Social Engineering Fraud Coverage

Social engineering fraud coverage responds to a specific and fast-growing loss: a criminal impersonates a vendor, executive, or trusted party and manipulates an employee into voluntarily sending money, wire transfers, or goods. Because the employee knowingly authorized the transfer — believing it legitimate — many traditional crime insurance forms deny these claims, since computer-fraud and funds-transfer-fraud insuring agreements typically require an unauthorized intrusion or forged instruction. This coverage is usually added by endorsement to a commercial crime policy, and sometimes to a cyber liability policy, to close that gap.

Why it matters to a small business: business email compromise and fake-invoice schemes now target companies of every size, and a single fraudulent wire can drain a payables account in minutes. The classic scenario — a spoofed email appearing to come from the CEO instructing accounting to wire funds to a new account — is exactly the kind of deception this coverage was built for. Buyers should note that limits for social engineering are frequently much lower than the base crime policy limit, often offered as a sublimit such as $100,000 or $250,000, and carriers commonly require a call-back verification control before they will pay.

A practical nuance: coverage and settlement often hinge on whether the insured followed its own stated verification procedures. Many policies condition payment on the business confirming payment-instruction changes through an independently obtained phone number — not the number in the fraudulent email. Failure to perform that call-back can void an otherwise valid claim. Social engineering coverage overlaps with but is distinct from cyber extortion and from a fidelity bond, which covers dishonesty by the insured's own employees rather than deception by an outsider; a well-built program addresses all three exposures.