Social Engineering Fraud Coverage: The Cyber Sublimit Buyers Miss

Why the Smallest Number on the Policy Often Matters the Most

A finance manager receives an email that looks exactly like it came from the company's CEO, asking for an urgent wire transfer to close a deal. The email address is close enough to the real one that nobody notices. The transfer goes through, and by the time anyone realizes what happened, the money is gone and untraceable. This is the scenario social engineering fraud coverage exists to address, and it is also the scenario where policyholders most often discover their cyber policy covers far less than they assumed.

What Exactly Counts as Social Engineering Fraud in a Cyber Policy?

It generally refers to losses where an employee is deceived into voluntarily transferring money or sensitive information to a fraudster, rather than losses from a system being hacked directly.

This distinction matters because no network was breached and no malware was involved. An authorized employee, acting on what looked like a legitimate instruction, moved funds or data themselves. Business email compromise is the most common version of this, but the category also covers fraudulent vendor payment changes, fake invoice schemes, and impersonation of executives or trusted partners over phone or email.

Why Is This Coverage Usually Capped So Much Lower Than the Rest of the Policy?

Insurers historically viewed social engineering losses as closer to a crime or fidelity risk than a true cyber event, and priced the sublimit accordingly rather than folding it into the main limit.

A cyber policy with a $2 million aggregate limit might cap social engineering fraud at $100,000 or $250,000 unless a policyholder specifically negotiates it higher. That gap catches a lot of businesses off guard, particularly since business email compromise losses can easily exceed a modest sublimit in a single incident. The reasoning behind the lower cap has softened somewhat as insurers have accumulated more loss data on these claims, but the sublimit structure itself remains standard across most of the market.

Coverage Element	Typical Treatment
Main cyber policy limit	Full negotiated limit, often $1M or more
Social engineering fraud sublimit	Often $100K-$250K unless separately negotiated
Ransomware and extortion	Usually within main limit or its own sublimit
Business interruption	Usually within main limit

Does a Dedicated Crime Policy Fill the Gap Better?

Sometimes, since standalone crime insurance is built specifically around funds transfer fraud and can carry a materially higher limit for this exposure.

The tradeoff is coordination. A business carrying both a cyber policy and a crime policy needs clear language on which one responds first, and in what order, to avoid a dispute between two insurers, or worse, a scenario where each policy points to the other as primarily responsible. This overlap shows up more broadly in Cyber Insurance First-Party and Third-Party Coverage, where the boundary between cyber and adjacent coverage types gets defined in more general terms.

Can This Sublimit Actually Be Raised?

Yes, many carriers will increase the social engineering sublimit for an additional premium, particularly when a business can demonstrate specific payment verification controls.

Insurnest's Business Email Compromise Loss Frequency and Severity AI Agent models how strong or weak a given control environment is likely to perform against real BEC attack patterns, which gives both the broker and the underwriter a more specific basis for negotiating that higher sublimit rather than guessing at an arbitrary number.

Who Tends to Get Caught by This Gap Most Often?

Professional services firms handling client funds, and any business with a habit of processing large wire transfers based on email instructions alone, show up disproportionately in social engineering claims.

Law firms holding client funds in trust accounts are a frequent example, a risk explored further in Cyber Insurance for Law Firms and Privileged Data, since the combination of large transfers and email-based instructions creates exactly the conditions social engineering fraud exploits. Real estate transactions, mergers and acquisitions closings, and any business regularly changing vendor payment details by email carry similar exposure.

The technical sophistication of a social engineering attack is often close to zero. It relies on convincing a person, not breaking encryption or exploiting a software flaw, which is precisely why it slips past controls designed to stop hacking specifically. Reading the sublimit on this coverage before an incident happens, not after, remains one of the more overlooked steps in buying a cyber policy.

Sources

• Business Email Compromise: The $50 Billion Scam, Internet Crime Complaint Center (IC3), FBI
• Cybersecurity (CIPR Topic Page), National Association of Insurance Commissioners