Your controller gets an email from a long-time vendor: new bank, new account number, please update before the next invoice. Or it's the CEO, traveling, asking for an urgent wire to close a deal. The money goes out, the real vendor calls a week later asking where its payment is, and you file a claim under your crime policy. Then the denial letter arrives. Here's why that happens, and how to set up your coverage and your procedures so it doesn't.
The scale of the problem
This is not a rare event. In its 2025 Internet Crime Report, released in April 2026, the FBI's Internet Crime Complaint Center (IC3) recorded 24,768 business email compromise complaints and $3,046,598,558 in reported losses, second only to investment fraud by dollars lost. Those are only the losses victims reported. The report's advice when it happens is blunt: call your bank immediately to request a recall of the funds, then file a complaint at ic3.gov. Speed is often the difference between a frozen transfer and a lost one.
Why computer fraud coverage often doesn't respond
Most commercial crime policies include computer fraud and funds transfer fraud insuring agreements. The names sound like they fit. The wording usually doesn't.
- Computer fraud generally pays for loss "resulting directly" from the use of a computer to fraudulently cause a transfer. Think of a hacker getting into your systems and moving money.
- Funds transfer fraud generally pays when fraudulent instructions are sent to your bank without your knowledge or consent.
In a social engineering loss, nobody hacked the bank. Your own authorized employee, fooled but acting voluntarily, approved the payment. Insurers argue the email was just a delivery method and the real cause was the employee's decision. Many current crime forms go further and specifically exclude transfers made in good-faith reliance on an impersonator's instructions, then offer that exposure back as separate coverage.
The court split, and why wording decides it
Federal appeals courts have reached opposite results on spoofed-email losses:
- Apache Corp. v. Great American Insurance Co. (5th Cir. 2016) found no coverage. After a call and an email from a look-alike domain, an Apache employee "verified" the vendor's new account by calling the phone number printed on the fraudster's own letterhead. The court called the email "merely incidental" to an authorized transfer. The opinion is unpublished and not binding precedent, but it is widely cited.
- Medidata Solutions v. Federal Insurance Co. (2d Cir. 2018), a summary order, found the computer fraud provision covered a wire sent after spoofed emails appearing to come from the company's president.
- American Tooling Center v. Travelers Casualty & Surety Co. (6th Cir. 2018) reversed a ruling for the insurer and found coverage where a fraudster impersonating an overseas vendor redirected invoice payments.
The lesson is not that you'll win if you sue in the right state. Each decision turned on the specific policy language, and insurers have rewritten their forms since. Counting on a computer fraud agreement to cover a social engineering wire is a bet on litigation, not a plan.
What social engineering coverage actually does
The market's answer is a separate insuring agreement, called social engineering fraud, fraudulent impersonation, or something similar. It covers money your employee transfers in good faith after being deceived by someone posing as a vendor, client, or one of your own executives.
In the standard ISO crime program, the 2022 editions moved Fraudulent Impersonation into the base crime forms as an optional insuring agreement, replacing the 2015 endorsement that previously provided it. A 2023 optional endorsement, CR 25 55 (Amend Verification Condition), lets an insurer add verification requirements that apply when someone requests an account change or sends a transfer instruction. Many insurers use their own forms instead, so the label on your policy may differ.
Two features define this coverage:
- It usually carries its own sublimit, often a small fraction of the main crime limit. A policy can show a large employee theft limit alongside a much smaller fraudulent impersonation limit.
- It usually comes with a verification condition.
The gotcha: the verification condition
This is where well-insured businesses lose claims. Social engineering coverage commonly requires that, before acting on a new payment instruction or a change to bank details, your business verify it through a channel the fraudster doesn't control. In practice that means calling the vendor or executive back at a phone number you already had on file, not one in the email, the attached invoice, or the signature block.
Look again at Apache. The employee did make a verification call. It went to the criminals, because the number came from the fraudulent letter. Under a policy with a callback condition, that's a failed verification, and a failed verification can void the claim entirely, no matter how sophisticated the scam was. Read your policy's exact procedure, write it into your accounts payable process word for word, and talk to your attorney if a denial letter cites it.
Where cyber insurance fits
A cyber policy is built around data breaches, ransomware, and system intrusions. Many can add social engineering or funds transfer fraud coverage, typically as an optional, sublimited part of the policy. Even when a cyber policy doesn't pay for the stolen wire, it may pay for the forensic work to find out how your inbox was compromised and whether client data was exposed.
When you carry both crime and cyber, the two can overlap or leave a gap. Each has its own definitions, verification conditions, and other-insurance language. Coordinating them is the point of reviewing them together. Our posts on commercial crime insurance and cyber insurance for small business cover each policy's broader scope.
Practical steps that protect the money and the claim
- Put a written callback procedure in place. Every new payee, bank change, or unusual wire gets confirmed by phone using contact information from your existing records.
- Require dual approval. One person sets up or changes payment details; a different person approves the transfer.
- Verify out of band. Never confirm a request by replying to the email that made it. Urgency and secrecy from an "executive" are red flags, not reasons to skip steps.
- Use your bank's controls. Ask about positive pay, payee allow-lists, and transfer alerts or holds.
- Match the sublimit to your largest real wire. If one closing, payroll run, or vendor payment exceeds your social engineering limit, the difference is yours.
This exposure is sharpest for businesses that move other people's money: title agencies and real estate brokerages handling closing funds, accounting firms with client payment authority, and law firms running trust accounts.
Our approach
At Cory Washington & Co., we start by mapping how money leaves your business: who can add a payee, who approves wires, and how bank changes get confirmed today. Then we make sure your crime insurance includes a social engineering or fraudulent impersonation agreement with a limit sized to your largest realistic transfer, and we put the policy's verification wording side by side with your actual procedure so the two match. We coordinate that coverage with your cyber insurance so a loss that starts in a compromised inbox doesn't fall between policies.
Not sure your policy would pay if a spoofed email got through tomorrow? Request a policy review and we'll walk through the wording with you.
Frequently Asked
Does crime insurance cover a wire sent after a fake vendor email?
Only if the policy includes a social engineering or fraudulent impersonation insuring agreement, and only if its conditions were met. Standard computer fraud and funds transfer fraud agreements are generally written for transfers made without your knowledge, so insurers often deny a loss where your own employee knowingly sent the money. Courts have split on that question, and the result turns on the exact policy wording.
What is the verification condition in social engineering coverage?
It is a requirement that your business confirm a payment instruction or bank-account change through an independent channel before money moves, typically a callback to a phone number you already had on file rather than one supplied in the email. Many policies make following that procedure a condition of coverage. If the employee skipped it or called the number the fraudster provided, the claim can be denied even when the fraud itself is obvious.
Does cyber insurance cover business email compromise?
Many cyber policies can include social engineering or funds transfer fraud coverage, but usually as an optional, sublimited part of the policy, and some exclude it entirely. A cyber policy is more likely to pay for investigating and restoring a hacked email account than for the stolen wire itself unless that coverage is specifically added. If you carry both crime and cyber, check how each responds and which one applies first.
How much social engineering coverage should a business carry?
Start from the largest single payment your business realistically sends, such as a vendor payment, payroll run, or real estate closing, not from what is commonly offered. Social engineering coverage is often written at a sublimit far smaller than the main crime limit. If one wire could exceed that sublimit, the gap is yours to absorb.
This article is general information for business owners, not insurance or legal advice, and does not bind or alter coverage. Policy terms, eligibility, and pricing vary by carrier and state — confirm specifics with our licensed team before making decisions.