# Commercial Crime vs Cyber Insurance for Wire Fraud: Which One Pays?

By [John Abbott](https://insura.ai/authors/john-abbott), Licensed Insurance Broker (Missouri license #3003876211) · 2026-10-16

Source: https://insura.ai/articles/commercial-crime-vs-cyber-insurance-wire-fraud

> **Does cyber or commercial crime insurance cover wire fraud?** Usually both, in layers. Cyber typically covers social engineering wire fraud only up to a $100,000–$250,000 sublimit, often with a callback condition. Commercial crime covers employee theft, forgery, funds transfer fraud and, with an endorsement, social engineering at higher limits. Most firms buy crime inside a management liability package, such as Cowbell's Zurich-underwritten program with D&O, EPL and fiduciary, alongside Cowbell cyber.

## The Short Answer

If someone tricks your staff into wiring money to a criminal, the policy that pays depends on *how* the money left and *whose* money it was. Cyber insurance covers some of it, usually through a social engineering sublimit of $100,000–$250,000. Commercial crime insurance covers the rest: employee theft, forgery, computer fraud, funds transfer fraud and, with the right endorsement, social engineering at higher limits. Most professional-services firms need both. Crime is usually bought inside a management liability package next to D&O, EPL and fiduciary coverage.

The FBI's Internet Crime Complaint Center (IC3) reports business email compromise (BEC) losses in the billions of dollars every year. That makes BEC one of the most expensive cybercrimes measured, and it hits small firms that move client money hardest.

## What Cyber Insurance Covers for Wire Fraud

A cyber policy is built around data and systems: breach response, forensics, notification, ransomware, business interruption and third-party privacy liability. Money-movement losses are usually an add-on, and they come with conditions:

- **Social engineering / fraudulent instruction.** This covers your own funds sent after a fake email or phone call that looked like it came from a vendor, client or executive. It's typically sublimited to $100,000–$250,000, even on a $1M or $3M cyber policy.
- **Funds transfer fraud.** A criminal gets into your bank account or email and moves money *without* your staff authorizing it. Some cyber forms include this; others leave it to crime.
- **Invoice manipulation.** This pays when your clients pay a fake invoice because your email was compromised and you can't collect what they owe. Not every carrier offers it.
- **Verification conditions.** Many cyber forms require a callback to a known phone number (not the one in the email) before changing payment instructions. Skip the callback and the claim may be reduced or denied.

Carriers like Cowbell, Chubb and Hiscox handle these differently. The limit on the declarations page is not the amount available for a wire-fraud loss. Check the sublimit.

## What Commercial Crime Insurance Covers

Commercial crime insurance (sometimes called a fidelity policy) is built around theft of money, securities and property. Wording varies by carrier, but the common insuring agreements are:

- **Employee theft / dishonesty.** An employee steals from the firm by skimming, setting up fake vendors or padding payroll.
- **Forgery or alteration.** Forged checks, drafts or promissory notes drawn on your accounts.
- **Computer fraud.** Someone manipulates your systems so money or property is transferred out.
- **Funds transfer fraud.** Fraudulent instructions sent to your *bank* in your name, without your knowledge.
- **Social engineering endorsement.** This covers a staff member being tricked into sending money. It's an add-on, often with its own sublimit, but crime carriers commonly offer higher limits than cyber.
- **Third-party / client property.** This covers money you hold for others, like a law firm's trust (IOLTA) account or client funds an advisor can access. Whether it's covered depends on the form, so confirm it in writing.

Read our [commercial crime insurance overview](/insurance/commercial-crime-insurance) for limits and underwriting questions.

## The "Voluntary Parting" Problem

This is the clause behind most denied wire-fraud claims. Standard crime forms cover computer fraud and funds transfer fraud, meaning money taken *without* your consent. When your bookkeeper sends the wire on purpose because a convincing email asked for it, many carriers treat that as a **voluntary parting** of funds, and the base computer fraud agreement doesn't respond.

Courts have split on this over the years, which is why carriers created the social engineering endorsement. Don't count on winning the argument after a loss. Buy the endorsement and pick a limit that matches how much money your firm actually moves in one transaction.

## Scenario Table: Which Policy Pays?

| Scenario | Cyber? | Crime? | Notes |
|---|---|---|---|
| Staff wire $180K to a fake "vendor" after a spoofed email | Often, up to social engineering sublimit | Yes, with social engineering endorsement | Voluntary parting exclusion bars base crime form. Callback condition common. |
| Hacker logs into bank portal and wires out funds | Sometimes (funds transfer fraud) | Yes, funds transfer / computer fraud | Classic crime claim. No staff consent involved. |
| Bookkeeper creates a fake vendor and pays herself for 2 years | No | Yes, employee theft | Cyber does not cover insider theft of money. |
| Client pays a fake invoice sent from your hacked email | Sometimes (invoice manipulation) | Rarely | Client may also sue you, which is an E&O/cyber liability question. |
| Funds diverted from law firm IOLTA trust account | Partial at best | Yes, if client property is covered | Confirm third-party property wording. Bar exposure is separate. |
| Ransomware locks systems, no money stolen | Yes | No | Pure cyber event. |
| Forged check drawn on operating account | No | Yes, forgery or alteration | Standard crime coverage. |
| Plan administrator steals from 401(k) | No | Not under standard crime | Needs an ERISA fidelity bond. |

## How Sublimits and Endorsements Interact

When both policies could respond, "other insurance" clauses decide which one pays first. Common patterns:

1. **Cyber pays first, crime sits excess.** Your cyber social engineering sublimit ($100K–$250K) pays first, and the crime endorsement covers the excess.
2. **Crime is primary for theft, cyber for everything else.** Crime pays the stolen funds, and cyber pays the forensics, breach notification and legal costs from the email compromise.
3. **Both claim to be excess.** Badly matched forms can each say the other pays first. A broker should line up the "other insurance" language before binding, not after a loss.

