Glossary
Social engineering fraud
Fraud that tricks an employee into voluntarily sending money or data by impersonating a vendor, executive or client, rather than breaking into systems.
Also called: social engineering, impersonation fraud, fraudulent instruction, vendor impersonation fraud
Social engineering fraud manipulates a person, not a system. A criminal poses as a vendor, executive, customer or bank and persuades an employee to wire money, change payment details or share credentials. Typical forms are a fake invoice, a spoofed email from the CEO demanding an urgent wire, a vendor "bank change" notice, and, increasingly, deepfake voice or video. The FBI's Internet Crime Complaint Center reported about $3.05 billion in business email compromise losses in its 2025 report.
The insurance problem is that traditional crime coverages were built for hacking and forgery. Computer fraud and funds transfer fraud typically respond when someone without authority causes the transfer. When an authorized employee voluntarily sends the money, those coverages often do not pay. Insurers therefore sell a social engineering or fraudulent instruction endorsement on a crime or cyber policy, usually with a sublimit well below the main limit and a condition, such as a call-back to a known phone number before paying, that the insured must have followed.
Check both policies for a gap. The crime policy may point to cyber and the cyber policy may point to crime, leaving nothing. Confirm the sublimit, the verification condition and whether the cover applies to vendor impersonation and executive impersonation alike. Written dual-approval and call-back procedures are the best control.
The guides on social engineering fraud: cyber policy or crime policy? and business email compromise and funds transfer fraud coverage explain placement, and the entries on funds transfer fraud and computer fraud show what the older grants cover.
Last reviewed October 10, 2026