Texas Cyber Crime Insurance

The Rising Digital Risks for Houston, Dallas, and Austin Hubs

Houston's concentration of energy and logistics firms makes it a frequent target for invoice manipulation schemes, where criminals intercept vendor payment instructions and redirect wire transfers. Dallas's financial services and technology sectors face persistent business email compromise attacks targeting controllers and accounting staff. Austin's startup and SaaS ecosystem, while technically sophisticated, often lacks the insurance infrastructure to match its risk profile.

Each metro presents a distinct threat mix, but the common thread is financial theft executed through digital channels. The FBI's Internet Crime Complaint Center has documented a consistent year-over-year increase in business email compromise losses nationally, and Texas companies account for a disproportionate share of those claims.

Why General Liability is Not Enough for Cyber Theft

A commercial general liability policy responds to bodily injury and property damage claims. It does not respond when an employee is tricked into wiring $400,000 to a spoofed vendor account. A commercial property policy may cover loss of tangible property, but money lost through fraudulent electronic instructions typically falls outside that coverage grant.

Even a standard commercial crime policy, which does cover employee dishonesty and forgery, often excludes losses caused by voluntary parting of funds, which is exactly what happens in a social engineering attack. The employee willingly initiates the transfer; they simply do so based on fraudulent information. That voluntary action creates a coverage gap that only a specific social engineering endorsement or cyber crime insuring agreement can fill.

Computer Fraud: Protecting Against Unauthorized Access

Computer fraud coverage responds when a third party gains unauthorized access to your computer systems and directly causes a transfer of money or securities. The key word is "directly." If a hacker breaks into your banking portal and initiates a wire transfer without any employee involvement, that is a computer fraud claim.

The coverage typically requires a direct causal link between the unauthorized access and the financial loss. Courts have interpreted "directly" narrowly, and claims have been denied where there were intervening human steps between the hack and the money movement. If you are evaluating a policy form, look for how the insuring agreement defines "direct loss" and whether it requires the transfer to occur without human intervention.

Funds Transfer Fraud: When Wire Instructions Go Wrong

Funds transfer fraud coverage protects against losses from fraudulent instructions sent to a financial institution to transfer money from your account. This coverage often overlaps with protections your bank may offer under the Uniform Commercial Code Article 4A, which governs wire transfers between commercial parties.

The critical distinction is who bears the loss. Under UCC 4A, if your bank accepted a fraudulent payment order that did not comply with an agreed-upon security procedure, the bank may bear the loss. But if the bank followed the security procedure and the order was still fraudulent, the loss may shift back to you. Funds transfer fraud coverage in your insurance program picks up where the bank's liability ends.

Social Engineering: The Human Element of Business Email Compromise

Social engineering fraud is the coverage that gets the most attention in 2026, and for good reason. This is where a criminal impersonates a vendor, executive, or client through email, phone, or text and convinces an employee to send money to a fraudulent account. No system is hacked. No unauthorized access occurs. The employee acts voluntarily based on deceptive communication.

Most crime policies did not cover this scenario until insurers began offering social engineering endorsements in the mid-2010s. Even now, many endorsements carry sublimits of $100,000 to $250,000, well below the average loss in a business email compromise event. Reviewing the sublimit on this endorsement is one of the most important steps in any policy placement. A firm like Bloc Cyber will read the actual endorsement language and flag whether the sublimit matches your wire transfer exposure before you bind.

Comparison Chart: Standard Cyber vs. Crime Endorsements

The verification requirement deserves special attention. Many social engineering endorsements will not pay a claim unless the insured can demonstrate that a callback or secondary verification procedure was in place and followed before the fraudulent transfer. If your company does not have a documented dual-authorization process for wire transfers, your coverage may not respond even if you carry the endorsement.

Factors Influencing Sub-limits for Social Engineering

Several variables affect what sublimit an underwriter will offer and at what price:

• Transaction volume and average wire size
• Whether dual-authorization controls are in place
• Employee training frequency on phishing and impersonation
• Prior loss history
• Industry sector (financial services and real estate face higher exposure)

Companies that can demonstrate strong internal controls, including documented callback procedures, segregation of duties in accounts payable, and regular phishing simulations, will generally qualify for higher sublimits at more favorable pricing. Bloc Cyber's approach is to review these controls with the client before going to market, so the submission reflects the actual risk profile rather than a generic application.

Texas-Specific Regulatory Considerations

Texas does not have a comprehensive state privacy law equivalent to California's CCPA, but it does maintain the Texas Identity Theft Enforcement and Protection Act, which imposes breach notification obligations on businesses that hold sensitive personal information. A cyber crime event that also involves access to personal data can trigger both a crime claim and a breach response obligation simultaneously.

The Texas Department of Insurance does not mandate specific cyber coverage for most industries, but regulated sectors like healthcare and financial services face federal and state requirements that make cyber crime coverage a practical necessity. If your business operates across multiple states, the notification timelines and regulatory defense costs vary by jurisdiction, which is exactly the kind of multi-state exposure that requires policy-level analysis rather than a one-size-fits-all approach.

Does my bank cover me if my business account is hacked?

Your bank may bear liability if it failed to follow an agreed-upon security procedure under UCC Article 4A. But if the bank followed its procedures and the fraudulent instruction still went through, or if an employee authorized the transfer voluntarily, the loss is yours. Insurance fills that gap.

What is the difference between computer fraud and social engineering?

Computer fraud requires unauthorized access to a computer system that directly causes a financial loss. Social engineering involves no system breach: a human is tricked into voluntarily sending money. The distinction determines which insuring agreement or endorsement responds.

Do I need this if I already have a Cyber Liability policy?

A cyber liability policy primarily covers breach response costs, regulatory defense, and third-party claims. Some cyber forms include crime coverage as an insuring agreement, but many do not. Check whether your policy includes computer fraud, funds transfer fraud, and social engineering coverage with adequate limits. If it does not, a separate crime policy or endorsement is necessary.

How much does cyber crime coverage cost in Texas?

Pricing varies based on revenue, industry, controls, and limits selected. A small professional services firm with $5M in revenue might pay $1,500 to $4,000 annually for crime coverage with a $250,000 social engineering sublimit. A mid-market company with higher wire transfer volume and a $1M sublimit will pay more. The only way to get an accurate number is to submit your specific risk profile to underwriters.

Cyber crime coverage for Texas businesses is not a single product: it is a combination of insuring agreements and endorsements that must be matched to your actual financial exposure. Computer fraud, funds transfer fraud, and social engineering fraud each respond to different attack methods, and carrying one without the others leaves predictable gaps.

The most expensive mistake is assuming your existing policies already cover these scenarios. They may not. A general liability policy will not respond. A cyber liability policy may not include crime coverage. A commercial crime policy may exclude voluntary parting. Each form needs to be read at the insuring-agreement level to confirm what triggers coverage and what falls outside it.

If you are placing or renewing a policy, consider having a specialist review the actual policy language with you before binding. Bloc Cyber works at the form level across cyber crime, cyber liability, and technology E&O placements, and a brief review can surface sublimit gaps or verification requirements that would otherwise only appear during a claim. You can request a coverage review to see exactly where your current program stands.

Cyber Coverage Built for Your Industry

Every industry faces a different cyber threat, from patient records in healthcare to wire fraud in construction. Bloc Cyber matches coverage to the risks your sector actually faces, drawing on specialty carriers that understand your business. Find your industry below to see how we protect it.

Field notes from the placement desk.
What carriers are asking right now.