Social engineering fraud: cyber policy or crime policy?

Social engineering fraud, where someone tricks your own employee into sending money, can be covered by a crime policy, a cyber policy, both or neither, and the answer sits in specific wording rather than in the name of the policy. A crime policy is the more natural home and can carry a higher limit, but it usually pays only if you verified the request by a method other than email. A cyber policy often carries the cover as a small sublimit, commonly in the low six figures at most.

Why the question is hard

A hacker who breaks into your bank portal and a stranger who emails your accounts-payable clerk a "new bank account" are different events. In the first, a thief moves your money without anyone at your company approving anything. In the second, your own employee, acting in good faith, authorizes a real payment to the wrong place. Insurers wrote the original computer fraud and funds transfer fraud wording for the first scenario. The second scenario, social engineering fraud, arrived in volume with business email compromise, and coverage has been patched in ever since.

The FBI's 2025 Internet Crime Report counted 24,768 business email compromise complaints with $3.05 billion in reported losses for 2025, up from 21,442 complaints and $2.77 billion in 2024 (FBI IC3 2025 Annual Report). Those are voluntary reports, so the true figure is higher. The point for buyers is that this is a first-party loss of your own cash, and neither your general liability policy nor your property policy touches it.

Which scam fits which coverage

How a crime policy responds

The ISO commercial crime form, in the June 2022 edition (CR 00 22 06 22, discovery form, as reproduced in a specimen published by AmTrust.pdf)), splits these events into separate insuring agreements. Carrier and manuscript forms vary, so treat this as the benchmark rather than your policy.

• Computer and funds transfer fraud (A.6). Covers loss resulting directly from a fraudulent entry or change of data in a computer system that causes money, securities or other property to be transferred without your knowledge or consent, and from your bank debiting your account on a forged transfer instruction. The same section excludes loss from an employee or other person acting on any instruction that proves to be fraudulent. That carve-out is what pushes a tricked-employee loss out of A.6.
• Fraudulent impersonation (A.7). Covers loss from acting in good faith on a "change of account request" that an imposter purported to issue for a client, vendor or authorized person, and from a "transfer instruction" from an imposter posing as an authorized person, client or vendor. It pays for "money" and "securities" only.
• The verification condition. Before moving money under A.7 you must make a reasonable effort to verify the request, "but not through email," with the vendor or client or with a different authorized person, and document the result at the time. Call-backs to a number already in your vendor file are the standard answer.
• The limit. Each insuring agreement has its own limit on the declarations page, and a blank line means no coverage. On carrier forms, impersonation coverage may arrive as an endorsement with a sublimit below the policy's overall limit, so check which one you have.

The ISO form defines a "vendor" as someone who provides goods or services to you under a written agreement. A one-off supplier without a contract can fall outside it, which is a detail underwriters rarely mention at placement and adjusters find at claim time. For the rest of the crime form, see commercial crime insurance: what it covers and what it excludes.

How a cyber policy responds

Cyber forms are not standardized, and not every one covers this at all. Where it is offered it appears under names like fraudulent instruction, social engineering, funds transfer fraud or cyber crime. Law firm Lowenstein Sandler wrote in Insurance Journal (March 2, 2023) that insurers moved from offering full-limit cover to sublimits "typically in the range of $100,000 to $250,000," often conditioned on independent verification of payment-instruction changes. That is a 2023 observation. Check the current figure on your own quote, because sublimits and retentions move at every renewal.

Two points follow from how cyber cover is built:

1. A cyber limit of $5 million does not mean $5 million for a fraudulent wire. The fraud extension is a sublimit inside the aggregate and may carry its own retention.
2. Cyber pays for the cleanup, crime pays for the money. A cyber policy's incident-response and forensic coverage helps you find out how the fraudster got in. A crime policy that excludes the expense of proving a loss will not. See first-party vs third-party cyber coverage for the split.

