Does your insurance cover a payment sent to an impostor?

Your business insurance covers a payment sent to an impostor only if a policy you hold contains a coverage part written for that event, usually called social engineering fraud or fraudulent instruction coverage, and even then it often pays only part of the loss. That coverage part normally carries a sublimit far below the policy limit, and it is commonly conditional on your having verified the changed payment details before the money left.

The sentence "we have cyber insurance" therefore answers a different question. A cyber policy is built around data breaches, ransomware and the liability that follows them. A crime policy is built around theft of money. A payment that one of your own people approved, in good faith, on an instruction that turned out to be false sits awkwardly between the two, and insurers and courts have spent years arguing about where it falls. The wording of your own policy decides the outcome, and that wording changes at renewal.

The court decisions and banking rules cited below come from the United States unless stated otherwise, and policy forms differ from one insurer and one country to the next. This article is general information, not legal or insurance advice: read your own policy with your broker.

Why does a payment to an impostor fall between a cyber policy and a crime policy?

A payment to an impostor falls between a cyber policy and a crime policy because the money was not taken from your firm by a machine or by a thief with access to your account: it was sent by your own authorised employee. Most traditional insuring agreements were written for the first two situations, not the third.

A crime policy, sometimes called a fidelity or commercial crime policy, is a first-party policy. It pays your own loss of money, securities or property from listed causes: employee dishonesty, forgery, theft on the premises, computer fraud, funds transfer fraud. Each cause is a separate insuring agreement with its own definition and often its own limit.

A cyber policy combines first-party cover for an incident on your systems (forensics, data restoration, business interruption, notification costs) with third-party liability cover for claims by people harmed by that incident. According to the insurance trade publisher Rough Notes, base cyber forms typically exclude the value of money or wire transfers lost, so the loss of funds comes back in only through an endorsed social engineering, phishing or funds transfer section. The wholesale broker Amwins notes that not all carriers offer impersonation fraud coverage and that its limits can be lower than for other cyber risks.

The practical result is that a firm can hold both policies, each with a seven-figure limit, and still find that the only part of either policy that answers an impostor payment is one endorsement with a five- or six-figure sublimit. A firm can also hold both and find the endorsement on neither.

Which coverage part answers which kind of loss?

Four coverage parts are usually in play after an impostor payment: computer fraud, funds transfer fraud, social engineering or fraudulent instruction, and invoice manipulation. Each one answers a different sequence of events, and only the third is written for an employee who sent the money willingly.

The table sets out the general pattern. Definitions vary by insurer, and the names themselves are not standard: Amwins lists cyber crime, eCrime, funds transfer fraud, cyber deception and impersonation fraud as labels the market uses for overlapping covers.

Read across the rows and the logic is consistent. The first two were drafted for money taken behind the firm's back. The third was added to the market because the first two kept being refused for payments made in the open. The fourth covers the mirror image: your firm is the one impersonated, and the person who paid the wrong account is your client.

Why does a voluntary payment by an employee often fall outside computer fraud and funds transfer fraud?

A voluntary payment by an employee often falls outside computer fraud and funds transfer fraud because those insuring agreements usually require a transfer made without the insured's knowledge or consent, or a loss resulting directly from the use of a computer, and an employee who knowingly approves a transfer satisfies neither test on the insurer's reading.

A 2021 decision of the US Court of Appeals for the Fifth Circuit shows the mechanism clearly. A silicon manufacturer's employees, deceived by emails that appeared to come from a vendor, sent more than $1 million to an account the vendor did not control. As summarised by the law firm Hinshaw & Culbertson, the policy had a computer transfer fraud part with a $1 million limit and a social engineering part with a $100,000 limit. The computer transfer fraud part covered a transfer made "without the Insured Entity's knowledge or consent". Three employees had affirmatively authorised the transfer, so the court held that the company knew of it, and recovery was confined to the $100,000 social engineering limit.

