The Multi-Million Dollar Coverage Trap: Why Cyber Insurance Won't Cover Business Email Compromise (BEC) Without Crime Endorsements
When an employee receives an email purporting to be from their CEO or an existing vendor demanding an urgent change of wiring instructions, and the employee transfers funds to a fraudulent offshore account, companies routinely file a claim under their Cyber Liability Policy.
In most instances, cyber underwriters reject the claim because no computer network was hacked and no malware was deployed. The employee acted voluntarily. Without a dedicated Commercial Crime Policy with a Social Engineering Fraud Endorsement, the stolen funds represent an irrecoverable corporate loss.
1. The Out-of-Band Callback Verification Warranty
Insurance carriers rarely offer full-limit social engineering coverage without strict contractual warranties. Underwriters routinely require policyholders to warrant that:
- Any request to change vendor bank account or routing details must be verified by calling a pre-established telephone number on file.
- Calling the phone number listed in the suspicious email or replying directly to the email voids the coverage warranty.
- Dual-authorization controls are enforced for all outgoing wire disbursements above a specified threshold (typically $5,000 or $10,000).
2. Employee Theft: The Discovery vs. Loss-Sustained Form
Internal embezzlement schemes often go undetected for years. Under a Loss-Sustained Crime Form, the policy only covers theft that both occurred and was discovered during the policy period (or within 1 year after expiration). A Discovery Form covers losses discovered today regardless of when the embezzlement originally began, making it the gold standard for financial crime risk management.
💻 Commercial Cyber Liability Modeler
Model ransomware downtime & forensic expenses with Cyber Liability Calculator.
👥 EPLI & Wage/Hour Modeler
Model employment discrimination & FLSA defense with EPLI Calculator.
Frequently Asked Questions
What is the difference between a Fidelity Bond and Commercial Crime Insurance?
A traditional Fidelity Bond covers employee dishonesty only (e.g. employee stealing money or inventory). Commercial Crime Insurance is a broader, modern package that includes employee theft, forgery, inside-the-premises robbery, funds transfer fraud, and social engineering impersonation.
Does Commercial Crime cover theft of intellectual property or trade secrets?
No. Commercial crime policies are designed strictly to cover tangible property, currency, negotiable instruments, securities, and digital funds transfers. Theft of confidential IP or client data is covered under Cyber Liability and Intellectual Property policies.