Social Engineering Insurance

The Difference Between Cyber Crime and Social Engineering

Cyber crime coverage typically responds when a third party gains unauthorized access to your systems and initiates a fraudulent transfer without your knowledge or consent. Social engineering coverage, by contrast, applies when your own employee authorizes the transfer voluntarily, albeit under false pretenses. That word, "voluntary," is the dividing line. If a hacker breaks into your banking portal and moves funds, that is a computer fraud claim. If a hacker sends your AP clerk an email pretending to be a supplier, and your clerk initiates the wire, that is social engineering.

Why Standard Cyber Policies May Not Cover Voluntary Transfers

Most cyber liability forms are built around data breaches, network security failures, and unauthorized system access. A voluntary wire transfer does not involve any of those triggers. The insured's own employee pushed the button. Many carriers specifically exclude voluntary parting of funds from their base cyber forms, and even crime policies with computer fraud coverage have been litigated extensively over whether an email-induced transfer qualifies. The result: without a specific social engineering endorsement, your claim may be denied.

Vendor Impersonation and Business Email Compromise (BEC)

Business email compromise remains the most financially damaging form of social engineering. The attacker either spoofs or hijacks a vendor's email account, then sends a payment redirection notice to your accounts payable team. The fraudulent instructions look identical to prior correspondence. BEC losses across U.S. businesses continue to run into the billions annually, and mid-market companies with limited AP controls are disproportionately targeted.

Executive Impersonation (CEO Fraud)

CEO fraud follows a similar pattern but targets the chain of command. An attacker impersonates a senior executive, typically the CEO or CFO, and directs a subordinate to make an urgent wire transfer. The request often arrives on a Friday afternoon, during travel, or right before a holiday, times when verification is less likely. The email may reference a real deal or acquisition to add credibility.

The Rise of Deepfake Voice and Video Fraud

Synthetic media has moved from novelty to operational threat. Global losses from deepfake-enabled fraud reached at least $3.7 billion by mid-2026, with approximately 89% of those incidents involving financial manipulation. Criminals now clone an executive's voice from publicly available earnings calls or conference recordings and use it in a phone call directing a wire transfer. Some attacks use real-time video deepfakes on video conferencing platforms to impersonate a CFO or outside counsel. Many existing policy forms were written before this technology matured, which creates a significant coverage gap for deepfake-specific claims.

Why Social Engineering Limits are Lower Than Policy Aggregate

Carriers view social engineering as a high-frequency, controllable-risk exposure. Unlike a data breach that may involve millions of records, a wire fraud loss is often the result of a single procedural failure. Insurers price and limit accordingly. A company with a $1 million crime policy might carry only $250,000 in social engineering coverage. If a single BEC attack costs $400,000, the policy pays $250,000 and the insured absorbs the rest. Some endorsements also apply co-insurance, meaning the carrier pays only 50% or 75% of the loss up to the sublimit. On a $250,000 sublimit with 50% co-insurance, your maximum recovery is $125,000.

The Importance of First-Party vs. Third-Party Loss

Social engineering losses are almost always first-party: your company sent money to a criminal. The loss belongs to you, not to a customer or third party filing a claim against you. This distinction matters because third-party liability coverage on a cyber form will not respond. You need a first-party coverage grant, either within a crime policy or as a standalone endorsement, that explicitly names social engineering or fraudulent impersonation as a covered peril.

Nearly every social engineering endorsement includes a callback verification condition. If your employee did not follow the prescribed verification steps before authorizing the transfer, the carrier can deny the claim entirely.

Social engineering coverage protects against a specific, well-documented category of loss that standard crime and cyber policies routinely exclude. The critical details sit in the sublimit, the co-insurance percentage, the callback verification requirements, and whether the form's impersonation language extends to voice and video deepfakes. Getting any of those wrong leaves money on the table when a claim hits.

If you are purchasing or renewing a cyber or crime policy, ask for the social engineering endorsement language in advance and read it line by line. A specialist at Bloc Cyber can walk through the form with you, identify where coverage stops, and flag gaps before they become unrecoverable losses. You can request a coverage review to have the endorsement language examined against your actual exposure.

Cyber Coverage Built for Your Industry

Every industry faces a different cyber threat, from patient records in healthcare to wire fraud in construction. Bloc Cyber matches coverage to the risks your sector actually faces, drawing on specialty carriers that understand your business. Find your industry below to see how we protect it.

Field notes from the placement desk.
What carriers are asking right now.