Commercial crime insurance: what it covers and what it excludes

Commercial crime insurance is a first-party policy that reimburses your business for money, securities and other property lost to theft and fraud: employee theft above all, but also forged checks, burglary and robbery, computer fraud, fraudulent wire instructions and impostor scams. It exists because your commercial property insurance: what it covers and what it doesn't and liability policies exclude most of these losses, and because cyber insurance responds to a different set of events.

Why property and liability policies leave a gap

The standard ISO property forms are built for fire, wind and similar physical perils. The special causes of loss form excludes dishonest or criminal acts by your employees and others you entrust with property, and it limits theft of money and securities. A general liability policy pays for harm you cause to other people, not for money that someone takes from you. NAIC's 2025 market share data show U.S. insurers wrote about $1.44 billion of fidelity premiums and $671 million of burglary and theft premiums in 2025. Crime coverage is the policy written for the loss that is left: the controller who pays invoices to a shell company, the cashier who skims the register, the forged check, the vendor "bank change" email that turns out to be a fraudster.

What the policy covers: the insuring agreements

A crime policy is a menu. Each insuring agreement is its own coverage with its own limit and deductible, and it applies only if the declarations show a limit next to it. A line left blank is coverage you do not have. The table follows the structure of the June 2022 edition of the ISO commercial crime policy (CR 00 22 06 22, discovery form), as reproduced in a specimen published by AmTrust.pdf). Carrier and manuscript forms differ in numbering and wording.

Two of these are where modern losses land. The computer fraud wording has been argued in court for years because older forms asked whether a computer was used to "fraudulently cause a transfer," and policyholders and insurers disagreed about whether a spoofed email counted. The impersonation agreement in the 2022 specimen addresses that scenario directly; social engineering fraud: cyber policy or crime policy? and business email compromise and funds transfer fraud coverage take it apart in detail.

Discovery form or loss-sustained form

ISO publishes the crime program in two triggers, and which one you hold matters most at renewal and when you switch carriers.

• Discovery form. Pays for loss that a "designated person" discovers during the policy period, whenever the act happened, unless a retroactive date or the known-dishonesty exclusion applies. A designated person is an insurance risk manager, partner, LLC member or manager, director, trustee or officer, or the highest-ranking employee at a location. After cancellation, the 60-day extended discovery period in the specimen ends the moment other insurance replaces the coverage, and runs one year for ERISA plan losses.
• Loss-sustained form. Pays only for loss that happened while this policy was in force, and typically gives a longer period, often one year, to discover it after the policy ends.

If a discovery form replaces a loss-sustained policy that still has an open window to discover loss, the form's "policy bridge" condition leaves losses within the old policy's limit and deductible to the old policy, and the new carrier pays only the excess. Tell your broker whether a prior carrier's discovery window is still open.

One employee, one limit

Under the ISO definition, an "occurrence" for employee theft is an individual act, the combined total of all separate acts whether or not related, or a series of acts, by one employee, during and before the policy period. A single limit and a single deductible apply, however many years the scheme ran.

Hypothetical example. A 25-person wholesale distributor carries a discovery-form policy with a $250,000 employee theft limit and a $10,000 deductible. In 2027 the owner learns that the controller has paid fake invoices to a shell vendor since mid-2023, and the forensic accountants put the total at $410,000. The policy pays the loss above the deductible, up to the limit: $250,000. The fee for the forensic accountants is not paid, because the standard form excludes the cost of establishing the existence or amount of a loss. The earlier years are not a separate claim with their own limits. Coverage for that controller ends when a designated person learns of the dishonesty. Whether the unpaid $150,000 can be recovered from the controller, a bank or the audit firm is a matter for the company's attorney.

