Business email compromise claims involve almost no malware or hacking tools, just a convincing email. Here is how insurers evaluate and pay these losses.