Crime policies can also contain a voluntary parting exclusion. In a federal district court decision from Virginia discussed by the law firm Hunton Andrews Kurth, the exclusion removed loss resulting from the insured, or anyone acting on its authority, being induced by a dishonest act to part with money. The court held that an impostor posing as the company's president did not make the employee's transfer any less voluntary, and it also refused cover under the forgery endorsement because an email is not a cheque, draft or similar instrument.

Courts have not been unanimous. In 2018 the US Court of Appeals for the Second Circuit held that a spoofed email was a fraudulent entry of data into the insured's computer system and that the employees' transfer of more than $5 million was a direct loss under a computer fraud part, and in the same month the Sixth Circuit reached a similar result for a manufacturer that had wired about $834,000 on falsified vendor emails, according to an analysis by the law firm Covington & Burling. Those rulings turned on the exact wording and on the state law applied. They are a reason to have a refusal reviewed, not a reason to count on computer fraud cover when the policy is bought.

How much does a social engineering sublimit actually pay?

A social engineering sublimit pays the loss, less your retention, up to the sublimit and no further, so on a large payment it can leave most of the loss with your firm even though the policy limit printed on the first page is many times higher. A sublimit is a ceiling inside the policy limit that applies to one coverage part only.

Lowenstein Sandler writes that insurers moved from offering this cover at full policy limits to sublimits typically in the range of $100,000 to $250,000. The retention, the amount your firm bears before the insurer pays anything, applies on top.

Take a worked example, with every figure illustrative. A firm pays $240,000 to an impostor posing as a known supplier. Its policy has a $1,000,000 limit, a social engineering sublimit of $100,000 and a retention of $10,000. The table shows what the same loss recovers under four versions of that policy.

In the second row the calculation is $240,000 less the $10,000 retention, which gives $230,000, capped at $100,000. The firm keeps $140,000 of the loss, a little over 58% of the payment, while holding a policy with a limit more than four times the amount lost. The sublimit is 10% of the policy limit and under 42% of this one payment.

A recall by the bank changes the arithmetic less than you might expect. Suppose the bank recovers $35,000, and the policy treats that recovery as reducing the loss first. The net loss is $205,000; less the retention it is $195,000, still above the sublimit, so the insurer still pays $100,000 and the firm bears $105,000. Policies differ on how recoveries are shared between insurer and insured, which is one more clause to read before a loss.

Some firms close part of the gap with an excess policy. Barnes & Thornburg points out that an excess policy may need wording that lets it drop down over a sublimit, otherwise it sits above the full underlying limit and never reaches a sublimited loss, and that a binder letter may not disclose the sublimits at all.

How does the uninsured share grow with the size of the payment?

The uninsured share grows quickly with the size of the payment because the sublimit is a fixed amount: once a loss exceeds the sublimit plus the retention, every additional dollar stays with the firm. A sublimit that looks adequate against an ordinary supplier invoice covers a small fraction of a closing payment or a settlement transfer.

The chart applies the same illustrative terms as before, a $100,000 sublimit and a $10,000 retention with all conditions met, to four payment sizes.

The firm's share goes from 20% of a $50,000 payment to 80% of a $500,000 payment and 90% of a $1,000,000 payment. The useful comparison at renewal is therefore the sublimit against the largest single payment your firm makes in a normal year, not against its average invoice. For a title office or a law office that figure is a closing or a settlement; for a brokerage it may be a commission disbursement or a client refund.

Which conditions decide whether a social engineering claim is paid?

A social engineering claim is usually decided by whether your firm verified the instruction before paying, by a method other than the one the instruction arrived through, and whether it can prove it. Notice given on time and answers in the application that match real practice come next.

Lowenstein Sandler describes policies that now require the policyholder to independently verify a change in payment instructions before sending money, some of them by a method of communication other than the one used to request the change. Amwins makes the same observation from the broker's side: callback and authentication provisions will often limit coverage for social engineering losses, and a buyer should try to avoid or narrow them where the market allows.