What a crime policy does not cover

Read the exclusions before the insuring agreements. The ones that surprise buyers:

• You and your partners. Theft by the named insured, partners or LLC members is excluded. An owner who steals from co-owners is not an employee-theft claim.
• Inventory shortages. Loss whose existence or amount depends on an inventory or profit-and-loss computation is excluded. If you cannot prove who took what apart from "the count is short," expect a denial. Perpetual inventory systems, camera evidence and a named suspect change that.
• Known prior dishonesty. If you or a designated person learned before the policy period that an employee had committed theft, losses from that employee are excluded.
• Indirect loss. Lost profits, damages you owe others, and the expense of proving the loss.
• Trading, warehouse receipts and virtual currency. Losses from trading accounts, fraudulent warehouse receipts and cryptocurrency are out of the standard form.
• Voluntary parting. Under the premises coverages, property you hand over because someone tricked you is excluded. That is why impersonation fraud needs its own insuring agreement.
• Authorized access. Computer fraud does not cover an employee or other authorized user who enters or changes data.
• Extortion and ransomware. Ransom demands and ransomware payments are excluded and belong in cyber coverage, along with breach-notification costs and data-security fines.

Verification conditions in the impersonation coverage

The specimen's impersonation agreement comes with a condition: before you move money, you must make a reasonable effort to verify the request with the client or vendor, or with an authorized person other than the one who made the request, and the verification cannot be done by email. You must also document the result at the time. Losses are denied where the finance team emailed back to "confirm" the new account number, or called the number printed on the fraudulent request. A call-back to a phone number already in your vendor file, written down on the day, is the control the policy assumes.

Setting the limit and deductible

There is no formula that works for every business, but the question is the same: how much could one trusted person take, or one fraudulent instruction release, before you would notice? Start with the largest balance in any account an employee can move, the largest wire your team releases in a day, the cash and checks on hand, and the amount of any client property in your care. The Association of Certified Fraud Examiners' 2026 report (Occupational Fraud 2026, 2,402 cases) found a median loss of $104,000 per case, according to Accounting Today's summary, with an average of $1.46 million and organizations estimated to lose about 5% of revenue to fraud each year. Those are cases investigated by fraud examiners, not a forecast for your business, but they show why a $25,000 limit is thin. On the outside-fraud side, the FBI's 2025 Internet Crime Report recorded $3.05 billion in business email compromise losses. If you sponsor a 401(k) or other plan, the ERISA minimum is 10% of the funds handled, at least $1,000 and capped at $500,000 ($1 million for plans holding employer securities), according to DOL Field Assistance Bulletin 2008-04, and the bond or policy must be written to meet it. See ERISA fidelity bonds vs fiduciary liability insurance.

Underwriters tend to ask the same questions, and your answers move the price and the deductible: who can both approve and release a payment, whether bank positive pay and ACH debit blocks are in place, whether vendor bank changes are verified by call-back, how often an outside CPA reviews the books, and whether employees with cash or check access are screened and required to take consecutive vacation days.

Where crime coverage is demanded by contract

Staffing firms, janitorial and security contractors, property managers, payroll and bookkeeping services, nonprofits and government grantees often meet it first in a contract or grant agreement. A client wants employee theft of its property covered, or a lender wants a minimum limit. See Staffing agency insurance, Property manager insurance and Nonprofit insurance. When a contract calls for a "fidelity bond" or "blanket crime bond," the next guide, employee theft coverage and fidelity bonds: what they cover and who needs one, explains how the bond differs from the policy. A package for smaller companies may bundle crime with directors' and officers' liability, employment practices and fiduciary liability (Management liability packages: D&O, EPLI, fiduciary and crime).

Key takeaways

• Crime insurance covers your own losses from theft and fraud that property and liability policies exclude; coverage applies only to insuring agreements with a limit on the declarations.
• Know your trigger. A discovery form pays for losses found during the policy period; a loss-sustained form pays for losses that happened during it.
• All acts by one employee are one occurrence and one limit, however long the scheme ran.
• Owner theft, inventory shortages, known prior dishonesty, proof-of-loss costs and ransomware are standard exclusions.
• Impostor-fraud coverage can require a documented verification, not by email, before you pay.