Cyber Crime Insurance

The Difference Between Cyber Liability and Cyber Crime

Cyber liability responds to breach events: notification costs, regulatory defense, forensic investigations, and third-party lawsuits. Cyber crime responds to theft events: money leaving your account because someone manipulated a system or a person. These are two distinct insuring agreements, and they sit in different parts of the policy form.

A ransomware demand, for instance, may trigger both the cyber extortion coverage under your liability section and a funds transfer fraud claim if the attacker also redirected a wire. Treating them as interchangeable leads to coverage gaps. At Bloc Cyber, the practice of reviewing each insuring agreement at the form level exists precisely because these distinctions matter at claim time.

Why Standard Commercial Property Policies Fall Short

Commercial property policies cover tangible losses: fire, theft of physical inventory, equipment damage. Money lost through electronic manipulation does not fit neatly into those forms. Most commercial property policies exclude losses arising from voluntary parting of funds, which is exactly what happens when an employee is tricked into sending a wire to a fraudulent account.

Even standalone commercial crime forms often contain exclusions for losses involving electronic communications or computer systems unless a specific endorsement is added. The gap is real, and it is the primary reason dedicated cyber crime coverage exists as a separate product.

How Computer Fraud Coverage Protects Against Unauthorized Access

Computer fraud coverage typically responds when a third party gains unauthorized access to your computer system and directly causes a transfer of money, securities, or property. The key word is "directly." If a hacker breaks into your accounting software and initiates a wire, that is a direct cause. If a hacker steals your credentials and then calls the bank pretending to be you, some forms will argue the cause was not direct enough.

Courts have split on this issue repeatedly. The policy form's definition of "computer system" and "direct cause" will determine whether your claim is paid. A form-level review before binding, not after a loss, is the only way to know where you stand.

Understanding Funds Transfer Fraud and Electronic Instructions

Funds transfer fraud coverage responds when a third party issues fraudulent electronic instructions to your bank or financial institution, causing money to leave your account without your authorization. This is distinct from computer fraud because the attack targets the transfer mechanism itself, not your internal systems.

A common scenario: an attacker compromises your email, monitors invoice traffic for weeks, then sends a spoofed wire instruction to your bank using your email address. The bank processes the wire. Your funds transfer fraud coverage should respond here, but sublimits and retentions vary widely. Some forms cap this coverage at $100,000 or $250,000, well below the loss amounts that are growing more expensive per incident.

Social Engineering Fraud: When Employees Are Tricked

Social engineering fraud coverage responds when an employee is manipulated into voluntarily transferring funds to a criminal. The classic example is the CEO impersonation email: "I need you to wire $85,000 to this account for a confidential acquisition. Do it now and do not discuss it with anyone." The employee complies. The money is gone.

This coverage is almost never included in the base cyber policy form. It is typically added by endorsement, and it frequently carries a sublimit lower than the main policy aggregate. A $1 million cyber policy might include only $100,000 in social engineering coverage unless you negotiate a higher limit at placement. The rise in identity theft-linked insurance fraud projected through 2025 and into 2026 reflects how profitable these schemes have become for criminals.

Invoice Manipulation: Protecting Your Accounts Receivable

Invoice manipulation is a variation of business email compromise where the attacker intercepts legitimate invoices and alters the payment instructions. Your customer pays the invoice in good faith, but the money goes to the attacker's account instead of yours. You are left with an unpaid receivable and a customer who believes they already paid.

Some policy forms treat this as a social engineering loss. Others classify it under funds transfer fraud or computer fraud depending on how the manipulation occurred. The distinction matters because each insuring agreement may carry different limits, retentions, and conditions. If your policy form does not specifically address invoice manipulation, you may find yourself arguing over which coverage applies while the claim sits unpaid.

Insuring Digital Assets and Crypto Wallets

If your business holds cryptocurrency, whether as a payment method, treasury asset, or customer funds, traditional crime forms do not cover it. Cryptocurrency is not "money" or "securities" under most policy definitions. A dedicated digital asset endorsement or a standalone crypto crime policy is required.

Coverage typically applies to theft from hot wallets through unauthorized access, but cold storage losses and private key compromise present underwriting challenges. The potential for quantum computing to disrupt cryptographic protections adds a forward-looking risk that underwriters are beginning to price. If your firm holds digital assets, confirm that the policy form explicitly names cryptocurrency in the covered property definition.

Telecom Fraud: Who Pays for Unauthorized Phone Charges?

Telecom fraud occurs when an attacker compromises your phone system, typically a PBX or VoIP platform, and routes thousands of dollars in long-distance or premium-rate calls through your account. The telecom carrier bills you. Your standard business insurance will not cover it.

Some cyber crime forms include telecom fraud as a named coverage; others exclude it entirely. The losses can be substantial: a compromised PBX running over a holiday weekend can generate $50,000 or more in fraudulent charges before anyone notices. Ask your broker whether the form includes telecom fraud and what the sublimit is.

Does my bank cover me if my business account is hacked?

Most commercial banking agreements place the liability for unauthorized electronic transfers on the account holder, not the bank, once the bank has followed its standard security procedures. Your bank is not your insurer. A dedicated funds transfer fraud policy is the appropriate risk transfer mechanism.

What is the difference between phishing and social engineering?

Phishing is a delivery method: a fraudulent email designed to steal credentials or install malware. Social engineering is broader and includes phone calls, text messages, and in-person deception. A phishing email that leads to credential theft may trigger computer fraud coverage, while a phone call that tricks an employee into wiring funds triggers social engineering coverage.

Is cyber crime insurance expensive for small businesses?

Premiums for small businesses with 10 to 100 employees typically range from a few hundred to a few thousand dollars annually, depending on revenue, industry, and the limits selected. Cyber insurance market conditions have stabilized heading into 2026, making coverage more accessible than it was during the hard market of 2022-2023.

Do I need this if I already have a general liability policy?

Yes. General liability excludes electronic theft, wire fraud, and virtually every scenario described in this guide. There is no overlap between a GL form and a cyber crime insuring agreement.

Will insurance pay if an employee makes a mistake?

It depends on the mistake. If an employee is deceived into sending a wire by a social engineering attack, the social engineering endorsement may respond. If an employee simply sends money to the wrong account due to carelessness, most forms will not cover the loss. The policy language around "voluntary parting" and "fraudulent inducement" controls the outcome.

Cyber Coverage Built for Your Industry

Every industry faces a different cyber threat, from patient records in healthcare to wire fraud in construction. Bloc Cyber matches coverage to the risks your sector actually faces, drawing on specialty carriers that understand your business. Find your industry below to see how we protect it.

Field notes from the placement desk.
What carriers are asking right now.