Check your own file against the conditions that most often matter:

• A call-back to a known number. The person who verified used a telephone number already on file before the request arrived, not a number taken from the email or the new invoice.
• A record of that call. The date, time, the person spoken to, the number dialled and the name of the employee who called are written down where a claims adjuster can see them. A verification nobody recorded is hard to prove months later.
• A second approver. Where the policy or the application refers to dual authorisation, a second person approved the payment or the change of bank details, and the approval is logged.
• The scope of the trigger. The condition may apply to any change of payment details, to new payees, or to payments above a threshold. Know which, because a control that runs only above a threshold fails a condition that has none.
• Whose money is covered. The cover may be limited to your firm's own funds. Money you hold for clients may need a separate endorsement.
• Who can be impersonated. Some wordings list the parties whose impersonation counts: a vendor, a client, an employee, an executive. An impostor posing as someone outside the list may fall outside the cover.
• Notice and proof of loss. The policy sets when the insurer must be told and when the documented claim must follow. Late notice is a common ground of refusal.
• The application. The answers your firm gave about its payment controls when it bought the policy describe what it actually does today.

Are client funds and money held in trust covered?

Client funds and money held in trust are not automatically covered by a social engineering coverage part, which is often written for the insured's own money. Amwins identifies client funds as a gap: some insurers offer an endorsement for client funds lost to social engineering, and the practice is not universal.

For the firms most exposed to impostor payments, this is the central question. A law office, a title or settlement office, a property manager and many brokerages move far more of other people's money than their own. A crime policy may cover property of others only when it is held on the firm's premises or only for employee dishonesty. A professional liability policy may respond when a client claims the firm was negligent in paying the wrong account, but those policies frequently carry their own exclusions or sublimits for funds transfers, and they answer a claim made against you, not the loss itself.

Amwins also notes that brokers with specialist markets can place this risk for attorneys, real estate and title firms, classes that standard markets treat as high risk. If your firm holds client money, ask in writing whether the social engineering cover extends to funds held in trust or escrow, and to what sublimit, and keep the answer with the policy.

Who else may bear part of the loss, apart from your insurer?

Apart from your insurer, part of the loss may fall on a bank or on the counterparty who was impersonated, but neither is a reliable source of recovery for a business, and the result depends on the country, the payment system and the contract between the parties.

In the United States, wire transfers between businesses are governed by Article 4A of the Uniform Commercial Code. As the law firm Spencer Fane summarises it, a bank can leave the loss from a fraudulent order sent in the customer's name with the customer when the two had agreed a commercially reasonable security procedure and the bank followed it in good faith. An impostor payment is weaker ground still for the customer, because the order was genuinely issued by the customer's own staff. On the receiving side, the same article lets the beneficiary's bank rely on the account number even when the name on the order identifies someone else; the law firm Burr & Forman notes that the exception is actual knowledge of the mismatch, which is a question of fact in each case.

Rules elsewhere can be more favourable but are often aimed at consumers. In the United Kingdom, the Payment Systems Regulator's reimbursement requirement for authorised push payment fraud applies from 7 October 2024 to payments over Faster Payments and CHAPS, up to £85,000 per claim, and covers individuals, microenterprises and charities. A firm above the microenterprise size is outside it.

The counterparty is the other possibility. If your firm paid a supplier's invoice to an impostor's account, the supplier is still owed; if the false instructions came from the supplier's compromised mailbox, your firm may argue the supplier should share the loss. Some US courts have looked at which party was better placed to prevent the error, and many disputes end in a commercial compromise. In the Sixth Circuit case described earlier, the manufacturer paid its vendor half of the outstanding invoices and the two agreed that the other half would depend on the insurance recovery, according to Covington & Burling. Where the supplier's own system was compromised, its cyber policy may respond to your claim under its network security liability or invoice manipulation cover. A written payment-details clause in your contracts, stating that bank details change only after a call-back to a named contact, makes that conversation much shorter.

What should you do in the first hours to protect the claim?