What the courts have said about "computer fraud"

Because older crime forms paid for loss "resulting directly from the use of any computer to fraudulently cause a transfer," policyholders sued over spoofed-email losses and got mixed results. The Fifth Circuit rejected coverage for a roughly $7 million vendor-impersonation loss in Apache Corp. v. Great American Insurance Co. (Oct. 18, 2016, unpublished). The Second Circuit (Medidata Solutions v. Federal Insurance Co., summary order, July 6, 2018) and the Sixth Circuit (American Tooling Center v. Travelers, 895 F.3d 455, July 13, 2018) found coverage for spoofing losses under computer fraud wording. The Eleventh Circuit found coverage for a $1.7 million fraudulent-instruction loss in Principle Solutions Group v. Ironshore (944 F.3d 886, Dec. 9, 2019). Those cases turned on specific policy language and state law. Insurers responded by writing the dedicated impersonation agreement described above, so a modern claim usually rises or falls on that wording and its verification condition, not on the older computer-fraud debate. Policy interpretation is a matter for coverage counsel.

When both policies could apply

The same loss can arguably fall under a crime policy's impersonation agreement and a cyber policy's fraud extension. Each form's other insurance clause may make it excess over the other, or the insurers may split the loss. Brokers handle this in three ways: confirm which policy is intended to respond first, ask that each policy's retention count toward the other's so you don't pay two deductibles for one loss, and align the verification conditions so a control that satisfies one satisfies both. If you buy crime and cyber through different agents, give each the other's declarations.

Hypothetical example

Say a 40-person industrial distributor carries a crime policy with a $250,000 fraudulent impersonation limit and a $10,000 deductible, plus a cyber policy with a $100,000 social engineering sublimit and a $25,000 retention. A fraudster compromises a supplier's email and sends a "bank change" notice. An accounts-payable clerk updates the vendor record and pays a $186,000 invoice to the new account.

• If the clerk phoned the supplier's number from the existing vendor file, and logged the call that day, the verification condition is met. The crime policy would pay $186,000 less the $10,000 deductible, or $176,000, assuming no other exclusion applies.
• If the clerk emailed the supplier's contact "to confirm," the reply came from the fraudster. That fails a "not through email" condition. The crime insurer may deny, and the company falls back on the cyber sublimit: $100,000 less the $25,000 retention, or $75,000, if the cyber policy's own verification terms were met.

The numbers are invented to show the mechanics, not typical limits or prices.

What to do in the first hours after a payment goes wrong

1. Call your bank's fraud or wire desk and ask for a recall of the transfer. The FBI's IC3 says that if you discover a fraudulent transfer, time is of the essence, and to contact your financial institution immediately and request a recall along with any indemnification documents.
2. File a complaint at ic3.gov with the full transaction details, whatever the amount. The IC3 Recovery Asset Team's Financial Fraud Kill Chain process was initiated 3,900 times in 2025 (3,574 domestic, 326 international), with $507 million frozen in the domestic cases (FBI IC3 2025 Annual Report).
3. Notify your crime and cyber insurers and your broker the same day. Read what happens when you file a cyber claim for what the claim file will ask for. Late notice and skipped verification can each put the claim at risk.
4. Preserve the emails with full headers, the vendor-change request, and your call-back notes. Do not delete the spoofed messages.

Buying checklist

• Find where each of impersonation, funds transfer fraud and computer fraud sits, and write down each limit, retention and sublimit. Compare them with your largest realistic single wire.
• Read the verification condition word for word. Does it require a call, a named person, written documentation, or approval by a second person?
• Check whether the definition of "vendor" or "client" requires a written agreement.
• Ask whether the policy covers AI-generated voice or video impersonation. See Deepfakes and AI-driven fraud: what cyber and crime policies cover.
• Run the cyber insurance readiness checklist: dual approval on wires, call-backs on bank changes and positive pay are controls both underwriters and claim handlers look for.

Key takeaways

• A tricked employee is not a hacker. Standard computer-fraud wording often excludes the first and covers the second, so social engineering needs its own coverage line.
• Crime policies can offer a higher limit for impersonation, but verification by something other than email, documented before payment, is often a condition of paying.
• Cyber fraud extensions are frequently sublimited well below the policy limit. Ask for the sublimit and retention in writing.
• Where crime and cyber might both respond, confirm which pays first and whether retentions erode across policies.
• After a bad wire, call the bank for a recall and file with IC3 within hours; speed affects whether funds can be frozen.