Social Engineering Fraud
Social engineering fraud is a scheme in which criminals deceive an employee into voluntarily sending money or other property, typically by impersonating a vendor, executive or client. Coverage is usually added by endorsement to a crime or cyber policy and carries a sublimit.
Last updated October 13, 2026
How social engineering fraud works
Instead of breaking into a system, the criminal persuades a person to act. The person is typically tricked by a message or call that appears to come from a trusted party, such as a supplier with new bank details, an executive requesting an urgent transfer, or a client asking for a payment redirect. Business email compromise is one common form.
How insurance may respond
Standard crime policies usually exclude losses where the insured voluntarily parts with money, even if deceived. Insurers therefore offer social engineering or impersonation fraud coverage as an endorsement or as part of a cyber policy. According to Chubb and Amwins:
- Coverage is often available as an endorsement to a crime policy or as an impersonation fraud grant within cyber coverage.
- It is typically subject to a sublimit that is lower than the main policy limit, and limits and terms vary by insurer.
- Some policies require verification, such as a callback to a known number or another authentication step, and may reduce or deny a claim if it was skipped.
Forms differ on what triggers coverage and what property is included, so the wording is decisive. See our crime and fidelity and cyber pages for general background.
Social engineering fraud vs. related terms
Several coverages touch the same losses, and the labels are easy to mix up. The differences usually turn on who authorized the payment and how the criminal got in.
- Funds transfer fraud. This crime coverage typically responds when a criminal sends fraudulent instructions to a bank to move money out of the insured's account without the insured's knowledge or consent. In social engineering, your own employee knowingly sends the payment, having been deceived. The two are often written as separate grants with separate limits.
- Employee theft. Employee dishonesty coverage, found in crime insurance, addresses theft by the company's own people. Social engineering involves outsiders deceiving honest employees.
- Ransomware and extortion. In ransomware, the criminal locks systems or threatens exposure and demands payment. In social engineering, the victim believes the payment is legitimate.
- Business email compromise. BEC is a method, often a spoofed or hijacked mailbox. Social engineering fraud is the broader category, and the coverage is usually written around the result, an impostor-induced payment, not the technique.
Example
An accounts payable employee receives an email that appears to be from a regular supplier, asking to update its bank account. The employee pays a $180,000 invoice to the new account without calling the supplier. The policy has a social engineering sublimit and a callback condition. The insurer may reduce or decline the claim depending on the sublimit and whether the verification requirement was met.
A second example
A finance lead at a hypothetical payments startup gets a call from someone claiming to be from the company's bank, warning of suspicious activity and asking for approval to move funds to a "protected" account. The caller sounds credible and knows some account details. The transfer goes out. Whether the policy responds depends on its wording: for example, whether the definition of impersonation covers a caller posing as a financial institution, whether phone instructions qualify, and whether the verification condition was met. This is why the exact grant and its conditions matter more than the headline limit.
What to watch for
- Sublimits. Check how the sublimit compares with your typical payment sizes.
- Verification conditions. Make sure procedures match what the policy requires, and that staff follow them.
- Two policies, one loss. Cyber and crime forms can overlap or leave gaps. Ask how they coordinate.
- Data theft is different. Losses from stolen or disclosed data are usually addressed under cyber liability rather than a funds-transfer endorsement.
Questions to ask your broker or underwriter
- Is the coverage written as a crime endorsement, a cyber grant, or both, and does it have its own sublimit and retention?
- Whom must the impostor pretend to be: a vendor, an executive, a client, an employee, a bank? Is any of those left out?
- Which channels count: email only, or also phone, text, chat and video calls? Ask specifically how the form treats synthetic voice or video impersonation.
- Does the verification condition apply to every payment or only above a threshold, and what counts as verification?
- Does the definition of money or property include securities or digital assets, and does it reach funds you hold for customers?
- If a crime policy and a cyber policy both have a grant, which responds first, and could a dispute leave a gap?
Common mistakes
- Assuming a standard crime policy covers deceived-employee losses. Many forms exclude voluntary transfers unless this coverage is added by endorsement.
- Buying a sublimit well below the size of a normal wire or invoice batch.
- Writing a callback procedure into the insurance application but not following it in practice.
- Relying on one person to both set up and approve a new payee.
Why it matters for technology, AI, fintech and digital-asset companies
Companies that move funds frequently, or hold customer funds, see many payment instructions, which gives impostors more chances to look routine. Chubb and Amwins note that client-funds coverage is emerging and not offered by every insurer, so ask what property and whose money the policy addresses.
Fintech and payments companies handle a steady flow of payment instructions, and a request to change bank details can look like routine work. Digital-asset companies add another wrinkle: transfers of digital assets can be hard or impossible to reverse, so the question of whether the policy's definition of money or property reaches digital assets deserves a direct answer in writing. Venture-backed companies with small finance teams may also lack a second approver, which is both a risk and, often, an underwriting question. For more background, see our pages for fintech and digital assets, and digital asset insurance.
See how this applies in practice: fidelity and crime insurance and tech E&O and cyber insurance.
Related terms
Frequently asked questions
What is social engineering fraud?
Social engineering fraud is a scheme in which criminals deceive an employee into voluntarily sending money or other property, typically by impersonating a vendor, executive or client. Coverage is usually added by endorsement to a crime or cyber policy and carries a sublimit. Verification conditions often apply.
Is social engineering fraud covered by a standard crime policy?
Usually not by default. Standard crime forms often exclude voluntary transfers made by the insured, even when the person was deceived. Coverage is typically added by a social engineering or impersonation fraud endorsement, often with a sublimit and conditions, so check your policy.
What is a callback verification requirement?
It is a policy condition requiring the insured to verify a payment request or bank change, for example by calling a known phone number or using another authentication step, before paying. If the condition is not met, the insurer may reduce or deny the claim.
How does social engineering fraud differ from cyber crime?
Social engineering relies on persuading a person to send money or property voluntarily. Traditional cyber events involve unauthorized access to systems or data. Some schemes involve both, which is why policies may address them under crime, cyber, or both, with different limits.
Does cyber insurance cover social engineering fraud?
Sometimes. Some cyber policies include an impersonation or social engineering fraud coverage grant, usually with a sublimit, while others leave that exposure to a crime policy. Because forms differ, check which policy carries the grant and what conditions apply.
What are common examples of social engineering fraud?
Typical examples include a fake request from a supplier to change bank details, a message posing as an executive asking for an urgent wire, a fraudulent invoice that looks like a regular one, and a caller pretending to be from the company's bank. The common thread is that a person is persuaded to send money voluntarily.
How can a company reduce social engineering fraud risk?
Common steps include a written procedure to verify payment requests and bank changes by calling a known number, requiring two people to approve new payees or large transfers, and training staff to recognize pressure and urgency. Controls like these also tend to line up with policy verification conditions, but they do not guarantee that a claim will be paid.
Does social engineering coverage apply to cryptocurrency transfers?
It depends on how the policy defines the money or property that is covered. Some forms address digital assets only through specific wording or an endorsement, so confirm in writing whether a transfer of digital assets to an impostor would qualify.
Need this coverage, or just a clear answer?
Our brokers translate terms like Social Engineering Fraud into a program built for how your company actually operates, and read every policy for the exclusions that matter.
Book a consultation → (opens in a new tab)