Social Engineering Fraud Insurance: Coverage, Examples and What to Look For
Key Takeaways
- Social engineering fraud insurance provides cover in the event that an employee falls victim to a social engineering scam.
- Social engineering is the art of manipulating people’s emotions in order to get them to do things they otherwise wouldn’t do.
- Hackers, fraudsters, and cyber criminals use a wide range of tricks to get their targets to divulge private or sensitive information for illegitimate purposes.
- Social engineering fraud affects all kinds of organizations.
- Social engineering fraud insurance is not a standalone insurance; it may be added to a cyber or a commercial crime insurance policy as an extension.
What is Social Engineering Fraud insurance?
Social engineering fraud (SEF) insurance coverage offers financial protection to organizations when they incur monetary loss due to an employee falling victim to a social engineering scam. It specifically covers loss caused by the good faith transfer of money, securities, or other property as a direct result of fraudulent instructions given by a person purporting to be a vendor, client, supplier, or employee authorized to provide such instruction.
Fraudsters are constantly targeting businesses. Despite all the security measures an organization may employ, criminals may still be successful in manipulating a well-meaning employee into transferring a large sum of money. Social engineering fraud coverage reduces the financial impact on an organization of loss that results from SEF.
Understanding Social Engineering Fraud
Social Engineering Fraud
Social engineering fraud (SEF) is the use of psychology to manipulate someone in order to gather information or persuade them to take actions they otherwise wouldn’t do. This may take the form of disclosing sensitive information to be used by a fraudster for illegitimate purposes or transferring funds to a fraudster’s account.
Fraudsters search organizations looking for points of vulnerability and use a wide range of tricks to manipulate their targets, such as phishing scams sent through email and social media, to telephone calls (vishing) and text messaging (smishing). Social engineering fraud is a widespread problem. It affects all organizations alike, regardless of size – small, medium, or large; or industry sector.
Example 1
A fraudster, posing as a company’s Chief Financial Officer, emails the CEO’s assistant requesting a $155,000 wire transfer to a foreign vendor’s new bank account. Five hours after executing the wire transfer, the assistant discovers they have been duped.
Example 2
A fraudster impersonates a long-standing supplier and emails an employee advising that the supplier has changed banks. The employee updates the supplier’s banking information and subsequently sends a $75,000 invoice payment to the fraudster’s account.
How prevalent is social engineering fraud?
According to Barracuda’s 2026 Email Threats Report, phishing accounts for 48% of malicious email activity, highlighting how heavily cybercriminals continue to rely on social engineering to target organizations.
Business email compromise (BEC) is one of the most financially damaging forms of social engineering fraud. According to the FBI Internet Crime Complaint Center’s 2025 Annual Report, approximately $3 billion in reported losses were attributed to business email compromise in 2025.
These attacks often involve criminals impersonating executives, employees, vendors, or other trusted parties to persuade someone to transfer funds, change payment instructions, or disclose sensitive information.
Where to find Social Engineering Fraud coverage?
Social engineering fraud coverage is commonly provided as part of, or by endorsement to, a commercial crime or cyber insurance policy rather than purchased as a standalone policy. Some insurers may automatically include limited SEF coverage on a crime or cyber insurance policy. Typically, however, buyers add SEF cover to a cyber or a commercial crime insurance policy as an extension to the base policy. Review your policy wording carefully when checking for SEF coverage. It may appear under a different name such as “fraudulent instruction coverage“. It’s also very important to note that SEF insurance does not necessarily respond to every type of social engineering loss. The wording may be very specific about what it will and will not cover.
Cyber Insurance
Cyber insurance policies offer protection against financial loss due to data breaches and other cyber security issues. Some cyber insurance policies also offer an extension for social engineering fraud.
Commercial Crime Insurance
Commercial crime insurance is a type of property insurance that covers the loss that a commercial organization suffers from damage to, or destruction or disappearance of, its own property as a direct result of crime; such as theft, fraud or embezzlement.
Which insurance policy to buy for SEF cover?
How do you decide if a cyber insurance policy, a commercial crime insurance policy, or both is the right purchase for you? It all depends on the terms and conditions, and pricing, that insurers offer to your organization. When you want to purchase insurance coverage, look on your commercial crime or cyber insurance policy for a separate insuring clause that covers social engineering fraud. The coverage will vary from insurer to insurer.
Social engineering fraud coverage is often subject to a sublimit that is lower than the policy’s overall limit. Available limits, retentions, and coverage terms vary considerably by insurer and policy.
Since SEF coverage is sublimited and varies from one insurer to the next, you may also want to consider purchasing coverage under both a cyber and a commercial crime policy to obtain broader coverage overall. Obtaining coverage under both cyber and commercial crime insurance policies may be helpful if coverage is coordinated.
‘Coordinating’ coverage refers to the process used by insurance companies to determine which insurer pays what and when in the event of a claim when there are overlaps in coverage.
Insurance buyers should work with a knowledgeable professional to coordinate the coverages. This usually entails adding details to the policies that stipulate which policy would respond first.
Beware that SEF coverage on a cyber insurance policy may not always include the following. For these, the commercial crime insurance policy is more likely to respond:
- Extra expense coverage for investigating, determining, and proving the loss;
- Losses where the fraudster has colluded with an employee (i.e., employee dishonesty);
- Computer fraud transfer coverage; and
- Fund transfer fraud coverage.
On the other hand, cyber insurance policies typically offer broader coverage and services such as a Breach Coach®, and IT forensics, which may respond in different types of social engineering fraud scenarios.
Application checklist
When you apply to purchase social engineering fraud coverage, insurance companies will evaluate your organization to assess the risk. Expect a SEF-specific application form with questions about previous experience with SEF and policies and procedures such as the following:
1. Supervisor review of all vendor/supplier record changes
Does your organization require that a supervisor confirm and verify all changes to supplier/vendor details?
2. Employee training on social engineering fraud
Do you train your employees to update them on the latest trends in social engineering and cyber fraud, and teach them how to spot fraud attempts to avoid financial losses? Do you provide such training to all employees, not just those working in positions deemed sensitive by your organization?
3. Learning from previous experience with SEF – phishing, smishing, vishing
Have you or your employees previously fallen victim to social engineering fraud? Have you identified the weaknesses that made your organization vulnerable to the attack. For example, following an email link without verifying the sender, or divulging confidential information. What did the organization learn, and what is it doing differently to prevent a reoccurrence?
4. Procedures for verifying new customers, vendors, suppliers, and account changes
Are there controls in place around the process of verifying new customers, vendors, and suppliers’ bank and contact information?
5. Independent verification of payment and account-change instructions
Does your organization require employees to independently verify requests to transfer funds or change banking information using a trusted method of communication? For example, an employee may be required to call a known contact using a previously verified telephone number rather than relying on the contact information provided in an email requesting the change.
Fraudsters are also progressing along with advances in technology. They will always be on the lookout for fresh methods of committing financial fraud. Verifying information received by emails and establishing the identity of the one who provided it is important, even if the email appears to be from a trusted vendor, supplier, or employee.
