Business email compromise and funds transfer fraud coverage

A business email compromise (BEC) attack can create three separate losses: money you sent to a criminal, a data breach because the hijacked mailbox held personal information, and sometimes a customer's payment that went to the criminal instead of you. A cyber policy usually pays for the breach response in full, covers the stolen payment only through a sublimited funds transfer or social engineering extension with conditions, and often does not cover the customer's misdirected payment at all. The question of whether a crime policy or a cyber policy answers the payment loss is covered in social engineering fraud: cyber policy or crime policy?; this guide covers the rest of the claim.

How big the problem is

The FBI's 2025 Internet Crime Report counted 24,768 BEC complaints with $3,046,598,558 in reported losses. The report defines BEC as a scam aimed at businesses and individuals that regularly make wire transfers, carried out by compromising email accounts and other communication channels through social engineering or computer intrusion. It also noted that businesses reported more than $30 million in BEC losses involving AI in 2025, which is the territory of Deepfakes and AI-driven fraud: what cyber and crime policies cover. Those are only reports made to the FBI.

Four kinds of BEC loss and what usually responds

The first two rows are the money. The third is the breach. The fourth is the one policyholders do not see coming.

The mailbox is a data breach

Most business owners treat BEC as a fraud and forget the second half. A compromised email account may hold Social Security numbers in payroll messages, tax returns sent to accountants, health information or bank details in attachments. If the account was accessed by an unauthorized person, a lawyer has to decide whether notification duties are triggered, and the answer turns on state law, the data in the account and what the forensic review can prove. See data breach notification laws and what they cost.

This is where cyber insurance earns more than the fraud sublimit. Typical breach response coverage pays for the forensic firm that works out how the attacker got in and how long they were there, a privacy lawyer through a breach coach arrangement, mailbox review to find which messages held personal data, notification letters, and monitoring offered to affected people. A crime policy generally does not cover those costs. An employee who reports the fraud only to the bank and not to the cyber carrier can miss the part of the loss that is often larger than the stolen payment.

What funds transfer fraud coverage looks like on a cyber form

Wording varies by carrier, so treat this as the pattern, not your policy. Cyber forms have broadly three versions of the grant:

1. Funds transfer fraud. Covers loss when a third party sends a fraudulent instruction to your bank, without your knowledge, to move your money. This matches the "intruder" row above.
2. Social engineering or fraudulent instruction. Covers loss when your employee transfers funds after a fraudulent request. Forms often require that you verified the request by a separate means and may exclude goods and services, limiting cover to money and securities.
3. Invoice manipulation. Covers the loss when a criminal alters an invoice or payment details so that a customer pays the wrong account. IOA's 2026 midyear cyber outlook says protections for invoice manipulation and deception of a vendor or client are usually missing from cyber endorsements to package policies.

Three terms control how much you collect:

• The sublimit. The fraud grant is often a fraction of the policy limit. A $2 million cyber policy may pay only a six-figure amount for a fraudulent wire. IOA reports that in 2026 some insureds with strong cybercrime controls and payment authentication procedures are getting social engineering limits of $1 million or more, so ask.
• The retention, which can differ from the one that applies to breach response.
• The verification condition. If the form says you must confirm changes of payment details by a call to a known number, a claim where the clerk only replied to the email can be denied. Document each call at the time it is made.

Your bank is not your insurer

Business bank accounts do not carry the consumer protections people expect. Wire transfers are governed in most states by Article 4A of the Uniform Commercial Code, as adopted with state variations. Under the uniform text (§ 4A-202), a payment order is the customer's order if the customer authorized it, which includes an employee acting with authority, even if the employee was tricked about the recipient. If a payment was unauthorized and the bank did not follow a commercially reasonable security procedure, § 4A-204 requires the bank to refund it. Under that section the bank does not owe interest if you failed to exercise ordinary care and to notify the bank within a reasonable time not exceeding 90 days, and § 4A-505 bars objections not made within one year. Which side of that line your loss falls on is a legal question, so involve counsel.

This is why speed matters. The FBI's report says that if you discover a fraudulent transfer, you should immediately contact your bank and request a recall, and file a complaint at ic3.gov whatever the amount. The IC3 Recovery Asset Team initiated 3,900 Financial Fraud Kill Chain actions in 2025 for fraud of all kinds, covering $1.16 billion in attempted theft, and reported $679 million frozen, a 58% success rate. That figure is for all fraud types, not BEC alone, and recovery depends on how fast the request reaches the receiving bank.

A hypothetical: the hijacked controller

Say a 30-person building supplier has a cyber policy with a $2 million aggregate, a separate breach response limit, a $100,000 social engineering sublimit and a $25,000 retention. An attacker gets into the controller's mailbox through a stolen password without MFA, sets a rule that hides replies, and for six weeks reads messages about payments. The attacker emails a regular customer a notice that the supplier's bank details have changed, and the customer pays $210,000 to the criminal's account. The attacker also impersonates the supplier's steel vendor and a clerk pays $140,000 to a new account. These figures are invented to show the mechanics.

• Breach response. The mailbox held payroll and tax documents. The forensic firm, counsel and notification vendors are covered under breach response, subject to its retention.
• The vendor payment. If the clerk verified the change of account details by phone, the social engineering extension may pay up to $100,000 less the retention. The remaining $40,000 plus the retention is the supplier's loss, unless a crime policy with a larger impersonation limit also responds (commercial crime insurance: what it covers and what it excludes).
• The customer's payment. The $210,000 never reached the supplier. Without an invoice manipulation extension, there may be no first-party coverage. Who bears the loss between supplier and customer can turn on the sales contract and state law. If the customer sues, the third-party coverage may respond to the claim, subject to its terms.

The best result here would have come from controls: MFA on email, a call-back for bank changes and a second approver on wires. MFA, EDR and backups: the controls cyber insurers now require shows which of these carriers ask about.

The first 24 hours after a suspected BEC

1. Call the bank's fraud or wire desk and request a recall, and ask what documents it needs.
2. File at ic3.gov with transaction details.
3. Notify the cyber insurer, the crime insurer if you have one, and your broker the same day (what happens when you file a cyber claim).
4. Lock the compromised account: reset the password, sign out all sessions, enable MFA, and look for mailbox rules that forward or hide email.
5. Preserve the original messages with headers and your call-back notes. Do not delete anything.
6. Ask counsel whether the mailbox contents trigger notification duties.

Questions to ask your broker

• Does the policy have a funds transfer fraud grant, a social engineering grant, and an invoice manipulation grant, and what is each sublimit and retention?
• What is the verification condition, exactly, and who must perform it?
• Does breach response apply to a mailbox compromise with no ransomware?
• Are funds sent to a fraudulent account by an employee covered, or only money taken by an outsider?
• If both a crime policy and cyber policy could respond, which pays first, and do the retentions stack?

Key takeaways

• BEC can create three losses: your payment, the breach from the hijacked mailbox, and a customer's misdirected invoice. Make sure each has a home.
• Cyber breach response usually covers the mailbox investigation and notification costs in full, while fraud extensions are sublimited and conditional.
• Invoice manipulation coverage is often missing from cyber endorsements, so check for it by name.
• Banks are not your insurer: under Article 4A of the UCC, authorized payments are generally yours to bear, and reporting deadlines are short.
• Call the bank, file at ic3.gov and notify your insurers within hours.