Key Takeaways
- Social engineering fraud tricks an authorized employee into sending money or changing payment details voluntarily.
- Standard computer fraud and funds transfer fraud insuring agreements often exclude losses where your own employee authorized the payment.
- Social engineering coverage is usually added by endorsement, often with a sublimit and a verification condition.
- Callback verification to a known phone number and dual approval for payment changes are the controls underwriters ask about most.
Social engineering fraud is a scam in which a criminal impersonates a vendor, executive, or client to trick an employee into sending money. Many crime and cyber policies exclude these losses unless you add a specific social engineering endorsement, explains Bozzuto Group, a San Diego–based specialty commercial insurance brokerage that structures crime and cyber programs.
These scams succeed because nothing is hacked in the traditional sense. Your employee logs in normally, follows what looks like a legitimate instruction, and releases the payment. That voluntary act is exactly what trips up coverage.
What is social engineering fraud?
Social engineering is the use of deception to manipulate a person into taking an action, such as sending a wire, changing bank details, or sharing credentials. In a business setting, the most common versions include:
- Vendor impersonation. A fraudster poses as a supplier and emails new bank instructions for upcoming invoices.
- Executive impersonation. An email or text that appears to come from the CEO or owner asks finance staff to send an urgent, confidential payment.
- Client impersonation. A criminal posing as a customer redirects a refund or asks you to wire funds held on their behalf.
- Payroll diversion. A request that appears to come from an employee asks HR to change direct deposit details to a new account.
Business email compromise (BEC) is a related term for scams that use a hacked or spoofed email account to deliver these requests. Attackers increasingly add phone calls, text messages, and AI-generated voice to make requests more convincing.
Why doesn't my crime or cyber policy cover it?
A commercial crime policy is made up of separate insuring agreements, each with its own trigger. Two of them sound like they should apply but often do not:
- Computer fraud generally covers loss from someone fraudulently entering or changing data in your computer system to transfer money. Many courts and carriers read this to require unauthorized system access, not an employee voluntarily entering a payment.
- Funds transfer fraud generally covers fraudulent instructions sent to your bank without your knowledge. When your own employee issues the instruction, that trigger may not apply.
Many crime forms also contain a voluntary parting exclusion, which removes coverage when someone with authority knowingly hands over money, even if they were deceived. Similarly, cyber liability insurance focuses on data breaches, ransomware, and network interruption, and may treat social engineering as optional or limited coverage. Coverage depends on the carrier and policy wording.
| Insuring agreement | What it is designed for | Employee tricked into paying? |
|---|---|---|
| Computer fraud | Unauthorized entry into your systems to move money | Often not covered |
| Funds transfer fraud | Fake instructions sent directly to your bank | Often not covered |
| Social engineering endorsement | Employee deceived into transferring funds | Designed for this, subject to terms |
How does social engineering coverage work?
Social engineering coverage, sometimes called fraudulent instruction or impersonation fraud coverage, is usually added to a crime or cyber policy by endorsement. Common features include:
- A sublimit that is lower than the main crime limit. Ask what limit is available and whether it matches the size of payments you routinely make.
- A verification condition requiring that the employee verify the instruction, such as calling the vendor at a number on file, before sending funds. Failing to follow it can void coverage for that loss.
- A separate deductible that may differ from your other crime deductibles.
- Definitions of who the impersonated party can be, such as vendors, clients, or employees. Some endorsements cover only certain categories.
Read these terms closely. A sublimit that is too low or a verification step your team does not follow can leave you largely uninsured.
Which controls reduce the risk?
Underwriters ask about payment controls before offering social engineering coverage, and the same controls prevent most losses:
- Call back on a known number. Verify any new or changed bank details by calling a phone number you already have on file, never the number in the request.
- Require dual approval. Have a second person approve wires above a set threshold and any change to vendor or payroll banking information.
- Slow down urgent requests. Train staff that pressure, secrecy, and urgency are warning signs, especially when a request bypasses normal channels.
- Protect email accounts. Use multifactor authentication and alerts for new forwarding rules, which attackers often create after taking over an inbox.
- Document the process. Written procedures show underwriters your controls exist and give employees a script to follow.
Bozzuto Group's loss control resources can help you formalize these steps.
What should you do if you sent a fraudulent payment?
Speed matters. Call your bank immediately and ask it to recall or freeze the transfer. File a complaint with the FBI's Internet Crime Complaint Center at ic3.gov. Notify your insurance broker and carrier as soon as possible, preserve the emails and call logs, and avoid deleting the compromised mailbox before forensic review.
How Bozzuto Group Helps
We review your existing crime and cyber policies to show you which insuring agreements apply to social engineering, what the sublimits are, and what verification conditions you must meet. If coverage is missing or too thin, we market endorsements or standalone crime coverage sized to the payments your business actually makes.
For businesses that move large sums through wires, including distributors, manufacturers, and cannabis operators with frequent vendor payments, we align your written payment procedures with policy conditions so a claim is not denied over a missed step. Our guide to cyber liability insurance explains how these coverages fit together.
Want to check whether a funds-transfer scam would be covered? Call Bozzuto Group at 858-805-1865 or request a quote to review your crime and cyber coverage.
Frequently Asked Questions
Does cyber insurance cover wire fraud?
Sometimes. Many cyber policies cover social engineering or fraudulent instruction losses only through an optional endorsement with a sublimit. Others exclude losses where an employee voluntarily sent the money. Coverage depends on the carrier and policy wording, so review whether your cyber or crime policy includes social engineering coverage and what limit and verification conditions apply.
What is the difference between computer fraud and social engineering coverage?
Computer fraud coverage generally applies when someone gains unauthorized access to your systems and moves money. Social engineering coverage applies when a criminal deceives an authorized employee into sending payment voluntarily. Because no system is breached in most social engineering scams, a computer fraud insuring agreement often will not respond without a specific social engineering endorsement.
What is a voluntary parting exclusion?
A voluntary parting exclusion removes coverage when someone with authority knowingly transfers money or property, even if they were tricked into doing so. It appears in many crime policies and is a common reason social engineering claims are denied. A social engineering endorsement is typically designed to provide coverage for this situation, subject to its own terms and sublimit.
What controls do insurers require for social engineering coverage?
Insurers commonly ask whether you verify changes to vendor bank details by calling a known phone number, require dual approval for wires above a threshold, train employees on phishing and impersonation, and use multifactor authentication on email. Many endorsements include a verification condition, so failing to follow your documented callback procedure could jeopardize coverage.
What should I do immediately after a fraudulent wire transfer?
Contact your bank right away and ask it to recall or freeze the transfer, since speed improves the chance of recovery. File a complaint with the FBI's Internet Crime Complaint Center at ic3.gov. Then notify your broker and insurer, preserve emails and call records, and avoid altering affected accounts until a forensic review is complete.