Social Engineering Fraud vs Crime Insurance Exclusions: What Small Business Owners Need to Know

If you own a small business in America, you're a target.

Social engineering attacks have been increasing in intensity and number, and research undertaken in 2020 has indicated that social engineering will be one of the most prominent challenges of the upcoming decade.

The financial stakes are enormous: [1]

in 2023, the FBI estimated it received approximately 589,400 scam-related complaints, resulting in losses of $10.55 billion.

But here's the problem many business owners don't realize until it's too late: the insurance policy you thought would protect you from fraud might not cover the most common type of attack your business faces. Understanding the difference between social engineering fraud and traditional crime insurance exclusions could mean the difference between recovering from a devastating loss and closing your doors permanently [2].

What Is Social Engineering Fraud?

Social engineering is the use of psychological influence of people into performing actions or divulging confidential information.

Unlike traditional cybercrime that relies on hacking into computer systems, social engineering manipulates human psychology to bypass security measures [1].

Criminals compromise legitimate business or personal email accounts through social engineering or computer intrusion techniques to conduct unauthorized transfers of funds, and either through monitoring active email traffic or reviewing past requests, they identify who is allowed to approve payments and who is allowed to request payments be sent somewhere different.

The most common form affecting businesses is Business Email Compromise (BEC), where fraudsters impersonate executives, vendors, or clients to trick employees into wiring money or sharing sensitive information [3].

2024 has already exceeded the $12.5 billion dollars of loss reported in the year 2023.

Real-world examples illustrate how sophisticated these schemes have become [3].

Two tech giants—Google and Facebook—were phished out of $100 million by a Lithuanian fraudster who impersonated a hardware supplier to falsely invoice both companies over two years, and despite their technological sophistication, the companies lost the money, although they were later able to recuperate the majority of the funds stolen.

For more information on how these attacks work, read our guide on social engineering fraud coverage [1].

Traditional Crime Insurance: What It Covers Crime insurance has been protecting businesses for decades against employee theft, forgery, and other fraudulent acts. Traditional commercial crime policies typically cover:

Employee dishonesty: Theft or fraud committed by your employees
Forgery or alteration: Fraudulent checks or financial instruments
Theft of money and securities: Physical theft from your premises
Computer fraud: Unauthorized access to your computer systems resulting in theft
Funds transfer fraud: Fraudulent instructions to transfer funds from your accounts

These coverages work well for traditional crimes where someone physically steals from your business or hacks into your systems. But social engineering fraud operates differently—it doesn't require breaking into anything. The fraudster simply tricks an authorized person into voluntarily transferring money.

The Coverage Gap: Why Crime Insurance Often Excludes Social Engineering

Here's where many business owners get blindsided. Most traditional crime insurance policies contain exclusions that specifically eliminate coverage for social engineering fraud. Why? Because insurers classify these losses differently than traditional theft or computer fraud.

The key distinction lies in the voluntary nature of the transfer. When your employee willingly authorizes a payment based on fraudulent instructions, many insurers argue this doesn't constitute "theft" or "computer fraud" as defined in standard crime policies. The computer system worked exactly as intended—the problem was the human decision-making process.

Understanding crime insurance exclusions is critical for small business owners who want to avoid nasty surprises when filing a claim.

Common Exclusions That Eliminate Social Engineering Coverage

Traditional crime insurance policies typically contain several exclusions that can eliminate coverage for social engineering losses:

Voluntary Parting Exclusion

This is the most common exclusion affecting social engineering claims. It states that the policy doesn't cover losses where an employee voluntarily parts with money or property, even if induced to do so by fraudulent means. Since social engineering relies on tricking employees into authorizing legitimate transactions, this exclusion often applies.

Authorized Access Exclusion

Many computer fraud coverages exclude losses when someone with authorized access to your systems initiates the transfer. In social engineering scenarios, your own employee—who has legitimate access—makes the transfer, triggering this exclusion.

Indirect Loss Exclusion

Some policies exclude "indirect" losses or losses that result from someone deceiving an employee into making a payment. Insurers may argue that social engineering losses are indirect because the fraud didn't directly access your accounts—it went through your employee first.

Transfer Fraud Limitations

Even when policies include funds transfer fraud coverage, they often limit it to situations where the fraudster directly accesses your bank account or forges transfer instructions. Social engineering attacks that manipulate employees into making authorized transfers may fall outside this coverage.

The Evolution: Social Engineering Coverage Endorsements

Recognizing the growing threat, many insurers now offer social engineering fraud coverage—but typically as an optional endorsement or rider to your crime policy, not as standard coverage. This separate coverage specifically addresses the gap left by traditional crime insurance exclusions.

Most carriers limit social engineering coverage to sublimits between $100,000 and $250,000.

This means even if your overall crime policy has a $1 million limit, your social engineering coverage might max out at $250,000 [4].

Key features of social engineering endorsements typically include:

Separate sublimits: Lower limits than your main crime coverage
Higher deductibles: Often $10,000 to $25,000 per claim
Strict notification requirements: You must report suspected fraud immediately
Recovery assistance: Some policies include help recovering transferred funds
Training requirements: Insurers may require employee training as a condition of coverage

For a detailed comparison, check out our article on social engineering fraud: crime vs cyber insurance.

Crime Insurance vs Cyber Insurance: Which Covers Social Engineering?

The line between crime insurance and cyber insurance has blurred significantly as fraud has become increasingly digital. This creates confusion about which policy covers social engineering losses.

Crime Insurance with Social Engineering Endorsement:

Covers the direct financial loss from fraudulent fund transfers
Focuses on the monetary theft itself
Typically doesn't cover investigation costs or business interruption
May not cover losses involving third-party vendors

Cyber Insurance:

May include social engineering coverage as part of cyber crime coverage
Often covers broader consequences like forensic investigation costs
May include coverage for business email compromise
Typically covers notification costs and credit monitoring if data is compromised

The challenge is that neither policy automatically covers social engineering fraud in all scenarios. You need to carefully review both policies and understand how they interact. In some cases, you might need both types of coverage to be fully protected.

Real-World Scenarios: When Coverage Applies (and When It Doesn't)

Understanding how these policies work in practice helps illustrate the importance of proper coverage:

Scenario 1: The Fake Vendor Invoice
Your accounts payable clerk receives an email that appears to be from your regular supplier, requesting payment to a new bank account. The email looks legitimate, using the vendor's logo and similar email address. Your employee wires $75,000 to the fraudulent account.

Traditional crime policy: Likely denied due to voluntary parting exclusion
Crime policy with social engineering endorsement: Covered, subject to sublimit and deductible
Cyber insurance: May be covered under social engineering or cyber crime coverage

Scenario 2: The CEO Impersonation
An employee receives an urgent email appearing to be from your CEO, requesting an immediate wire transfer for a confidential acquisition. The employee complies, transferring $150,000 to the fraudster.

Traditional crime policy: Likely denied—no computer system was hacked
Crime policy with social engineering endorsement: Covered
Cyber insurance: Potentially covered under business email compromise coverage

Scenario 3: The Compromised Email Account
A fraudster hacks into your CFO's actual email account an