier's position is that the loss was preventable — and therefore not insurable.

The practical takeaway: your coverage is only as good as your internal procedures. A crime policy with a verification procedure requirement provides zero protection for a business that doesn't have — or doesn't enforce — a dual-authorization callback process for wire transfers.

For context on how these gaps compound with operational disruptions, the article on cyber events and business interruption coverage covers related issues that often surface simultaneously during a fraud incident.

Social Engineering Endorsements: What to Look For and What to Demand

If your broker presents a cyber policy or crime policy and claims you're covered for social engineering, push for specifics. Ask for the endorsement form number and read the insuring agreement. Here's what a legitimate social engineering fraud endorsement should address:

1. Covered Events Definition

The endorsement should explicitly name the fraud types it covers: business email compromise, phishing, vishing (voice phishing), impersonation of vendors or executives, and spoofed wire instructions. Vague language like "deceptive communications" may or may not cover your specific scenario when a claim is filed.

2. Sublimit Amount

Understand that the sublimit on a social engineering endorsement is almost always lower than the base policy limit. Negotiating this sublimit upward — even to $500,000 or $1 million — is worth the premium difference if your business regularly processes wire transfers or large vendor payments.

3. Deductible Structure

Some policies apply a separate, higher deductible to social engineering claims than to other cyber losses. Know this number before you buy.

4. Coverage Conditions

Look for conditions that require multi-factor authentication (MFA), dual-authorization for transfers above a set dollar amount, and/or security awareness training. These aren't just risk management suggestions — failure to maintain them can be cited as grounds for claim denial.

Understanding what a full cyber liability policy covers beyond social engineering is essential context. See what cyber liability insurance covers and why businesses need it for a complete breakdown of covered events.

“Business email compromise is fundamentally an abuse of trust, not a technical exploit. The insurance market has been slow to adapt its coverage forms to reflect that human deception — not system intrusion — is now the primary driver of financial loss for small and mid-sized businesses.”

— Lori Bailey, Former Chief Insurance Officer, Corvus Insurance; cyber underwriting industry expert

How Much Coverage Do You Actually Need?

The right sublimit for social engineering coverage depends on the largest single wire transfer your business could plausibly be tricked into making. That's the honest answer. For a landscaping company whose largest vendor payment is $15,000, a $100,000 sublimit is probably adequate. For a real estate firm closing transactions in the millions, it isn't.

Consider these factors when sizing your coverage:

• Average vendor payment amounts: What's your typical AP transaction size?
• Frequency of wire transfers: Businesses processing daily wires face higher cumulative exposure.
• Industry targeting: Real estate, legal, manufacturing, and professional services firms are disproportionately targeted for BEC.
• Employee financial authority: How many people can authorize a transfer, and at what dollar threshold?

A useful rule of thumb: your social engineering sublimit should cover at least your three largest typical vendor payments. If a fraudster is going to impersonate your biggest supplier, they'll try to maximize the take.

For small businesses unsure where to start on cyber coverage overall, the complete cyber liability insurance reference for business owners is a useful end-to-end resource.

After a Social Engineering Loss: Filing the Claim Effectively

If you've already wired money to a fraudster, speed matters more than anything else. The FBI's Internet Crime Complaint Center (IC3) operates a Financial Fraud Kill Chain program. If you contact your bank within 24–72 hours of the fraudulent transfer, there's a reasonable chance some funds can be recalled — particularly if the receiving account is still holding the money or it hasn't been converted to cryptocurrency.

When you file the insurance claim:

1. Document the fraudulent communication in full: Save the original email with full headers, any follow-up messages, and the wire confirmation. Don't delete anything.
2. Record your internal process: Write down exactly what verification steps were or weren't taken. This will be a primary focus of the claims investigation.
3. Report to law enforcement: File with IC3 and your local FBI field office. Many policies require this as a condition of coverage.
4. Notify your bank immediately: Request a wire recall even if you doubt it will succeed. The attempt itself may be required by the policy.
5. Preserve all communication logs: Email, phone records, and any internal approvals are part of the claims file.

Carriers will investigate whether your verification procedures were followed and whether the conditions of the social engineering endorsement were met. Having documented evidence of your process — even if it was imperfect — is far better than having nothing.

It's also worth understanding the broader landscape of what cyber policies don't cover, since social engineering claims sometimes surface additional exclusions. Common misconceptions about cyber liability insurance addresses the assumptions that leave businesses short at claim time.