In the first hours, three notifications protect both the money and the claim: a recall request to your bank, a report to the authorities, and notice to every insurer whose policy might respond. Each one also creates a dated record that the claim will need.

Speed matters for the recall above all. In the FBI's 2024 IC3 report, the Recovery Asset Team handled 3,020 incidents under its Financial Fraud Kill Chain process, and the report states that complaints filed as quickly as possible help that process.

The proof of loss follows later and is built from the same records: the payment confirmation, the false instruction, the control that was or was not applied, the recall result and the report reference. If the insurer refuses the claim, Lowenstein Sandler's advice is to have the policy wording and the insurer's coverage position letter reviewed by experienced coverage counsel before accepting the refusal, because the result turns on the words of the policy.

What should you ask your broker at renewal?

At renewal, ask your broker to show you in the policy wording where an impostor payment is covered, for how much, and on what conditions. A summary of cover or a binder is not enough, because sublimits and conditions often sit in endorsements.

The questions worth putting in writing:

• Which policy, and which numbered insuring agreement or endorsement, covers a payment our employee makes in good faith on a false instruction?
• What is the sublimit for that cover, what is the retention, and is the sublimit per claim or an aggregate for the policy period?
• Can the sublimit be raised, and what would the insurer need from us to offer it?
• Is there a verification or call-back condition? Does it apply to every payment, to changes of bank details, or above a threshold? What evidence satisfies it?
• Is the verification requirement a condition of cover, or does failing it only reduce the limit?
• Are funds we hold for clients, in trust or in escrow, covered under the same part? To what limit?
• Whose impersonation is covered: vendors, clients, our own executives and staff, other parties to a transaction?
• If our own mailbox is compromised and a client pays our invoice to the wrong account, is there invoice manipulation cover, and does it pay our unpaid receivable, the client's claim against us, or both?
• If we hold both a crime policy and a cyber policy with this cover, which pays first, and can the two sublimits be added together?
• Does any excess policy drop down over the social engineering sublimit?
• What are the notice and proof of loss deadlines, and to whom must notice be sent?
• Has any wording in these sections changed since the last policy period?

The last question matters more than it looks. Lowenstein Sandler describes verification language as having been added quietly at renewal, and advises policyholders to scrutinise crime and cyber renewals because insurers revise their wording each year.

Which controls reduce both the loss and the cost of cover?

The controls that reduce the loss are the same ones underwriters ask about, so they improve the terms on offer as well: a call-back to a known number for every change of payment details, two people for every payment above a set amount, and a written record of both. Insurers price and limit this cover from the answers in the application.

• A fixed call-back rule. Any new payee and any change of bank details is confirmed by telephone on a number held before the request, by someone other than the person who received the request. This is the control most policies now name.
• A verification log. One shared record, with the fields listed in the conditions section above. It turns a habit into evidence.
• Dual approval above a threshold. Set the threshold below your sublimit, so that no single person can send a payment larger than the insurance would cover.
• A cooling period for changed details. The first payment to changed bank details waits a set time, or is preceded by a small test payment confirmed by the payee on the known number.
• Controls at the bank. Ask your bank which security procedures it offers business customers: dual release in online banking, payee allow-lists, daily limits, and a payee name check where the payment system supports one. Under the Uniform Commercial Code rules described above, the procedure you agreed with the bank also shapes who bears the loss.
• Mailbox protection. Multi-factor authentication on every mailbox, and a periodic review of forwarding rules, address the invoice manipulation side of the risk, where your firm is the one being impersonated.
• Training tied to the procedure. Amwins notes that some cyber policies include training modules. Training is most useful when it rehearses your own call-back rule with the people who release payments.
• Contract wording. State in engagement letters and supplier contracts that your bank details never change by email alone, and that the other party's will be verified by telephone.

None of these removes the need to read the policy. A firm with every control in place and no social engineering coverage part still recovers nothing from its insurer, and a firm with the coverage part and no record of its call-back may recover nothing either. The two halves, the wording and the evidence, have to be in place on the day before the instruction arrives.