Fraudulent payment instructions are turning routine business transactions into costly losses, with criminals using convincing emails and phone calls to persuade employees to send money to accounts they control.
The FBI’s Internet Crime Complaint Center received 24,768 business email compromise complaints in 2025, involving approximately $3.05 billion in reported losses. The category was the second largest source of reported internet crime losses, behind investment fraud.
But even businesses that have bought social engineering coverage can discover that a fraudulent transfer is uninsured. Some policies require employees to verify payment instructions through another channel, and at least one specialist has seen claims denied when those checks were missed.
Alyssa Orschel (pictured), cyber and fidelity claims leader at HUB International, said this makes the connection between policy wording and everyday payment procedures an important part of a broker’s placement conversation.
“It’s important for insureds to understand their policy and what procedures they should have in place before even having a loss,” Orschel said. “If their policy provisions state that they need another means of out-of-band authentication, then they should have that written in their own policies and procedures.”
Orschel described an employee receiving an email requesting a change to automated clearing house (ACH) payment instructions. If the policy requires a callback or other independent verification, acting on the email alone could jeopardize coverage. A finance team following its usual process may still fall short of what the insurance contract requires.
Walking through a proposed change of bank details with the client can help brokers establish whether the required verification is part of the payment process, she added. The potential claims pitfall has come into greater focus as criminals have become more sophisticated about monitoring how businesses communicate.
“(Fraud emails) much more real-looking, and they sometimes will go into the email and watch for a few days to see how they respond to other individuals,” Orschel told Insurance Business. “They’ll copy the CEO and have it look like the email is coming from the CEO to request the payment transfer.”
She has also seen an uptick in calls from criminals posing as a bank’s fraud department. While asking employees to verify supposedly fraudulent transactions, the callers obtain access to the account and transfer money themselves, she said, while the conversation is still underway.
Cyber and crime policies can both provide social engineering protection, but the way a fraud unfolds helps determine which coverage provisions need to respond.
When an employee is deceived into sending money to a fraudulent account, the loss would generally be considered under social engineering coverage, Orschel said. If a criminal obtains banking credentials and makes the transfer directly, funds transfer fraud provisions may be relevant. Brokers need to check how the wording treats each scenario.
Read more: Why cyber claims are won or lost in the first hour
A separate gap can arise when a customer’s payment is diverted before it reaches the insured. Orschel warned that crime coverage can leave that loss uninsured because the funds were never in the insured’s possession. She pointed to invoice manipulation coverage under cyber insurance as an option to examine for diverted incoming payments.
The amount available also needs scrutiny. A policy’s overall limit may be much higher than its sublimit for social engineering losses. Comparing that sublimit with the payments a client routinely authorizes can help establish how much of a loss the business could still have to absorb.
Claims investigations can also expose discrepancies between the security controls described on an insurance application and those operating within the business. Orschel gave the example of an insured stating that multifactor authentication is enforced across its applications, only for forensic investigators to establish otherwise. A misstatement about those controls could affect coverage, she said.
Preparation should also extend to the response after a loss. Orschel recommended an action plan that includes contacting banks immediately and reporting the incident to the FBI’s Internet Crime Complaint Center.
Read more: Ransomware’s new AI tactic could inflate cyber claims
Orschel said: “Clients should be making sure they’re patching and providing the appropriate training as AI is becoming more and more sophisticated and probably going to be the lead of these scams going forward, as well as “making sure that they have the proper procedures in place so that they can act quickly when an event occurs without acting in panic.”
