Cyber insurance guide
Social engineering and funds transfer fraud
Social engineering coverage pays when an employee is tricked into sending money or goods to a criminal posing as a vendor, executive, or client.
How the scams work
A criminal gains access to an email account or imitates one, then sends a convincing request to change bank details, pay an invoice, or wire funds. Because the employee authorizes the payment, standard computer fraud coverage may not respond. That is why social engineering is a separate insuring agreement.
Reported losses
In 2024 the FBI's IC3 recorded 21,442 business email compromise complaints with $2,770,151,146 in reported losses, among the costliest categories it tracks. Source: IC3 2024 Internet Crime Report.
Coverage variations
- Social engineering fraud: loss from an employee's good-faith transfer based on fraudulent instructions
- Funds transfer fraud: unauthorized instructions sent to your bank in your name
- Invoice manipulation: lost revenue when a criminal redirects a payment owed to you
- Telecommunications fraud: unauthorized use of your phone system
Verification is the best control
Call back a known number before changing payment details or sending any wire. Many insurers ask whether you require call-back verification, dual approval for transfers above a threshold, and email security training. A written procedure can affect both eligibility and sublimits.
Frequently asked questions
Is business email compromise covered by cyber insurance?
Often, under a social engineering or funds transfer fraud section, usually with a sublimit. Some policies require verification procedures as a condition of coverage.
How big are business email compromise losses?
The FBI's IC3 recorded 21,442 business email compromise complaints and about $2.77 billion in reported losses nationally in 2024.
Does crime insurance cover this instead?
Some crime policies cover social engineering fraud. Coordinate cyber and crime coverage so there are no gaps or unexpected exclusions.
More coverage and guides
- First-party cyber coverage
- Third-party cyber liability
- Ransomware and cyber extortion coverage
- Social engineering and funds transfer fraud
- Cyber business interruption
- Regulatory defense and PCI coverage
- Data breach notification laws by state
- Security controls cyber insurers look for
- Cyber insurance application checklist
- What affects cyber insurance cost
- Building a cyber incident response plan
Last updated October 15, 2026 · How we research