These two loss scenarios are treated differently under most policy forms. Social engineering fraud occurs when an employee is deceived into initiating a legitimate transfer to a criminal's account. The system itself is never compromised. Direct system hacking involves an attacker gaining unauthorized access to your banking portal or internal transfer system and moving funds without employee involvement.

Many policies cover direct hacking under the computer fraud insuring agreement but cap social engineering losses at a sublimit, sometimes as low as $100,000 on a $1 million policy. If your firm processes high-value wire transfers, that sublimit gap can be catastrophic. You need to read the endorsement language and confirm whether the social engineering sublimit matches your actual exposure.

Most carriers now require documented verification procedures as a condition of coverage. If your firm cannot demonstrate that it followed a callback protocol or dual-authorization process before releasing funds, the claim may be denied entirely. This is not a technicality: it is a coverage condition printed in the endorsement.

A practical callback procedure involves contacting the requestor at a previously verified phone number, not the number listed in the email requesting the transfer. Some underwriters require dual authorization for transfers above a stated threshold. Firms that work with a specialist agency like Bloc Cyber can have these verification requirements reviewed at the endorsement level before binding, so there are no surprises during a claim.

The Safeguards Rule requires a written information security program that includes risk assessment, access controls, encryption of customer data in transit and at rest, and incident response planning. For firms with over 5,000 customer records, the rule also mandates a qualified individual to oversee the program and periodic reporting to the board of directors.

These are not optional guidelines. Failure to maintain them creates both regulatory exposure and potential coverage issues. An underwriter reviewing your application will ask about these controls, and your answers directly affect both pricing and coverage availability.

A well-structured policy form may respond to regulatory defense costs when a state or federal agency opens an investigation into your security practices. This coverage typically falls under a "regulatory proceedings" insuring agreement. Some forms also cover fines and penalties where insurable by law, though California's insurability rules limit this in certain contexts.

The practical value here is significant. A DFPI investigation triggered by a breach can generate six-figure legal defense costs even if no fine is ultimately assessed. Your policy should specify whether regulatory proceedings coverage applies to the GLBA, the California Consumer Privacy Act (CCPA), and DFPI-specific actions.

Contingent business interruption coverage responds to income loss caused by a cyber event at a third-party provider your firm depends on. This is distinct from standard business interruption, which covers outages to your own systems. CBI coverage requires that the third party experience a qualifying security event, not just routine downtime or maintenance.

The critical detail is how the policy defines "dependent business" or "service provider." Some forms limit CBI to providers listed on a schedule. Others use broader language covering any provider whose services are essential to your operations. Confirming this definition before binding prevents a coverage gap when a core processor outage halts your operations for days.

CBI coverage almost always includes a waiting period, typically 8 to 12 hours, before coverage begins to respond. Any income lost during that waiting period is uninsured. For a firm processing hundreds of transactions per hour, even an 8-hour gap represents real money.

Retention structures for CBI claims may differ from first-party breach retentions on the same policy. Some forms apply a separate, higher retention to contingent losses. Reviewing these figures at the form level, rather than relying on a coverage summary, is where a specialist placement agency adds measurable value.

Policy limits tell you the maximum the carrier will pay. Sublimits tell you what the carrier will actually pay for specific loss types. A $2 million aggregate limit with a $100,000 social engineering sublimit provides far less protection than the declarations page suggests.

Retentions function as your deductible. For financial services firms, retentions on funds transfer fraud claims are often higher than retentions on data breach response costs. A $25,000 retention on breach response paired with a $75,000 retention on social engineering fraud is common. You should model your retention against your probable loss scenarios, not just your budget.

Bloc Cyber's approach to placement involves reviewing each insuring agreement, sublimit, and retention before binding. This form-level review ensures that the numbers on your policy match the risks your firm actually faces, particularly for wire fraud and CBI exposures where sublimits frequently create hidden gaps.

MFA is non-negotiable for 2026 underwriting. Carriers expect MFA on all remote access points, email platforms, and administrative consoles. Financial services firms face additional scrutiny: underwriters typically require MFA on wire transfer authorization systems and client-facing portals where account information is accessible.

SMS-based MFA is increasingly viewed as insufficient. Underwriters favor authenticator apps or hardware tokens. If your firm still relies on SMS codes, expect questions during the application process and potentially higher retentions.

EDR has replaced traditional antivirus as the minimum control underwriters expect on every endpoint. The distinction matters: antivirus relies on signature-based detection, while EDR monitors endpoint behavior and can isolate compromised devices in real time.

Carriers want to see EDR deployed across all endpoints, including remote employee devices. Managed detection and response (MDR) services, where a third party monitors your EDR platform around the clock, can improve both your security posture and your underwriting outcome.