Money lost to fraud is rarely covered elsewhere.

The insuring agreements, and where social engineering fits

The June 2022 ISO discovery form (CR 00 22 06 22) lists eight insuring agreements: Fidelity (employee theft, ERISA plan official dishonesty, and employee theft of clients' property); forgery or alteration; inside the premises, theft of money and securities; inside the premises, robbery or safe burglary of other property; outside the premises; computer and funds transfer fraud; fraudulent impersonation; and money orders and counterfeit money. Coverage applies only to the agreements with a limit shown in the declarations, and IRMI describes fraudulent impersonation as optional.

• Computer and funds transfer fraud is designed for a fraudulent entry or change of data in a computer system that moves money beyond your control, and for a bank debiting your account on a transfer instruction an imposter issued in your name.
• Fraudulent impersonation is designed for the case where your own staff, acting in good faith, change a vendor's or client's bank details or send money on a fake instruction.

Before that agreement existed, courts split on whether computer fraud wording reached these losses. In Apache Corp. v. Great American (5th Cir., Oct. 18, 2016), a phone call and an email from a look-alike domain changed a vendor's bank account, and the confirming call went to the number on the fake letterhead. The court called the email "merely incidental" and rendered judgment for the insurer. In Medidata Solutions v. Federal (2d Cir., July 6, 2018, summary order), spoofed emails that appeared to come from a senior executive led to a transfer; the court held the spoofing attack was "the proximate cause" of the loss and affirmed coverage under that policy's computer fraud provision.

Each ruling turned on that policy's words. Ask for impersonation coverage by name and read its limit. IRMI notes that social engineering coverage on a cyber policy comes by endorsement and applies excess of any crime policy; see cyber liability.

What to read for before a loss

• Termination as to an employee. In the 2022 ISO form, coverage for an employee or ERISA plan official ends as soon as a designated person, or someone in your HR department, not in collusion with them, learns of theft or another fraudulent or dishonest act by that person, whether before or after they were hired. Risk Management magazine notes this can apply with no immediate loss, and that some wordings add time limits or dollar thresholds. Read for that trigger before leaving anyone near money after a red flag.
• Inventory shortages. The ISO Fidelity coverages exclude loss whose existence or amount depends on an inventory or profit-and-loss computation; once you establish the loss wholly apart from those, the form lets you offer inventory records and a physical count to support the amount. Keep records that show the theft itself.
• Deadlines. The 2022 ISO discovery form asks for notice as soon as possible, a sworn proof of loss within 120 days, and any lawsuit within two years from discovery. Other wordings, Risk Management magazine notes, require notice "at the earliest practicable moment."
• Verification. For fraudulent impersonation, the ISO form requires a reasonable effort to verify a change of account request or transfer instruction, not through email, with the vendor or client or with a different authorized person, documented before money moves. Have staff call a number you already had, not one on the request.

If something looks off, tell me before anyone is confronted, so notice goes in on time.