Cyber Insurance Wire Transfer Fraud: Closing the Crime-Cyber Gap

When Wire Fraud Falls Between Your Crime and Cyber Policies

A business pays a fraudulent invoice, wires six figures to what looks like a trusted vendor's account, and then discovers both its crime and cyber policies point at each other. This is one of the most common and most avoidable coverage disputes in commercial insurance today. Cyber insurance wire transfer fraud losses sit at the seam between two policy types that were written for different eras of crime, and unless a broker actively closes that seam, the business pays for the mistake twice: once to the fraudster, and once in a denied claim.

Why does wire transfer fraud fall between crime and cyber policies?

The short answer is that crime and cyber policies were built to answer different questions.

Crime insurance was designed around dishonest acts, originally focused on employee theft, and cyber insurance was designed around network intrusions. Wire transfer fraud driven by a spoofed email doesn't cleanly fit either box. No employee stole anything, and often no system was actually hacked. A person was tricked into authorizing a transfer that looked legitimate. Underwriters on both sides can point to policy language that arguably excludes this scenario, which is exactly why so many claims end up in dispute.

What is a "fraudulently induced transfer" and why does that phrase matter?

A fraudulently induced transfer is a payment an employee sends voluntarily, believing it is legitimate, rather than one taken through unauthorized system access.

This distinction is the crux of the coverage gap. Standard crime insurance computer fraud coverage typically requires unauthorized access to a computer system, and standard cyber insurance often requires a network security failure. A fraudulently induced transfer usually involves neither. The employee logs in normally, the system isn't breached, and the transfer is authorized through the company's own approval process, just based on false information. Carriers that don't offer a specific social engineering fraud endorsement will frequently deny these claims on that technicality alone.

How much money is actually at stake from this gap?

The scale is large and growing, based on the FBI's most recent tracking of business email compromise losses.

According to the FBI's Internet Crime Complaint Center, business email compromise schemes generated $55.5 billion in exposed losses globally between October 2013 and December 2023, with $20.1 billion of that tied to US victims specifically. Exposed losses grew 9% year over year in the most recent reporting period the FBI tracked. These aren't scattered small losses either. A single successful scheme often targets one large, time-sensitive payment, such as a real estate closing, a payroll run, or a vendor invoice, which is why individual claims frequently land in the hundreds of thousands of dollars.

What does cyber insurance typically cover, and what does it leave out?

Cyber insurance generally covers losses tied to a network security failure or a data breach, not a tricked employee.

Most cyber policies respond well when a hacker breaches a network and directly initiates a fraudulent transaction, or when ransomware disrupts operations and creates business interruption costs. Where cyber insurance tends to fall short is the far more common scenario: an employee receiving a convincing but fake email and initiating the transfer themselves. Unless the policy has been specifically endorsed for funds transfer fraud or social engineering fraud, this scenario often sits outside the cyber policy's insuring agreement entirely, even though the fraud clearly originated from a digital scheme. This is part of a broader pattern of overlooked exposures worth reviewing against your own cyber insurance coverage gaps before renewal.

What does crime insurance typically cover, and where does it fall short?

Crime insurance often covers social engineering fraud only as a narrow, separately priced add-on with its own low sublimit.

Traditional crime policies were built around employee dishonesty and third-party theft of money or securities. Many carriers added social engineering fraud coverage as an endorsement only after claim volume forced the issue, and that endorsement is commonly capped at a sublimit far below the policy's core crime limit, sometimes $100,000 or less. A business that assumes its crime policy fully backstops fraudulent wire transfers is often surprised to learn the coverage was never purchased, or was purchased at a fraction of the loss amount.

Coverage	What it typically responds to	Common gap
Cyber insurance	Network intrusion, ransomware, data breach	Employee voluntarily authorizes a fraudulent transfer with no system breach
Crime insurance (base)	Employee theft, forgery, third-party theft of funds	Social engineering fraud often excluded from the base computer fraud insuring agreement
Social engineering fraud endorsement	Fraudulently induced transfers specifically	Frequently sold at a low sublimit, or not offered by the carrier at all

How can brokers actually close this gap for a client?

The fix is matching endorsements and definitions across both policies rather than assuming either one alone is enough.

A broker reviewing a client's program should confirm that a social engineering fraud endorsement exists on the crime policy, that its sublimit is realistic against the client's typical payment size, and that the cyber policy's funds transfer fraud language (if present) doesn't conflict with the crime policy's definition of computer fraud. Where both policies could plausibly respond, brokers should also check for "other insurance" clauses that could reduce, rather than combine, the total available limit. This is exactly the kind of detail that belongs in a broker submission package so underwriters can price the exposure accurately from the start rather than discovering the gap at claim time.

What should a business ask for when buying crime and cyber coverage together?

A business should ask for a coordinated program, not two policies bought separately and never compared against each other.

At minimum, that means requesting a social engineering fraud sublimit that reflects the largest single payment the business realistically processes, confirming both policies use consistent definitions of fraud and unauthorized access, and asking the broker to identify in writing which policy responds first if a loss could arguably trigger both. Businesses should also pair this with basic verification controls, like a callback policy for any changed payment instructions, since insurers increasingly expect to see that control in place before they'll offer a meaningful sublimit.

Wire transfer fraud isn't a rare, exotic loss anymore. It's a routine one, and the businesses that avoid a denied claim are usually the ones whose broker checked the seam between their crime and cyber policies before a fraudster found it first.

Sources

• FBI Internet Crime Complaint Center, PSA240911: Business Email Compromise