Retentions matter too. A $5,000 crime deductible and a $25,000 cyber retention on the same loss can leave you paying more than you expected.

## ERISA Bond vs. Crime: Quick Note

If your firm sponsors a 401(k) or other retirement plan, federal law (ERISA) requires a fidelity bond covering people who handle plan funds. The bond is typically at least 10% of plan assets, with a statutory cap that rises for plans holding employer securities. A commercial crime policy doesn't automatically satisfy this requirement. Many carriers can add ERISA coverage to the crime policy, so ask for it explicitly. Fiduciary liability (in the management liability package) is different again. It covers claims that you managed the plan badly, not theft.

## Vertical Callouts

### Law Firms: Trust Accounts Change the Math

Law firms are favorite BEC targets because real estate closings, settlements and escrow move large sums by wire. The ABA's ethics opinions frame the duty clearly. Formal Opinion 477R addresses reasonable efforts to secure client information sent electronically, and Formal Opinion 498 discusses the duties that apply to virtual practice. Together with Model Rule 1.15 on safekeeping client property, they point the same way: lawyers are expected to take reasonable care with client data and client money. If trust funds are diverted, the firm may have to make the client whole regardless of insurance.

Your stack should include crime coverage that clearly covers client trust/IOLTA funds, cyber with a meaningful social engineering limit, and legal malpractice for the client's claim. See [social engineering and wire fraud coverage for law firms](/articles/social-engineering-wire-fraud-cyber-insurance-law-firms), or start at [law firm cyber insurance](/insurance/law-firm-cyber-insurance).

### Financial Advisors and RIAs: Client Money and Reg S-P

Advisors face fraudulent client distribution requests, often a hacked client email asking for an urgent transfer to a "new" account. Even when a custodian holds the assets, an advisor who processes a fraudulent request may face a client claim and regulatory scrutiny. The SEC's amended Regulation S-P requires incident response programs and customer notification for certain breaches of customer information. That makes the cyber side important even when no money moves.

The usual setup is cyber plus investment advisor E&O, with crime coverage that addresses client property where the form allows. More detail is in [BEC and wire fraud for financial advisors](/articles/bec-wire-fraud-cyber-insurance-financial-advisors).

### IT/MSPs and SaaS: Payroll and Vendor-Payment Fraud

Tech firms are less likely to hold client money, but they get hit with payroll diversion (a fake employee email changes direct deposit details), fake vendor bank-change requests and executive impersonation aimed at finance staff. Growing SaaS companies with investors also face insider risk as headcount climbs. Crime handles employee theft and payment fraud. Cyber and Tech E&O handle the breach and client liability. If an MSP's compromised tools are used to defraud a client, that's a Tech E&O/cyber liability claim, not a crime claim.

## How to Stack Them: Buy Crime Inside a Management Liability Package

For most small professional-services and tech firms, crime is most efficient when it's bought as one part of a **management liability package**:

- **D&O** for claims against leaders and the company
- **EPL** for employment claims
- **Fiduciary liability** for benefit-plan management
- **Crime**, with a social engineering endorsement

Example: Cowbell's management liability program, underwritten by Zurich (Zurich Select Plus), quotes all four parts together and sits alongside Cowbell cyber. That lets you match the crime social engineering limit to the cyber sublimit instead of guessing. See our [management liability insurance page](/insurance/management-liability-insurance).

**Typical pricing we've seen:**

- A **$1M crime limit with a $5,000 deductible**, packaged for a small professional-services firm, has priced around **$2,100–$2,200 per year**.
- **Standalone small-firm crime** commonly runs **about $500–$3,000 per year**, depending on limit, headcount, whether you hold client funds, and controls like dual authorization and callback verification.

These are typical ranges, not quotes. Your premium depends on underwriting.

**Controls that improve terms and claim outcomes:**

- Callback verification on any change to payment instructions, using a number you already have on file
- Dual approval on wires above a set threshold
- MFA on email and banking portals
- Separation of duties between whoever sets up vendors and whoever pays them
- Positive pay with your bank

## Get Quotes

Fill out one application on insura.ai and compare cyber, crime and management liability options from Cowbell and other carriers. A licensed producer reviews every submission, lines up the sublimits and "other insurance" wording, and tells you where the gaps are before you bind. [Start your quote](/get-quote).

---
Compare cyber, E&O and D&O quotes from Chubb, Hiscox, The Hartford and Cowbell: https://insura.ai/get-quote