Impersonation scams have become the defining fraud threat of 2026, and the data coming out of one of the country’s largest insurers points to a problem that extends well beyond consumer awareness.
According to data released by Allstate Identity Protection on October 29, 2026, impersonation scams accounted for nearly 60% of all cases it processed from January through September 2026. What the company calls “fake-and-take” scams are distinct from conventional identity theft in a way that has direct consequences for coverage. In these schemes, a fraudster poses as a bank, a government agency, a delivery company, or even a family member to pressure someone into sending money voluntarily. That distinction is where many standard policies draw a line.
More than 90% of Allstate’s 2026 scam cases involved payment methods such as cryptocurrency, wire transfers, gift cards, and peer-to-peer apps. These are the same channels that trigger exclusions or sublimit caps in most cyber and personal lines policies.
The Federal Trade Commission (FTC) reported in June 2026 that Americans lost $3.5 billion to imposter scams in 2025 alone, nearly three times the 2020 total, making impersonation fraud the most reported fraud category for the fifth consecutive year. Against that backdrop, a client who falls victim and then finds that their policy doesn’t respond faces a compounding loss.
The central issue is the voluntary parting exclusion, a clause embedded in most crime and cyber policies that bars coverage when a policyholder willingly, even if under deception, authorizes a transfer. Courts have repeatedly upheld these exclusions in social engineering cases where employees were tricked into wiring funds following a fraudulent request. The legal reasoning is consistent: the transfer was authorized by the account holder, regardless of the circumstances that prompted it.
Boyadjian has noted that the standard language, which primarily focused on identity theft and minimal cyber extortion coverage, is no longer sufficient, and that voluntary wire transfer fraud is now among the most significant gaps in cyber coverage for high-net-worth clients. Where social engineering is covered at all, it often comes with sublimits, procedural requirements, or exclusion carve-outs that narrow the response significantly.
“Scammers make fraud look real by pretending to be someone you trust and pressuring you to act before you have time to think,” said Caroline Slane, senior vice president of business operations at Allstate Identity Protection. That manufactured urgency and believable impersonation are also what make coverage conversations difficult after the fact because a client who followed instructions from someone they believed was their bank may find that their insurer views the transaction the same way a court does: as a voluntary transfer.
When a client arrives after the payment has cleared and the policy doesn’t respond, a broker’s practical options are limited. The immediate steps are to escalate to the carrier, check whether any social engineering endorsement exists on the policy, and help the client document the timeline and the nature of the deception for any coverage dispute. But those steps rarely change the outcome if the underlying policy language excludes authorized transfers.
The more durable conversation happens before a claim - at renewal, when the broker can assess whether the client’s current coverage actually responds to this category of loss, or whether a standalone endorsement or a product specifically designed for scam reimbursement needs to be on the table.
In response to this environment, Allstate has built two product lines targeting the exposure. Its scam protection benefit, available through participating employee benefits plans, offers up to $50,000 in annual reimbursement for covered scam losses, including certain cryptocurrency scams, a coverage area that most policies either cap sharply or exclude. According to the Allstate, nearly 7.5 million eligible customers in 44 states now have access to free identity theft protection through the insurer, including support from US-based identity restoration specialists. Allstate describes this as the first offering of its kind at that scale from a major US insurer.
The product design shows the market is moving away from policies that only respond to unauthorized system access and toward products that account for fraud involving human-authorized payments. Allstate flags shopping, charity, and delivery scams as active categories in its 2026 caseload. These losses tend to surface after the fact, when the payment has already cleared and the policy language becomes the only remaining question.
